239449 matches found
CVE-2026-73850 Emlog: Arbitrary SQL Execution Vulnerability in ai.php within queryDatabase() Function
Emlog is an open source website building system. In 2.6.20 and earlier, there is a SQL injection vulnerability in the queryDatabase function in ai.php...
CVE-2026-73850
CVE-2026-73850 affects Emlog (open source website building system). The vulnerability is a SQL injection in the function queryDatabase() inside ai.php for version 2.6.20 and earlier. The described impact is arbitrary SQL execution, enabling an attacker with network access and high privileges (per...
CVE-2026-73850
Emlog is an open source website building system. In 2.6.20 and earlier, there is a SQL injection vulnerability in the queryDatabase function in ai.php...
CVE-2026-73850 Emlog: Arbitrary SQL Execution Vulnerability in ai.php within queryDatabase() Function
Emlog is an open source website building system. In 2.6.20 and earlier, there is a SQL injection vulnerability in the queryDatabase function in ai.php...
EUVD-2026-58743
A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database...
CVE-2026-19680
A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database...
CVE-2026-19680 SQL Injection
A SQL injection vulnerability exists in Security Center that could allow an attacker to access unauthorized data from the application's database...
CVE-2026-19680
CVE-2026-19680 is a SQL injection vulnerability in Security Center that could allow an attacker to access unauthorized data from the application's database. The public records show a high-severity impact with CVSS metrics indicating network access and low privileges required. Tenable’s advisory f...
CVE-2026-73847
Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant executetool action in admin/ai.php lets a remote unauthenticated attacker submit a forged cross-site request from an attacker-controlled page to a recently logged-in administrator...
CVE-2026-73847
CVE-2026-73847 affects emlog (pro) up to 2.6.23. The AI Assistant endpoint admin/ai.php?action=execute_tool lacks CSRF protection, relies on a session cookie without SameSite, and uses a hardcoded public confirm gate. This enables a forged cross-site request from an admin in-session to execute SQ...
EUVD-2026-58740
Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant executetool action in admin/ai.php lets a remote unauthenticated attacker submit a forged cross-site request from an attacker-controlled page to a recently logged-in administrator...
CVE-2026-73847 Emlog: Missing CSRF protection in AI Assistant execute_tool leads to full database compromise and admin account takeover
Emlog is an open source website building system. In 2.6.26 and earlier, missing CSRF protection on the AI Assistant executetool action in admin/ai.php lets a remote unauthenticated attacker submit a forged cross-site request from an attacker-controlled page to a recently logged-in administrator...
CVE-2026-19631 SQL Injection
A SQL injection vulnerability exists in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries, potentially resulting in unauthorized access to sensitive data, including credentials...
EUVD-2026-58733
A SQL injection vulnerability exists in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries, potentially resulting in unauthorized access to sensitive data, including credentials...
CVE-2026-19631
CVE-2026-19631 describes a SQL injection vulnerability in Security Center that could allow an authenticated administrator to execute arbitrary SQL queries and access sensitive data, including credentials. Tenable’s advisory indicates Security Center 6.9.0 fixes multiple vulnerabilities and lists ...
CVE-2026-49989 CrateDB's Blob HTTP handler bypasses authorization
CrateDB is a distributed SQL database. Prior to versions 6.2.8 and 6.3.2, any authenticated user can read or delete any blob whose SHA-1 digest they know, and can plant new blobs unconditionally, in any blob table, regardless of GRANTs. CrateDB has two ways to access blob storage: SQL SELECT...
EUVD-2026-58717
CrateDB is a distributed SQL database. Prior to versions 6.2.8 and 6.3.2, any authenticated user can read or delete any blob whose SHA-1 digest they know, and can plant new blobs unconditionally, in any blob table, regardless of GRANTs. CrateDB has two ways to access blob storage: SQL SELECT...
CVE-2026-49989 CrateDB's Blob HTTP handler bypasses authorization
CrateDB is a distributed SQL database. Prior to versions 6.2.8 and 6.3.2, any authenticated user can read or delete any blob whose SHA-1 digest they know, and can plant new blobs unconditionally, in any blob table, regardless of GRANTs. CrateDB has two ways to access blob storage: SQL SELECT...
