Astra Linux – Vulnerability in Apache Log4j1.2

By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter, where the values to be inserted are converted using PatternLayout. The message converter %m is likely to always be included. This allows attackers to manipulate SQL statements by entering crafted...

Astra Linux – vulnerability in mariadb-10.3

It has been discovered that MariaDB Server versions v10.6.3 and earlier contain a use-after-free vulnerability in the Itemfuncin::cleanup component; this vulnerability can be exploited via specially crafted SQL statements...

Astra Linux – vulnerability in PostgreSQL 11

In the extension script, a SQL injection vulnerability was found in PostgreSQL when it uses @extowner@, @extschema@, or @extschema:...@ within a quoting construct dollar quoting, '', or "". If an administrator has installed files from a vulnerable, trusted, non-bundled extension, an attacker with...

Astra Linux – vulnerability in libhibernate3-java

A flaw was found in hibernate-core in versions prior to and including 5.4.23.Final. An SQL injection in the implementation of the JPA Criteria API can allow un sanitized literals to be used when a literal appears in the SQL comments of a query. This flaw may enable an attacker to access...

Astra Linux – vulnerability in PostgreSQL 11

A flaw was found in PostgreSQL versions prior to 13.1, prior to 12.5, prior to 11.10, prior to 10.15, prior to 9.6.20, and prior to 9.5.24. An attacker with permission to create non-temporary objects in at least one schema can execute arbitrary SQL functions under the identity of a superuser. The...

Astra Linux – vulnerability in mariadb-10.3

MariaDB versions prior to 10.6.5 contain an integer overflow in sqllex.cc, which can cause the application to crash...

Astra Linux – Vulnerability in PostgresSQL 11

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries during the initial establishment of a connection, despite the use of SSL certificate verification and encryption...

Astra Linux – vulnerability in mariadb-10.3

MariaDB CONNECT Storage Engine Stack-based Buffer Overflow Privilege Escalation Vulnerability. This vulnerability enables local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw lies in the processing...

Astra Linux – Vulnerability in OpenLDAP

In OpenLDAP 2.x versions before 2.5.12 and 2.6.x versions before 2.6.2, there is a SQL injection vulnerability in the experimental slapd backend, caused by a SQL statement within an LDAP query. This vulnerability can occur during an LDAP search operation, when the search filter is processed, due ...

Astra Linux – Vulnerability in Mariadb 10.3

MariaDB version 10.5.9 allows a sqlparse.cc application to crash due to incorrect expectations regarding usedtables...

Astra Linux – vulnerability in mariadb-10.3

It has been discovered that MariaDB Server versions v10.7 and earlier contain a segmentation fault caused by the sql/sqlclass.cc component...

Astra Linux – Vulnerability in Mariadb 10.3

It has been discovered that MariaDB Server v10.9 and earlier contains a segmentation fault due to the component sql/sqlwindow.cc...

Astra Linux – vulnerability in libpgjava

The PostgreSQL JDBC Driver abbreviated as PgJDBC enables Java programs to connect to a PostgreSQL database using standard, database-independent Java code. The PGJDBC implementation of the java.sql.ResultRow.refreshRow method fails to escape column names; therefore, a malicious column name...

Astra Linux – vulnerability in Zabbix

A non-administrator user account on the Zabbix frontend with the default User role, or with any other role that grants API access, can exploit this vulnerability. There is an SQL injection flaw in the CUser class within the addRelatedObjects function; this function is invoked via CUser.get, which...

WordPress FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler plugin <= 1.7.0 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Wordfence PRISM in WordPress Plugin FluentCart versions = 1.7.0...

CVE-2026-79843

A corrupted file may cause out-of-bounds read in HPE NonStop SQL/MX EXE under certain conditions, potentially leading to information disclosure, process termination, CPU halt, or data corruption...

CVE-2026-53574

EspoCRM is an open source customer relationship management application. From 8.1.0 until 9.3.8, an authenticated non-administrator can submit a crafted where parameter to the GET entity streamAttachments endpoint because that query path permits complex expressions. Boolean-based blind SQL injecti...

600,000 WordPress Sites Affected by SQL Injection Vulnerability in Backuply WordPress Plugin

On September 17th, 2026, we received a submission for a Second-Order SQL Injection vulnerability in Backuply, a WordPress plugin with more than 600,000 active installations. This vulnerability makes it possible for authenticated attackers with subscriber-level access and above to store a maliciou...

mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()

A flaw was found in MariaDB server. An application processing non-validated user input, which then uses mysqlrealescapestring and sends data to the database via text protocol with the big5 character set, is vulnerable to SQL injection. This allows a remote attacker to execute malicious SQL...

Important: Red Hat Security Advisory: mariadb-connector-c security update

An update for mariadb-connector-c is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...