#cwe-89

共收录 2592 条相关情报。

← 返回所有主题

漏洞预警2026-05-13 发布INFO

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.0, some endpoints were vulnerable to SQL injection through specially crafted requests, which w...

CVE-2026-44447

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 16.9.0, some endpoints were vulnerable to

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-13 发布INFO

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.14.0, some endpoints were vulnerable to SQL injection through specially crafted req...

CVE-2026-44446

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.104.3 and 16.14.0, some endpoints were

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

安全公告2026-05-13 发布INFO

A SQL injection vulnerability in Trust Protection Foundation allows an authenticated attacker to...

CVE-2026-0242

A SQL injection vulnerability in Trust Protection Foundation allows an authenticated attacker to execute arbitrary SQL c

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-89 #severity:medium

漏洞预警2026-05-13 发布INFO

CubeCart is an ecommerce software solution. Prior to 6.7.0, the admin orders-transactions listing page (admin.php?_g=orders&node=transactions) builds a raw ORDER BY SQL fragment...

CVE-2026-45054

CubeCart is an ecommerce software solution. Prior to 6.7.0, the admin orders-transactions listing page (admin.php?_g=ord

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-13 发布INFO

EcclesiaCRM is CRM Software for church management. In 8.0.0 and earlier, the ValidateInput() function's default case in EcclesiaCRM's query view passes user-supplied POST parame...

CVE-2026-44418

EcclesiaCRM is CRM Software for church management. In 8.0.0 and earlier, the ValidateInput() function's default case in

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-13 发布INFO

MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, a SQL injection vulnerability existed in the handling of user-controlled ordering parameters in...

CVE-2026-44381

MISP is an open source threat intelligence and sharing platform. Prior to 2.5.37, a SQL injection vulnerability existed

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-13 发布INFO

CubeCart is an ecommerce software solution. Prior to 6.6.0, Authenticated Time-Based Blind SQL Injection vulnerabilities were identified in the sorting parameters (sort[price], ...

CVE-2026-39358

CubeCart is an ecommerce software solution. Prior to 6.6.0, Authenticated Time-Based Blind SQL Injection vulnerabilities

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-13 发布INFO

Flight is an extensible micro-framework for PHP. Prior to 3.18.1, SimplePdo::insert(), SimplePdo::update(), and SimplePdo::delete() build SQL statements by concatenating the $ta...

CVE-2026-42550

Flight is an extensible micro-framework for PHP. Prior to 3.18.1, SimplePdo::insert(), SimplePdo::update(), and SimplePd

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

安全公告2026-05-13 发布INFO

Strapi Vulnerable to SQL Injection in Content Type Builder

CVE-2026-22599

### Summary of CVE-2026-22599 Vulnerability Details - CVE: CVE-2026-22599 - CVSS v3.1 Vector: `CVSS:4.0/AV:N/AC:L/AT:N/

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-89 #severity:critical

漏洞预警2026-05-13 发布INFO

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5, a vulnerability in datastore_search_sql allowed attacke...

CVE-2026-42031

CKAN is an open-source DMS (data management system) for powering data hubs and data portals. Prior to 2.10.10 and 2.11.5

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-13 发布INFO

A SQL injection vulnerability in Trust Protection Foundation allows an authenticated attacker to execute arbitrary SQL commands against the product database. Successful exploita...

CVE-2026-0242

A SQL injection vulnerability in Trust Protection Foundation allows an authenticated attacker to execute arbitrary SQL c

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-13 发布INFO

Joomla J2 JOBS 1.3.0 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the '...

CVE-2020-37226

Joomla J2 JOBS 1.3.0 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipu

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-13 发布INFO

Joomla J2 JOBS 1.3.0 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the '...

CVE-2020-37224

Joomla J2 JOBS 1.3.0 contains an authenticated SQL injection vulnerability that allows authenticated attackers to manipu

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-13 发布INFO

Joomla com_hdwplayer 4.2 contains an SQL injection vulnerability in the search.php file that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malic...

CVE-2020-37218

Joomla com_hdwplayer 4.2 contains an SQL injection vulnerability in the search.php file that allows unauthenticated atta

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-13 发布INFO

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to blind SQL Injection via the 'rid' parameter in all versions up to, and including, 5...

CVE-2026-4608

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to blind SQL Injection via th

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-13 发布INFO

qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysUserMapper.xml file. This vulnerability allows attackers t...

CVE-2026-37429

qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysU

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-13 发布INFO

qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysDeptMapper.xml file. This vulnerability allows attackers t...

CVE-2026-37428

qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysD

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-13 发布INFO

The Avada Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘product_order’ parameter in all versions up to, and including, 3.15.1 due to insufficie...

CVE-2026-4798

The Avada Builder plugin for WordPress is vulnerable to time-based SQL Injection via the ‘product_order’ parameter in al

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-13 发布INFO

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'sortf' parameter in all versions...

CVE-2026-6929

The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to time-based blin

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-05-13 发布INFO

The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to generic SQL Injection via the 's' parameter in...

CVE-2026-7619

The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vul

历史摘要 · 未重新核验 · NVD

#cve #cwe-89