CVE-2025-22207

CVE-2025-22207 is a Joomla! SQL injection in the backend task list of the com_scheduler component caused by improperly built ORDER clauses. Affected versions include Joomla! 4.x earlier than 4.4.11 and 5.x earlier than 5.2.4, per connected scanner/NVD data. The vulnerability allows an attacker to...

PT-2025-6940

Name of the Vulnerable Software and Affected Versions: com scheduler affected versions not specified Description: The issue is related to improperly built order clauses, which lead to a SQL injection vulnerability in the backend task list of com scheduler. This vulnerability may allow attackers t...

CVE-2025-22207: Improper Neutralization of Special Elements used in an SQL Command

Improperly built order clauses lead to a SQL injection vulnerability in the backend task list of comscheduler...

CVE-2024-13500: Improper Neutralization of Special Elements used in an SQL Command

The WP Project Manager – Task, team, and project management plugin featuring kanban board and gantt charts plugin for WordPress is vulnerable to time-based SQL Injection via the ‘orderby’ parameter in all versions up to, and including, 2.6.17 due to insufficient escaping on the user supplied...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the download function due to improper input validation when processing image references during task exports. . An attacker can access files outside the intended directory structure by creating tasks with path...

Directory Traversal

Overview label-studio is a Label Studio annotation tool Affected versions of this package are vulnerable to Directory Traversal via the download function due to improper input validation when processing image references during task exports. . An attacker can access files outside the intended...

CVE-2023-42663

Apache Airflow, versions before 2.7.2, has a vulnerability that allows an authorized user who has access to read specific DAGs only, to read information about task instances in other DAGs. Users of Apache Airflow are advised to upgrade to version 2.7.2 or newer to mitigate the risk associated wit...

CVE-2023-39508

Execution with Unnecessary Privileges, : Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Airflow.The "Run Task" feature enables authenticated user to bypass some of the restrictions put in place. It allows to execute code in the...

CVE-2024-28276

Sourcecodester School Task Manager 1.0 is vulnerable to Cross Site Scripting XSS via add-task.php?taskname=...

CVE-2024-28277

In Sourcecodester School Task Manager v1.0, a vulnerability was identified within the subjectname= parameter, enabling Stored Cross-Site Scripting XSS attacks. This vulnerability allows attackers to manipulate the subject's name, potentially leading to the execution of malicious JavaScript payloa...

CVE-2024-26517

SQL Injection vulnerability in School Task Manager v.1.0 allows a remote attacker to obtain sensitive information via a crafted payload to the delete-task.php component...

PT-2025-16760

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.14.0-rc1-next-20250206-xfstests-dirty 726 Description A vulnerability in the Linux kernel has been resolved, which could cause a hung task if ext4 inode attach jinode fails in ext4 setattr. This failure prevent...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: iouring: check if iowq is killed before queuing Task work can be executed after the task has gone through iouring termination, whether it’s the final taskwork run or the fallback path. In this case, task work finds -iowq to be...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: perf: Fix event leak upon exit When a task is scheduled out, pending sigtrap deliveries are deferred to the target task upon resume to user space via taskwork. However, failures during the addition of an event’s callback to the...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Flush all requests after setting CACHEFILESDEAD In ondemand mode, when the daemon is processing an open request, if the kernel flags the cache as CACHEFILESDEAD, cachefilesdaemonwrite will always return -EIO, preventi...

Astra Linux – vulnerability in linux-6.1

In the Linux kernel, the following vulnerability has been resolved: perf: Fix event leak upon exec and file release The perf pending task work is never waited upon for the matching event release. In the case of a child event released via freeevent, this can potentially result in a leaked event, a...

Azure Linux 3.0 Security Update: kernel (CVE-2024-46798)

The version of kernel installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-46798 advisory. - In the Linux kernel, the following vulnerability has been resolved: ASoC: dapm: Fix UAF for sndsocpcmruntime...

CVE-2025-0982

Sandbox escape in the JavaScript Task feature of Google Cloud Application Integration allows an actor to execute arbitrary unsandboxed code via crafted JavaScript code executed by the Rhino engine. Effective January 24, 2025, Application Integration will no longer support Rhino as the JavaScript...

SQL Injection

Overview yascheduler is a Yet another computing scheduler and cloud orchestration engine Affected versions of this package are vulnerable to SQL Injection in the queuesubmittask function. Remediation Upgrade yascheduler to version 1.0.7 or higher. References - GitHub Commit...

CVE-2025-0982

Sandbox escape in the JavaScript Task feature of Google Cloud Application Integration allows an actor to execute arbitrary unsandboxed code via crafted JavaScript code executed by the Rhino engine. Effective January 24, 2025, Application Integration will no longer support Rhino as the JavaScript...