#cwe-89

共收录 2545 条相关情报。

漏洞预警2026-08-12 发布INFO

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify SQL tables due to improper neutralization of special elements used in an SQL command.

CVE-2026-17419

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify SQL tables due to improper neutraliza

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-12 发布INFO

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to improper neutralization of special elements used in an SQL command.

CVE-2026-17418

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to cause a denial of service due to improper neu

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-12 发布INFO

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify data in certain SQL tables due to improper neutralization of special elements used in an SQL c...

CVE-2026-17222

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to modify data in certain SQL tables due to imp

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

安全公告2026-08-12 发布INFO

phpMyFAQ: SQL LIKE Wildcard Injection in Chat User Search Allows Authenticated User Enumeration

CVE-2026-47132

### Summary An authenticated SQL LIKE wildcard injection vulnerability in phpMyFAQ’s chat user search allows any logg

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-20 #cwe-89 #cwe-200 #severity:medium

安全公告2026-08-12 发布INFO

Winter: SQL Injection in Backend Filter Widget numberrange Scope via numbersFromAjax

CVE-2026-32593

## Impact The Backend Filter widget (`Backend\Widgets\Filter`) is vulnerable to SQL injection through the `numberrange`

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-89 #severity:medium

漏洞预警2026-08-12 发布INFO

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerable to SQL injection. The vulnerability affects a SQLite da...

CVE-2025-41771

An authenticated attacker with low privileges can access an endpoint in the controller’s web interface that is vulnerabl

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-12 发布INFO

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome Table allows Blind SQL Injection. This issue affects Tab...

CVE-2026-66659

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Essekia Tablesome

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-12 发布INFO

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthe...

CVE-2026-18474

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL sta

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-12 发布INFO

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL statement through one of its authenticated AJAX actions, whi...

CVE-2026-18230

The WP Directory Kit WordPress plugin before 1.5.6 does not sanitise and escape a parameter before using it in a SQL sta

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-12 发布INFO

The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it in a SQL statement, allowing users with a subscriber accou...

CVE-2026-18057

The Events Manager WordPress plugin before 7.4.1 does not sanitise and escape a user-controlled value before using it i

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-12 发布INFO

The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is substituted into a dynamic SQL query built for a database...

CVE-2026-16977

The Form Maker by 10Web WordPress plugin before 1.15.45 does not properly parameterize a user-controlled value that is

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-12 发布INFO

The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a ...

CVE-2026-13613

The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-11 发布INFO

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolates the attacker-controlled ActivityPub actor inboxUrl int...

CVE-2026-73211

PeerTube is an ActivityPub-federated video streaming platform. Prior to 8.1.6, ActorFollowModel.updateScore() interpolat

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-11 发布INFO

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary ...

CVE-2026-48381

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-11 发布INFO

Weaver (Fanwei) E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint that allows unauthenticated remote attackers to extract arb...

CVE-2022-50997

Weaver (Fanwei) E-cology 8.0 and 9.0 contains a SQL injection vulnerability in the HrmCareerApplyPerView.jsp endpoint th

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-11 发布INFO

Weaver (Fanwei) E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthenticated remote attackers to read arbitrary files by inje...

CVE-2016-20097

Weaver (Fanwei) E-cology 8.0 contains a SQL injection vulnerability in the SignatureDownLoad servlet that allows unauthe

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-11 发布INFO

Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Entra Connect Sync allows an authorized attacker to elevate privileges locally.

CVE-2026-65673

Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Entra Connect Sync all

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-11 发布INFO

Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.15.0, Twenty allowed a workspace administrator with the DATA_MODEL permission to supply sett...

CVE-2026-73069

Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.15.0, Twenty allowed a workspace ad

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-11 发布INFO

YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-import path (`FormManager::create()`) allows any unauthentic...

CVE-2026-46670

YesWiki is a wiki system written in PHP. Prior to version 4.6.4, an unauthenticated SQL injection in the Bazar form-imp

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-11 发布HIGH

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which interpolates user-supplied identifier parameters (channel, func...

CVE-2026-72775

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which interp

来源摘录 · NVD

#cve #cwe-89