#cwe-89

共收录 2526 条相关情报。

← 返回所有主题

漏洞预警2026-09-18 发布INFO

The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape parameters before using them in a SQL query on an AJAX action available to unauth...

CVE-2026-87770

The Price Drop Alert for Woo Commerce WordPress plugin through 1.1 does not sanitize and escape parameters before using

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-18 发布INFO

The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and escape a parameter before using it in a SQL query on an AJAX action available t...

CVE-2026-87767

The wp shortcut link and advertisement baner WordPress plugin through 1.2.0 does not sanitize and escape a parameter bef

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-18 发布INFO

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allowing an authenticated technician to execute arbitrary SQL...

CVE-2026-18912

ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an authenticated SQL injection vulnerability, allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-17 发布INFO

SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 query_range API, allowing authenticated users to inject SQL. Attackers wit...

CVE-2026-93426

SigNoz versions 0.87.0 before 0.142.0 fail to escape user-supplied telemetry field-key names in the v5 query_range API,

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-17 发布INFO

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly concatenates the administrator-controlled download_expire POST paramete...

CVE-2026-54647

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/settings.index.inc.php directly concatenates t

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-17 发布INFO

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator-controlled tablename values into ALTER TABLE, CHECK TABL...

CVE-2026-54646

CubeCart is an ecommerce software solution. Prior to 6.7.5, admin/sources/maintenance.index.inc.php places administrator

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-17 发布INFO

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet["tableName"] value in the Ex...

CVE-2026-53557

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated use

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-17 发布INFO

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in backend/apps/datasource/c...

CVE-2026-53556

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/dat

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-17 发布INFO

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated user with module_support write...

CVE-2026-54597

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to versi

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-17 发布INFO

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.07, an authenticated Technician or higher with acce...

CVE-2026-54596

ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to versi

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-17 发布INFO

MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTranslate...

CVE-2026-54354

MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter tran

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-17 发布INFO

In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists.

CVE-2025-55787

In MailData Email Archiving System v4.2 and earlier, a SQL injection vulnerability exists.

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

安全公告2026-09-17 发布INFO

CakePHP: Multiple methods in FunctionsBuilder vulnerable to SQL injection

CVE-2026-79752

### Impact The `FunctionsBuilder::cast($field, $dataType)`, `extract($part, $expr)`, `datePart($part, $expr)`, `dateAdd(

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-89 #severity:critical

漏洞预警2026-09-17 发布INFO

Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user with the HR User role can inject SQL through filters in the Salary...

CVE-2026-54524

Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user with the

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-17 发布INFO

Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated, non-readonly user with access to an object usable in a permission pair can submit DELETE /api/p...

CVE-2026-52851

Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated, non-readonly user with access to an ob

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

安全公告2026-09-17 发布INFO

Frappe HR: SQL Injection in HRMS Salary Payments Based on Payment Mode Report

CVE-2026-54524

Frappe HR is an open-source human resources management solution (HRMS). Prior to 16.7.0, an authenticated user with the

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-89

安全公告2026-09-17 发布INFO

Traccar: Authenticated Blind SQL Injection in DELETE /api/permissions

CVE-2026-52851

Traccar is an open source GPS tracking system. Prior to 6.14.0, an authenticated, non-readonly user with access to an ob

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-89

漏洞预警2026-09-17 发布INFO

A vulnerability has been found in code-projects Matrimonial System 1.0. This vulnerability affects the function writepartnerprefs of the file /partner_preference.php. Such manip...

CVE-2026-92926

A vulnerability has been found in code-projects Matrimonial System 1.0. This vulnerability affects the function writepar

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-09-17 发布INFO

SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints that interpolate service_name and span_name fields into Clic...

CVE-2026-93292

SigNoz versions from 0.88.0 before 0.142.1 contain a SQL injection vulnerability in trace-funnel analytics endpoints tha

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-09-17 发布INFO

CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::cast, FunctionsBuilder::extract, FunctionsBuilder::datePart...

CVE-2026-79752

CakePHP is a rapid development framework for PHP. Prior to 4.5.12, 4.6.5, 5.1.9, 5.2.14, and 5.3.7, FunctionsBuilder::ca

历史摘要 · 未重新核验 · NVD

#cve #cwe-89