CVE-2026-55418 FastGPT: S3 presign/read handlers do not bind the object key to the caller's team (cross-team file disclosure)

FastGPT is an open source AI knowledge base platform. Prior to v4.15.0-beta5, two FastGPT file handlers authorize an unrelated resource and then sign or read an S3 object using a key taken directly from the request, without checking that the key belongs to the caller's team. Because S3 object key...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection in the POST /api/v1/meters process when user-supplied input in the valueProperty or groupBy fields is improperly handled, allowing arbitrary SQL commands to be executed against the backend database. An attacker can gain...

CVE-2019-15557

XM^online 2 User Account and Authentication server 1.0.0 allows SQL injection via a tenant key...

CVE-2019-15557

XM^online 2 User Account and Authentication server 1.0.0 allows SQL injection via a tenant key...

CVE-2019-15557

XM^online 2 User Account and Authentication server 1.0.0 allows SQL injection via a tenant key...

Sql injection

XM^online 2 User Account and Authentication server 1.0.0 allows SQL injection via a tenant key...

CVE-2019-15557

XM^online 2 User Account and Authentication server 1.0.0 allows SQL injection via a tenant key...

CVE-2019-15557: Improper Neutralization of Special Elements used in an SQL Command

XM^online 2 User Account and Authentication server 1.0.0 allows SQL injection via a tenant key...