2558 matches found
Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector
Summary This is a related but independently fixable vulnerability to GHSA-qqf5-x7mj-v43p PostgreSQL SQL injection, reported in the same original disclosure and split per GitHub CNA guidance rule 4.2.11 since it affects a separate integration, has a distinct attack precondition, and requires a...
GHSA-2XGG-R2WC-C5R2 Budibase: MySQL DESCRIBE Backtick Injection via multipleStatements in Database Connector
Summary This is a related but independently fixable vulnerability to GHSA-qqf5-x7mj-v43p PostgreSQL SQL injection, reported in the same original disclosure and split per GitHub CNA guidance rule 4.2.11 since it affects a separate integration, has a distinct attack precondition, and requires a...
GHSA-Q6X4-V3QX-85QW Budibase: SQL Injection via `multipleStatements: true`
Summary A critical SQL injection vulnerability was discovered in Budibase's MySQL integration that allows remote attackers to execute arbitrary SQL commands. Details Vulnerability Type SQL Injection Description The MySQL integration component in Budibase is configured with multipleStatements: tru...
Budibase: SQL Injection via `multipleStatements: true`
Summary A critical SQL injection vulnerability was discovered in Budibase's MySQL integration that allows remote attackers to execute arbitrary SQL commands. Details Vulnerability Type SQL Injection Description The MySQL integration component in Budibase is configured with multipleStatements: tru...
SQL Injection
Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to SQL Injection via the multipleStatements configuration in the MySQL integration. An attacker can execute arbitrary SQL commands by injecting malicious input into user fields, potentially leading...
Duplicate Advisory: Writes in a PERMISSIONS clause bypass table permissions
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-66r2-5gwj-gxm2. This link is maintained to preserve external references. Original Description SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within...
CVE-2026-63733 SurrealDB before 3.2.0 Permissions Bypass via PERMISSIONS Clause
SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMISSIONS clauses execute with enforcement disabled. Attackers with permission to perform a guarded operation can write to tables they lack permission for by embedding CREATE, UPDAT...
CVE-2026-63733 SurrealDB before 3.2.0 Permissions Bypass via PERMISSIONS Clause
SurrealDB versions before 3.2.0 contain a permissions bypass vulnerability where data-modifying statements within PERMISSIONS clauses execute with enforcement disabled. Attackers with permission to perform a guarded operation can write to tables they lack permission for by embedding CREATE, UPDAT...
CVE-2024-58370
SurrealDB before 1.1.0 is affected: the parser does not enforce recursion depth limits for nested SurrealQL statements (including IF, RELATE, and attribute access). This allows an attacker to submit queries with excessive nesting, potentially causing a stack overflow and server crash. Affected pr...
MariaDB: Connector/C++: heap out-of-bounds read when malicious server field length exceeds declared column length in binary result path
A heap out-of-bounds read vulnerability was identified in the connector library when processing binary result sets. The vulnerability occurred because the buffer for each result column was sized based on the server-declared column length, but then the actual field length reported by the server in...
PT-2026-60861
Name of the Vulnerable Software and Affected Versions IBM Db2 versions 11.5.0 through 11.5.9 IBM Db2 versions 12.1.0 through 12.1.4 Description A trap occurs during the compilation of specially crafted statements containing subqueries, which can lead to a denial of service. Recommendations At the...
CVE-2026-52887
NocoBase is an AI-powered no-code/low-code platform for building business applications and enterprise solutions. Prior to 2.0.61, NocoBase @nocobase/plugin-notification-in-app-message exposed GET /api/myInAppChannels:list, where the filterlatestMsgReceiveTimestamp$lt value was inserted into a...
PT-2026-60296
Name of the Vulnerable Software and Affected Versions NocoBase versions prior to 2.0.61 Description An issue exists in the @nocobase/plugin-notification-in-app-message where the 'GET /api/myInAppChannels:list' endpoint is exposed. A signed-up authenticated user can exploit this by providing a val...
IBM API Connect SQL Injection Vulnerability (CNVD-2026-29413)
IBM API Connect is an integrated platform for managing APIs developed by IBM Corporation in the United States. IBM API Connect has a SQL injection vulnerability. This vulnerability stems from the lack of validation for external SQL statements during the password reset function. Attackers can...
CVE-2026-57791
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeMove Brook brook allows PHP Local File Inclusion.This issue affects Brook: from n/a through = 2.9.0...
CVE-2026-57803 WordPress Struktur Core plugin < 2.7 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Select-Themes Struktur Core allows PHP Local File Inclusion. This issue affects Struktur Core: from n/a before 2.7...
PT-2026-59235
Summary SQLChatAgent in langroid ships a validate query defense-in-depth layer whose DANGEROUS SQL PATTERNS regex blocklist enumerates dangerous SQL primitives by specific function name. The list misses the canonical PostgreSQL filesystem-disclosure family pg read file, pg stat file, pg ls logdir...
SiYuan: Unauthenticated SQLite Data Exfiltration via Template Injection in /api/icon/getDynamicIcon
Summary The /api/icon/getDynamicIcon endpoint is explicitly excluded from authentication in SiYuan's kernel router router.go, "不需要鉴权" -- no auth needed. When called with type=8 and a valid block id parameter, this endpoint invokes RenderDynamicIconContentTemplate, which executes a Go template tha...
GHSA-HM42-Q32M-VJ4F Admidio: CSRF on Plugin Install, Uninstall, and Update via Unprotected GET Requests
Summary The modules/plugins.php endpoint handles plugin installation, uninstallation, and update operations via GET requests without CSRF token validation. Because these are top-level navigations, browsers include SameSite=Lax session cookies. An attacker crafts a malicious page that, when an...