#cwe-89

共收录 2545 条相关情报。

漏洞预警2026-08-04 发布MEDIUM

A vulnerability was detected in cemtan sar2html 4.0.0. This affects an unknown part of the file sar2html.py of the component Search. Performing a manipulation of the argument Se...

CVE-2026-18719

CVE-2026-18719 是影响 cemtan sar2html 4.0.0 的一个 SQL 注入漏洞。该漏洞存在于组件 Search 中的 sar2html.py 文件，攻击者可通过操纵参数 Search 触发 SQL 注入。由于该组

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

安全公告2026-08-04 发布INFO

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used...

CVE-2026-48326

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-89 #severity:critical

安全公告2026-08-04 发布INFO

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used...

CVE-2026-48330

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-89 #severity:critical

漏洞预警2026-08-03 发布INFO

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary ...

CVE-2026-48330

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-03 发布INFO

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary ...

CVE-2026-48326

Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

安全公告2026-08-03 发布INFO

Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder...

CVE-2026-18737

Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-89 #severity:high

漏洞预警2026-08-03 发布INFO

Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracle. The escape function defined in sql-string.js does not ...

CVE-2026-69240

Sequelize is a Node.js ORM tool. Prior to 6.37.4, SQL injection is possible with strings only if dialect is set to oracl

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-03 发布INFO

Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL fragments by supplying an unvalidated direction value in...

CVE-2026-18737

Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

安全公告2026-08-03 发布INFO

Sequelize: SQL Injection (Oracle DB)

CVE-2026-69240

### Summary SQL Injection is possible with strings only **if dialect is set to `oracle`**. The vulnerability was confirm

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #npm #cwe-89 #severity:critical

漏洞预警2026-08-03 发布INFO

Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated users with leads access to inject arbitrary SQL into a HAVIN...

CVE-2026-41453

Krayin CRM before 2.2.4 contains a blind SQL injection vulnerability in the leads DataGrid that allows authenticated use

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-03 发布INFO

SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-supplied keyword parameter is concatenated directly into S...

CVE-2026-69085

SiYuan before v3.7.3 contains a SQL injection vulnerability in the /api/filetree/searchDocs endpoint, where the caller-s

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-03 发布INFO

SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement verbatim to the main read-write siyuan.db handle with no...

CVE-2026-69084

SiYuan versions <= v3.7.2 expose the /api/search/searchEmbedBlock endpoint, which passes a client-supplied SQL statement

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-03 发布INFO

SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable by unauthenticated users and publish RoleReader tokens. ...

CVE-2026-69083

SiYuan versions before v3.7.3 contain SQL injection vulnerabilities in the fullTextSearchAssetContent endpoint reachable

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-03 发布INFO

A security flaw has been discovered in osCommerce 4.14.63493. Affected by this issue is the function EmailController of the file app/lib/backend/controllers/EmailController.php ...

CVE-2026-18592

A security flaw has been discovered in osCommerce 4.14.63493. Affected by this issue is the function EmailController of

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-08-03 发布INFO

The LogMyTrip WordPress plugin through 1.9 does not sanitize and escape a value taken from a cookie before using it in a SQL query, allowing unauthenticated users to perform SQL...

CVE-2026-16572

The LogMyTrip WordPress plugin through 1.9 does not sanitize and escape a value taken from a cookie before using it in a

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-03 发布INFO

The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and escape a stored value before using it in a SQL statement when duplicating a page, allowing users with...

CVE-2026-16539

The sm page duplicator WordPress plugin through 1.0.0 does not sanitise and escape a stored value before using it in a S

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-03 发布INFO

The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using it in a SQL query, allowing unauthenticated users to perf...

CVE-2026-16532

The Link Library WordPress plugin before 7.9.3 does not properly sanitise and escape a user-supplied value before using

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-03 发布INFO

The Super Store Finder WordPress plugin through 7.8 does not sanitize a parameter of an unauthenticated AJAX action before using it in a SQL query, allowing unauthenticated atta...

CVE-2026-12965

The Super Store Finder WordPress plugin through 7.8 does not sanitize a parameter of an unauthenticated AJAX action befo

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-08-02 发布INFO

PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrary SQL by exploiting improper quote-escaping in DefaultPar...

CVE-2026-65321

PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrar

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

安全公告2026-08-02 发布INFO

PyAthena 3.35.4 SQL Injection via DefaultParameterFormatter DELETE/CTAS

CVE-2026-65321

PyAthena prior to 3.35.4 contains a sql injection vulnerability that allows unauthenticated attackers to inject arbitrar

历史摘要 · 未重新核验 · OSV.dev

#advisory #cwe-89