#cwe-89

共收录 2560 条相关情报。

漏洞预警2026-06-13 发布HIGH

The WP Ticket plugin for WordPress is vulnerable to SQL Injection via the WordPress search query parameter (`s`) in versions up to, and including, 6.0.4 The plugin hooks WordPre...

CVE-2026-9848

该漏洞存在于 WordPress 的 WP Ticket 插件中，版本 ≤6.0.4。插件通过挂钩 `posts_request` 过滤器并调用 `wp_ticket_com_posts_request()` 函数，在未认证前台搜索请求中执

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-06-12 发布INFO

A weakness has been identified in CodeAstro Human Resource Management System 1.0. This vulnerability affects the function Invoice of the file \application\controllers\Payroll.ph...

CVE-2026-12131

A weakness has been identified in CodeAstro Human Resource Management System 1.0. This vulnerability affects the functio

历史摘要 · 未重新核验 · NVD

#cve #cwe-74 #cwe-89

安全公告2026-06-12 发布INFO

Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint

CVE-2026-46371

### Summary A vulnerability in Fleet's Apple MDM commands listing endpoint allowed authenticated users with the lowest-

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-89 #cwe-200 #severity:medium

安全公告2026-06-12 发布INFO

Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint

CVE-2026-46370

### Summary A vulnerability in Fleet's labels host-listing endpoint allowed authenticated users with the lowest-privile

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #go #cwe-89 #cwe-200 #severity:medium

安全公告2026-06-12 发布INFO

TYPO3 CMS has Privilege Escalation & SQL Injection in its Form Framework

CVE-2026-49741

### Problem Backend users with write access to the `form_definition` database table were able to directly create, update

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #composer #cwe-89 #cwe-862 #severity:high

漏洞预警2026-06-12 发布INFO

MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_...

CVE-2026-44172

MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taki

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-06-12 发布INFO

Frappe is a full-stack web application framework. Prior to versions 15.106.0 and 16.16.0, there is a possible SQL Injection via get_blog_list. This issue has been patched in ver...

CVE-2026-41581

Frappe is a full-stack web application framework. Prior to versions 15.106.0 and 16.16.0, there is a possible SQL Inject

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-06-12 发布MEDIUM

SQL injection vulnerability in phpBB profile field migration due to improper handling of user-supplied profile field data during migration, allowing execution of arbitrary SQL q...

CVE-2026-48613

SQL injection vulnerability in phpBB profile field migration due to improper handling of user-supplied profile field dat

来源摘录 · NVD

#cve #cwe-89

安全公告2026-06-12 发布INFO

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')...

CVE-2026-39494

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW Plugins Produc

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-89 #severity:critical

安全公告2026-06-12 发布INFO

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')...

CVE-2026-42647

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beardev JoomSport

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-89 #severity:critical

漏洞预警2026-06-11 发布INFO

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #132, any authenticated user who can upload videos can add multiple subtitles from different fil...

CVE-2026-45418

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #132, any authenticated user who can up

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-06-11 发布INFO

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/progress_video.php endpoint is vulnerable to blind SQL injection. Any unauthen...

CVE-2026-45060

ClipBucket v5 is an open source video sharing platform. Prior to version 5.5.3 - #129, the actions/progress_video.php en

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-06-11 发布INFO

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beardev JoomSport allows Blind SQL Injection. This issue affects JoomSport...

CVE-2026-42647

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Beardev JoomSport

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-06-11 发布INFO

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW Plugins Product Filter by WBW allows Blind SQL Injection. This issue a...

CVE-2026-39494

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WBW Plugins Produc

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

安全公告2026-06-11 发布INFO

PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by...

CVE-2026-11945

PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a JSON docume

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-89 #severity:medium

漏洞预警2026-06-11 发布INFO

PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a JSON document and placing malicious code inside a particular key-val...

CVE-2026-11945

PostgreSQL Anonymizer contains a vulnerability that allows a user to gain superuser privileges by creating a JSON docume

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

安全公告2026-06-11 发布INFO

SQL Injection vulnerability in damasac thaipalliative_lte through version 3.0 allows remote...

CVE-2026-38581

SQL Injection vulnerability in damasac thaipalliative_lte through version 3.0 allows remote attackers to execute arbitra

历史摘要 · 未重新核验 · GitHub Advisory

#advisory #cwe-89 #severity:critical

漏洞预警2026-06-11 发布INFO

SQL Injection vulnerability in damasac thaipalliative_lte through version 3.0 allows remote attackers to execute arbitrary SQL commands via the idFormMain parameter to /substudy...

CVE-2026-38581

SQL Injection vulnerability in damasac thaipalliative_lte through version 3.0 allows remote attackers to execute arbitra

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-06-09 发布INFO

The RemoteControl API methods invite_participants and remind_participants pass a caller-supplied token-ID array into TokenDynamic::findUninvited(), which concatenates the values...

CVE-2026-50636

The RemoteControl API methods invite_participants and remind_participants pass a caller-supplied token-ID array into Tok

历史摘要 · 未重新核验 · NVD

#cve #cwe-89

漏洞预警2026-06-09 发布INFO

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in MOSK Information Technologies Ltd. CBS Platform allows SQL Injection. This...

CVE-2026-8025

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in MOSK Information T

历史摘要 · 未重新核验 · NVD

#cve #cwe-89