#cwe-89

共收录 2545 条相关情报。

漏洞预警2026-07-09 发布INFO

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the block search endpoint POST /api/search/fullTextSearchBlock concatenates attacker-controlled pa...

CVE-2026-59834

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the block search endpoint POST /api/searc

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-09 发布INFO

Pimcore Studio Backend Bundle is the backend bundle for Pimcore Studio. Prior to 2025.4.6 and 2026.1.6, an authenticated user can extract the admin password hash and other datab...

CVE-2026-55208

Pimcore Studio Backend Bundle is the backend bundle for Pimcore Studio. Prior to 2025.4.6 and 2026.1.6, an authenticated

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

安全公告2026-07-09 发布INFO

YesWiki has Authenticated SQL Injection via ReactionManager

CVE-2026-52775

## Summary YesWiki through the latest development branch contains a SQL injection vulnerability in `ReactionManager::de

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-89 #severity:high

安全公告2026-07-09 发布INFO

YesWiki: Second-Order SQL Injection in Page Delete API via Unescaped Page Tag (`ApiController::deletePage`)

CVE-2026-52771

## Summary `ApiController::deletePage()` interpolates a page tag retrieved from the database into a `DELETE FROM …_links

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-89 #severity:high

安全公告2026-07-09 发布INFO

YesWiki: SQL Injection possible through public Bazar entry-listing APIs via numeric `query`/`queries` filters

CVE-2026-52770

### Summary YesWiki’s public Bazar entry-listing APIs are vulnerable to unauthenticated SQL injection in numeric `query`

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-89 #severity:high

安全公告2026-07-09 发布INFO

YesWiki: SQL injection via the `recentchanges` action `period` argument leads to arbitrary DB read

CVE-2026-52763

### Summary The `recentchanges` action (`actions/recentchanges.php`) accepts a `period` argument from two disjoint para

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-89 #cwe-1287 #severity:medium

漏洞预警2026-07-09 发布INFO

A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. This affects an unknown part of the file /login.php. Performing a manipulation of the ar...

CVE-2026-15190

A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. This affects an unknown part of

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-07-09 发布INFO

A SQLi vulnerability in AcyMailing component < 10.11.1 for Joomla was discovered. Exploiting this flaw can lead to unauthorized database access and data leakage.

CVE-2026-56292

A SQLi vulnerability in AcyMailing component < 10.11.1 for Joomla was discovered. Exploiting this flaw can lead to unaut

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-09 发布INFO

SOPlanning is vulnerable to SQL injection in the audit retention configuration. An attacker holding parameters_all rights can inject SQL commands into the audit configuration fo...

CVE-2026-50644

SOPlanning is vulnerable to SQL injection in the audit retention configuration. An attacker holding parameters_all right

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-09 发布INFO

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Inrove Software and Internet Services BiEticaret allows SQL Injection. Thi...

CVE-2026-5955

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Inrove Software an

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-09 发布INFO

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to time-based SQL Injection via the 'contact_ids' parameter...

CVE-2026-14342

The Mail Mint – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-09 发布INFO

The ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter...

CVE-2026-13011

The ERP: Complete HR, Accounting & CRM Suite with Recruitment and WooCommerce CRM Support plugin for WordPress is vulner

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-09 发布INFO

A weakness has been identified in code-projects Interview Management System 1.0. This vulnerability affects unknown code of the file \inc\classes\View.php. This manipulation of ...

CVE-2026-15137

A weakness has been identified in code-projects Interview Management System 1.0. This vulnerability affects unknown code

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-07-09 发布INFO

A security flaw has been discovered in code-projects Online Food Order System 1.0. This affects an unknown part of the file /edit_food_items.php. The manipulation of the argumen...

CVE-2026-15135

A security flaw has been discovered in code-projects Online Food Order System 1.0. This affects an unknown part of the f

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-07-09 发布INFO

A vulnerability was determined in CodeAstro Simple Online Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /SimpleOnlineLeave/...

CVE-2026-15134

A vulnerability was determined in CodeAstro Simple Online Leave Management System 1.0. Affected by this vulnerability is

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

漏洞预警2026-07-08 发布INFO

A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the newPassword parameter in the password change functiona...

CVE-2026-39179

A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via t

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-08 发布INFO

A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via the search parameter of the allContactSearch endpoint.

CVE-2026-39178

A SQL injection vulnerability in SOGo before 5.12.7 allows authenticated users to execute arbitrary SQL statements via t

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-08 发布INFO

IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulnerability in the password reset functionality.

CVE-2026-9074

IBM API Connect 10.0.8.0 through 10.0.8.9 and 12.1.0.0 through 12.1.0.3 contains an unauthenticated SQL injection vulner

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-08 发布INFO

Snowflake Terraform Provider versions prior to 2.18.0 contain several security vulnerabilities, including SQL injection via an unsanitized data source input could result in arbi...

CVE-2026-15067

Snowflake Terraform Provider versions prior to 2.18.0 contain several security vulnerabilities, including SQL injection

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-07-08 发布INFO

SQL injection vulnerabilities in the Snowflake Snowpark Python SDK (snowpark-python) versions prior to 1.53.0 could allow authenticated low-privilege users to execute SQL beyond...

CVE-2026-15062

SQL injection vulnerabilities in the Snowflake Snowpark Python SDK (snowpark-python) versions prior to 1.53.0 could allo

历史摘要 · 未重新核验 · NVD

#cve #cwe-89