#cwe-89

共收录 2524 条相关情报。

← 返回所有主题
漏洞预警2026-09-29 发布INFO

Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated remote attackers to inject arbitrary SQL through the Nam...

CVE-2023-54400

Fumasoft Fumeng Cloud contains a SQL injection vulnerability in the AjaxMethod.ashx endpoint that allows unauthenticated

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-29 发布INFO

ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function where the language_id parameter is concatenated unescape...

CVE-2026-102570

ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-29 发布INFO

ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the admin video edit function where the videoid parameter is concatenated into an UPD...

CVE-2026-102569

ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the admin video edit functio

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-29 发布INFO

A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78cc46d65e505949f7. The impacted element is the function QueryGenerator.doMultiFieldsOrder of the f...

CVE-2026-102491

A vulnerability was identified in mahonelau kykms up to 8f130c2d85842d5b44caae78cc46d65e505949f7. The impacted element i

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-29 发布INFO

Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attach_ids parameter of the file attachment download endpoint t...

CVE-2015-20122

Seeyon A6 collaborative office automation platform contains an unauthenticated SQL injection vulnerability in the attach

历史摘要 · 未重新核验 · NVD

安全公告2026-09-29 发布INFO

ClipBucket v5 through 5.5.3-#197 SQL Injection via language_id Parameter

CVE-2026-102570

ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the language update function

历史摘要 · 未重新核验 · OSV.dev

安全公告2026-09-29 发布INFO

ClipBucket v5 through 5.5.3-#197 SQL Injection via videoid Parameter

CVE-2026-102569

ClipBucket v5 through 5.5.3-#197 contains a time-based blind SQL injection vulnerability in the admin video edit functio

历史摘要 · 未重新核验 · OSV.dev

漏洞预警2026-09-29 发布INFO

The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained free text and templated them straight into the compute-c...

CVE-2026-86843

The Apache Airflow Teradata provider's compute-cluster example Dag declared every one of its Dag Params as unconstrained

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-29 发布INFO

SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL command...

CVE-2026-96429

SQL Injection in the /WebAgenda/SMBAjaxConfigProcess.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-29 发布INFO

SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08 allows remote attackers to execute arbitrary SQL commands...

CVE-2026-96428

SQL Injection in the /WebAgenda/SMBAjaxAutoComplete.do API endpoint of Flowring Agentflow 4.0 version before 2025/08/08

历史摘要 · 未重新核验 · NVD

安全公告2026-09-29 发布INFO

SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed...

CVE-2026-101091

SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyu

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-09-28 发布INFO

SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyuan.db. Attackers can craft malicious .sy documents with n...

CVE-2026-101091

SiYuan versions before v3.8.4 fail to properly validate SQL statements in block query embed blocks executed against siyu

历史摘要 · 未重新核验 · NVD

安全公告2026-09-28 发布INFO

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6 -...

CVE-2026-101110

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) quote() instead of rejecting it.

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-09-28 发布INFO

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8...

CVE-2026-101108

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8 - site/vehiclemanager.

历史摘要 · 未重新核验 · GitHub Advisory

安全公告2026-09-28 发布INFO

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6...

CVE-2026-100752

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9 - site/realestatem

历史摘要 · 未重新核验 · GitHub Advisory

漏洞预警2026-09-28 发布INFO

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) < 6.4.6 - site/booklibrary.php’s books() function reads the field and direction request pa...

CVE-2026-101110

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Book Library (Free) quote() instead of rejecting it.

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-28 发布INFO

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8 - site/vehiclemanager.php reads the order_field and order_direction sort parame...

CVE-2026-101108

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Vehicle Manager (Free) < 6.5.8 - site/vehiclemanager.

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-28 发布INFO

A vulnerability was determined in code-projects Matrimonial System 1.0. The affected element is the function processprofile_form of the file /create_profile of the component Pro...

CVE-2026-101105

A vulnerability was determined in code-projects Matrimonial System 1.0. The affected element is the function processprof

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-28 发布INFO

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9 - site/realestatemanager.php builds the ORDER BY clause of three separate f...

CVE-2026-100752

Joomla Extension - ordasoft.com - Unauthenticated SQL Injection in Real Estate Manager (Free) < 6.7.9 - site/realestatem

历史摘要 · 未重新核验 · NVD

漏洞预警2026-09-28 发布INFO

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Iron Mountain Archiving Services Inc. EnVision allows SQL Injection. This ...

CVE-2026-86595

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Iron Mountain Arch

历史摘要 · 未重新核验 · NVD