287953 matches found
CVE-2026-77051
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized entityKey and opEvent parameters. This issue affects...
CVE-2026-77051 Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized entityKey and opEvent parameters. This issue affects...
CVE-2026-77051
Apache Syncope is vulnerable to an SQL Injection vulnerability due to improper neutralization of special elements used in SQL commands. An administrator with adequate entitlements can execute arbitrary SQL via stacked queries by leveraging unsanitized entityKey and opEvent parameters. This issue ...
CVE-2026-77051 Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked queries, leveraging unsanitized entityKey and opEvent parameters. This issue affects...
Astra Linux – Vulnerability in Mariadb 10.3
It has been discovered that MariaDB Server v10.9 and below contains a segmentation fault through the component sql/itemfunc.cc:148...
Astra Linux – Vulnerability in Python-Django
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. .QuerySet.orderby is vulnerable to SQL injection when column aliases containing periods are used, provided that the same alias is used in FilteredRelation through a properly crafted dictionary expansion...
Astra Linux – Vulnerability in pgbouncer
In PgBouncer, the untrusted search path in the authquery connection handler before version 1.25.1 allows an unauthenticated attacker to execute arbitrary SQL during authentication through a malicious searchpath parameter in the StartupMessage...
Astra Linux – Vulnerability in Sogo
SOGo versions 5.12.7 and earlier contain a SQL injection vulnerability in the Access Control List management functionality. This vulnerability allows authenticated users to extract arbitrary data from the database by injecting SQL subqueries through the uid parameter of the addUserInAcls endpoint...
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection via the Neo4j persistence layer when processing FIQL search conditions. An attacker can execute arbitrary Cypher queries by crafting malicious FIQL search inputs. Remediation Upgrade...
SQL Injection
Overview org.apache.syncope.core:syncope-core-persistence-jpa is an Open Source system for managing digital identities in enterprise environments, implemented in Java EE technology and released under Apache 2.0 license. Affected versions of this package are vulnerable to SQL Injection via the sor...
Astra Linux – Vulnerability in Mariadb 10.3
A issue was discovered in the Field::setdefault component of MariaDB Server v10.6 and earlier versions. This issue allows attackers to cause a Denial of Service DoS attack through specially crafted SQL statements...
Astra Linux – Vulnerability in PHP 7.3, PHP 8.1
In PHP versions 8.0. before 8.0.27, 8.1. before 8.1.15, and 8.2. before 8.2.2, when using the PDO::quote function to quote user-supplied data for SQLite, providing an overly long string may cause the driver to incorrectly quote the data. This can further lead to SQL injection vulnerabilities...
Astra Linux – Vulnerability in libpgjava
pgjdbc, the PostgreSQL JDBC Driver, allows attackers to inject SQL statements if the PreferQueryMode=SIMPLE setting is used. Note that this is not the default setting. In the default mode, there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus sign...
Astra Linux – Vulnerability in pgbouncer
When PgBouncer is configured to use “cert” authentication, a man-in-the-middle attacker can inject arbitrary SQL queries when a connection is first established, despite the use of TLS certificate verification and encryption. This flaw affects PgBouncer versions prior to 1.16.1...
Astra Linux – Vulnerability in Chromium
Before version 105.0.5195.52, using WebSQL in Google Chrome allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page...
Astra Linux – Vulnerability in PostgresSQL 11
A late privilege drop in the REFRESH MATERIALIZED VIEW CONCURRENTLY operation in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. This feature enables the owner of the materialized view to run SQL functions, thereby allowing for the safe refreshing of...
Astra Linux – Vulnerability in Python-Django
A issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. Methods like QuerySet.annotate, QuerySet.alias, QuerySet.aggregate, and QuerySet.extra are vulnerable to SQL injection when column aliases are used, especially when a properly crafted dictionary is passed...
Astra Linux – Vulnerability in Python-Django
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on “RasterField” implemented only on PostGIS allow remote attackers to inject SQL through the band index parameter. Earlier, unsupported versions of Django such as 5.0.x, 4.1.x, and 3.2.x were no...
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2026-76461 Cisco Secure Email Gateway SQL Injection Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses...
