CVE-2026-28443 OpenReplay: SQL injection in cards/search via unvalidated sort field parameter

OpenReplay is a self-hosted session replay suite. Prior to version 1.20.0, the POST /projectId/cards/search endpoint has a SQL injection in the sort.field parameter. This issue has been patched in version 1.20.0...

CVE-2023-52290

Apache StreamPark (specifically streampark-console ) is vulnerable to SQL injection in its list pages, such as the application pages. The root cause is the lack of validation for the sort field sent from the front-end to the back-end, which is used directly to generate SQL queries. An attacker mu...