CVE-2026-75876

A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522Beta. Affected by this issue is some unknown functionality of the file ModuleController.java of the component Move Operations. Such manipulation of the argument sourcePath leads to sql injection. The attack may b...

CVE-2026-47720

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.2, the TDengine DAQ storage connector's escapeTdString function in server/runtime/storage/tdengine/index.js doubles single quotes but does not escape backslashes. A remote unauthenticated attacker can submit a...

CVE-2026-54348 Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration

Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update endpoints in lib/Froxlor/Api/Commands/Admins.php accept an attacker-controlled ipaddress array and store it as JSON in paneladmins.ip without enforcing numeric element types. When the poisoned...

EUVD-2026-61218

Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update endpoints in lib/Froxlor/Api/Commands/Admins.php accept an attacker-controlled ipaddress array and store it as JSON in paneladmins.ip without enforcing numeric element types. When the poisoned...

CVE-2026-54348

Froxlor (open-source server administration panel) prior to 2.3.8 is affected by a second-order SQL injection in its admin API. The Admins.add/Admins.update endpoints store an attacker-controlled ipaddress array as JSON in panel_admins.ip without numeric type enforcement. When the poisoned account...

CVE-2026-54348 Froxlor: Second-Order SQL Injection via `Admins.add` `ipaddress` Parameter Allows Full Database Exfiltration

Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update endpoints in lib/Froxlor/Api/Commands/Admins.php accept an attacker-controlled ipaddress array and store it as JSON in paneladmins.ip without enforcing numeric element types. When the poisoned...

CVE-2026-47720 FUXA: SQL injection in TDengine DAQ connector via backslash bypass of escapeTdString

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.2, the TDengine DAQ storage connector's escapeTdString function in server/runtime/storage/tdengine/index.js doubles single quotes but does not escape backslashes. A remote unauthenticated attacker can submit a...

CVE-2026-47720

FUXA (SCADA/HMI/Dashboard) versions before 1.3.2 contain a SQL injection (CWE-89) in the escapeTdString function at server/runtime/storage/tdengine/index.js:10, which doubles single quotes but fails to escape backslashes. Because TDengine's SQL parser treats \' as a literal quote, a crafted sids ...

CVE-2026-47720 FUXA: SQL injection in TDengine DAQ connector via backslash bypass of escapeTdString

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. Prior to 1.3.2, the TDengine DAQ storage connector's escapeTdString function in server/runtime/storage/tdengine/index.js doubles single quotes but does not escape backslashes. A remote unauthenticated attacker can submit a...

CVE-2026-75876 xianrendzw EasyReport Move Operations ModuleController.java sql injection

A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522Beta. Affected by this issue is some unknown functionality of the file ModuleController.java of the component Move Operations. Such manipulation of the argument sourcePath leads to sql injection. The attack may b...

CVE-2026-75876

EasyReport versions up to 2.0.17.0522_Beta contain a SQL injection in ModuleController.java via the sourcePath argument in the Move Operations component, exploitable remotely with low privileges; CVSS 6.3 (Medium) with proof-of-concept exploit disclosed; no patch version provided, project unrespo...

CVE-2026-75876 xianrendzw EasyReport Move Operations ModuleController.java sql injection

A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522Beta. Affected by this issue is some unknown functionality of the file ModuleController.java of the component Move Operations. Such manipulation of the argument sourcePath leads to sql injection. The attack may b...

EUVD-2026-61162

A security vulnerability has been detected in xianrendzw EasyReport up to 2.0.17.0522Beta. Affected by this issue is some unknown functionality of the file ModuleController.java of the component Move Operations. Such manipulation of the argument sourcePath leads to sql injection. The attack may b...

CNVD-2020-26585

creationtimestamp| type| source ---|---|--- 2026-08-18 19:00:04+00:00| seen| https://t.me/VulnerabilityNews/41921 2026-08-19 00:00:09+00:00| exploited| https://t.me/VulnerabilityNews/41921...

CVE-2026-65959

In Vitess 24.0.2 and earlier, the /debug/vrlog endpoint in vrlog.go calls vrlogStatsHandler() without acl.CheckAccessHTTP(r, acl.DEBUGGING), unlike comparable debug endpoints. A remote attacker reaching the vttablet debug HTTP port can stream live VReplication SQL statements and bound application...

CVE-2026-65959 Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data

Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler without acl.CheckAccessHTTPr, acl.DEBUGGING, unlike comparable deb...

EUVD-2026-61106

Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler without acl.CheckAccessHTTPr, acl.DEBUGGING, unlike comparable deb...

CVE-2026-65959 Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data

Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint in go/vt/vttablet/tabletmanager/vreplication/vrlog.go invokes vrlogStatsHandler without acl.CheckAccessHTTPr, acl.DEBUGGING, unlike comparable deb...

CVE-2026-49222

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product question operations allow a low-privileged Vendor to manage questions under another Vendor's products. The admin/sql/sqlite/productquestion.sql queries...

WordPress KiviCare plugin < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint vulnerability

Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint vulnerability discovered by Mokksh Parekh in WordPress Plugin KiviCare versions 4.5.2...