#cwe-89

共收录 2526 条相关情报。

漏洞预警2026-09-18 发布INFO

Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL queries by submitting malicious input through the u...

CVE-2019-25776

Weaver E-cology contains an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrar

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-18 发布INFO

ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary database contents by submitting the msg_id para...

CVE-2026-77928

ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-18 发布INFO

ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary data from the database by submitting the check_...

CVE-2026-77927

ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

安全公告2026-09-18 发布INFO

ClipBucket < 5.5.3-#182 Blind SQL Injection via Private Message Deletion Endpoint

CVE-2026-77928

ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-89

漏洞预警2026-09-18 发布INFO

SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values are concatenated raw into SQL string literals without es...

CVE-2026-93591

SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

安全公告2026-09-18 发布INFO

ClipBucket < 5.5.3-#182 Blind SQL Injection via Photo Deletion Endpoint

CVE-2026-77927

ClipBucket v5 before 5.5.3-#182 contains a blind SQL injection vulnerability that allows authenticated users to extract

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-89

安全公告2026-09-18 发布INFO

SiYuan before 3.8.3 SQL Injection via unescaped tag in graph.go

CVE-2026-93591

SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-89

漏洞预警2026-09-18 发布INFO

An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in Synology DiskStation Manager (DSM) before 7.2.1-69057-10,...

CVE-2026-4036

An improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Sharing API in

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-18 发布INFO

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler API in Synology DiskStation Manager (DSM) before 7.2.1-69...

CVE-2026-13683

An improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in EventScheduler

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-18 发布INFO

The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API Parameters in all versions up to, and including, 2.3.38 ...

CVE-2026-85705

The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-18 发布INFO

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injection via 'album_id' Shortcode Attribute in all versions up t...

CVE-2026-85652

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to time-based SQL Injectio

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-18 发布INFO

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the 'additional_params' parameter in all versions up to, and ...

CVE-2026-75961

The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to generic SQL Injection via the

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-18 发布INFO

HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. which could allow an authenticated attacker to inject data...

CVE-2026-67100

HCL BigFix Service Management is affected by SQL Injection flaw and a Cross-Tenant Data Exposure flaw vulnerabilities. w

历史摘要 · 未重新核验 · NVD

#cve #cwe-89 #cwe-200

漏洞预警2026-09-18 发布INFO

The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the 'wcfmmp_user_location_lng' parameter in all ve...

CVE-2026-18442

The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to generic SQL Injecti

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-18 发布INFO

The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the [wpinventory] shortcode in versions up to, and including,...

CVE-2026-17607

The WP Inventory Manager plugin for WordPress is vulnerable to SQL Injection via the 'where' shortcode attribute of the

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-18 发布INFO

The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL Injection via the 'store_locatore_search_radius' parameter in all versions up to, and including,...

CVE-2026-15275

The WP Multi Store Locator Pro plugin for WordPress is vulnerable to generic SQL Injection via the 'store_locatore_searc

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-18 发布INFO

The InfiniteWP Client plugin for WordPress is vulnerable to SQL Injection via the get_comments action in versions up to, and including, 1.13.9. This is due to insufficient escap...

CVE-2026-17576

The InfiniteWP Client plugin for WordPress is vulnerable to SQL Injection via the get_comments action in versions up to,

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-18 发布INFO

The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthen...

CVE-2026-87775

The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-18 发布INFO

The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to build a SQL query on an AJAX action available to unauthen...

CVE-2026-87774

The Tz Weekly Radio Schedule WordPress plugin through 1.8.1 does not sanitize and escape a parameter before using it to

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-18 发布INFO

The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize and escape parameters before using them in SQL queries on AJAX actions available to unauthentica...

CVE-2026-87771

The Product Question and Answer WordPress plugin through 1.1.0 does not sanitize and escape parameters before using them

历史摘要 · 未重新核验 · NVD

#cve #cwe-89