#CVE

共收录 69142 条相关情报。

漏洞预警2026-10-22 发布HIGH

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arbitrary SQL by appending stacked statements to custom metr...

CVE-2026-115330

Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute arb

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-22 发布HIGH

JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js that allows authenticated users to inject SQL via HistoryRe...

CVE-2026-115328

JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js th

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-22 发布MEDIUM

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xml.c when parsing NETCONF rpc action envelopes. Peers with...

CVE-2026-115327

libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in src/parser_xm

来源摘录 · NVD

#cve #cwe-824

漏洞预警2026-10-22 发布MEDIUM

QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSubmitRefundRequest() that allows authenticated customers t...

CVE-2026-115326

QloApps through 1.7.0 contains an insecure direct object reference vulnerability in OrderDetailController::displayAjaxSu

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-22 发布HIGH

mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. A...

CVE-2026-115324

mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attack

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-22 发布HIGH

EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unauthenticated attackers to manage other customers' addresses...

CVE-2026-115323

EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows unaut

来源摘录 · NVD

#cve #cwe-862

漏洞预警2026-10-22 发布MEDIUM

Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to access ot...

CVE-2026-115322

Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTas

来源摘录 · NVD

#cve #cwe-639

漏洞预警2026-10-22 发布LOW

fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows local attackers to exhaust the --listen HTTP server thro...

CVE-2026-115319

fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that allows

来源摘录 · NVD

#cve #cwe-407

漏洞预警2026-10-22 发布MEDIUM

A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a special...

CVE-2026-115207

A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-22 发布MEDIUM

Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endpoints that allows authenticated members to read arbitrary...

CVE-2026-114665

Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare endp

来源摘录 · NVD

#cve #cwe-59

漏洞预警2026-10-22 发布HIGH

A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configu...

CVE-2026-111079

A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command hist

来源摘录 · NVD

#cve #cwe-497

漏洞预警2026-10-22 发布HIGH

Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter wi...

CVE-2025-71434

Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the /api/do

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-22 发布MEDIUM

Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute scripts by proxying malicious SVG files through /api/imagePro...

CVE-2024-58394

Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute scri

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-22 发布HIGH

i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries th...

CVE-2024-58393

i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injection vulnerability that allows un

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-22 发布MEDIUM

WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject script by supplyi...

CVE-2023-54413

WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that all

来源摘录 · NVD

#cve #cwe-79

漏洞预警2026-10-22 发布MEDIUM

Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attackers to download arbitrary files via the name parameter of /...

CVE-2022-51025

Penta Security WAPPLES 4.0.54.1, 5.0, and 6.0 contains a path traversal vulnerability that allows authenticated attacker

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-22 发布HIGH

Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by supplying '../' sequences in the filename pa...

CVE-2022-51024

Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitr

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-22 发布HIGH

PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate ORDER BY clauses via the sort parameter. Attackers can s...

CVE-2022-51023

PHPOK 4.5.000 before 5.4.081 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate

来源摘录 · NVD

#cve #cwe-89

漏洞预警2026-10-22 发布CRITICAL

YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to r...

CVE-2022-51022

YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /ad

来源摘录 · NVD

#cve #cwe-22

漏洞预警2026-10-22 发布HIGH

NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries by sup...

CVE-2022-51021

NotificationX plugin for WordPress 2.0.0 before 2.3.12 contains an unauthenticated SQL injection vulnerability that allo

来源摘录 · NVD

#cve #cwe-89