1479 matches found
EUVD-2025-32372
The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter binding. As a result, an authenticated staff user level ≥ 1 can inject SQL to alter the filter logic, effectively bypassing department scoping...
CVE-2025-10692 OpenSupports 4.11.0 — SQL Injection
The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter binding. As a result, an authenticated staff user level ≥ 1 can inject SQL to alter the filter logic, effectively bypassing department scoping...
CVE-2025-10692
CVE-2025-10692 describes an SQL injection in OpenSupports 4.11.0 via POST /api/staff/get-new-tickets, where the user-supplied departmentId is concatenated into the SQL WHERE clause without parameter binding. An authenticated staff user (level ≥ 1) can alter filtering to access tickets outside the...
CVE-2025-10692 OpenSupports 4.11.0 — SQL Injection
The endpoint POST /api/staff/get-new-tickets concatenates the user-controlled parameter departmentId directly into the SQL WHERE clause without parameter binding. As a result, an authenticated staff user level ≥ 1 can inject SQL to alter the filter logic, effectively bypassing department scoping...
EUVD-2025-30245
Malicious code in bioql PyPI...
EUVD-2023-32425
Malicious code in bioql PyPI...
EUVD-2024-43340
Malicious code in bioql PyPI...
EUVD-2024-53986
Malicious code in bioql PyPI...
EUVD-2022-52774
Malicious code in bioql PyPI...
EUVD-2022-39416
Malicious code in bioql PyPI...
EUVD-2024-36834
Malicious code in bioql PyPI...
EUVD-2022-32477
Malicious code in bioql PyPI...
EUVD-2025-28773
Malicious code in bioql PyPI...
EUVD-2025-19508
Malicious code in bioql PyPI...
EUVD-2025-9612
Malicious code in bioql PyPI...
EUVD-2025-1897
Malicious code in bioql PyPI...
EUVD-2025-20498
Malicious code in bioql PyPI...
EUVD-2023-56238
Malicious code in bioql PyPI...