Other injection.

samlify: XML Injection in AttributeValue Allows Privilege Escalation in Signed SAML Assertions

• Other injection

<2.13.0 · fixed in 2.13.0

LDAP filter injection

• Netatalk
• Other injection

Avada (Fusion) Builder <= 3.15.2 - Unauthenticated Remote Code Execution via PHP Function Injection via 'render_logics' Shortcode Attribute via Widget AJAX Handler

• themefusion Avada (Fusion) Builder
• Other injection

authentik: SAML NameID XML Comment Injection Enables Authentication Bypass via Identifier Truncation

• authentik
• Other injection
• Authentication bypass

Plane: ORM Field Reference Injection via `segment` Parameter in Saved Analytics

• plane
• Other injection

Injection in Cisco ThousandEyes Enterprise Agent

• Cisco ThousandEyes Enterprise Agent
• Other injection

Apache OFBiz: Authentication Bypass due to Improper Neutralization of LDAP Special Elements in DN Construction

• Apache Software Foundation Apache OFBiz
• Other injection

OpenTelemetry eBPF Instrumentation: Redis error text is exported in span status messages

• Other injection
• Information disclosure

<0.9.0 · fixed in 0.9.0

Net::Statsd::Lite versions through 0.10.0 for Perl allowed metric injections

• RRWO Net::Statsd::Lite
• Other injection
• CWE-150

projectworlds hospital-management-system-in-php GET Parameter update_info.php getAllPatientDetail sql injection

• projectworlds hospital-management-system-in-php
• Other injection
• SQL injection

Edimax BR-6428NS POST Request formStaDrvSetup command injection

• Edimax BR-6428NS
• Other injection
• Command injection

org.linlinjava:litemall-wx-api has an Injection issue

• Other injection
• SQL injection

<=0.1.0 · no fixed version yet

Edimax BR-6228NC POST Request mp command injection

• Edimax BR-6228NC
• Other injection
• Command injection

linlinjava litemall Database Setting DbUtil.java load argument injection

• linlinjava litemall
• Other injection
• Command injection

linlinjava litemall Admin Endpoint sql injection

• linlinjava litemall
• Other injection
• SQL injection

Net::Statsd::Tiny versions before 0.3.8 for Perl allowed metric injections

• RRWO Net::Statsd::Tiny
• Other injection
• CWE-150

kalcaddle Kodbox fileThumb Plugin VideoResize.class.php parseVideoInfo command injection

• kalcaddle Kodbox
• Other injection
• Command injection

Oinone Pamirs queryListByWrapper RSQLToSQLNodeConnector.makeVariable sql injection

• Oinone Pamirs
• Other injection
• SQL injection

Dataease Data Dashboard SqlparserUtils.java SqlparserUtils.transFilter sql injection

• Dataease
• Other injection
• SQL injection

Net::Statsd::Lite versions before 0.9.0 for Perl allowed metric injections

• RRWO Net::Statsd::Lite
• Other injection
• CWE-150

Marten has an injection vulnerability in its full-text search regConfig parameter

• Other injection
• SQL injection

<8.37.0 · fixed in 8.37.0

Strapi may leak sensitive data via relational filtering due to lack of query sanitization

• Path traversal
• Information disclosure

>=4.0.0, <5.37.0 · fixed in 5.37.0

CRLF injection in WebPros cPanel and others

• WebPros cPanel
• WebPros WP Squared
• Other injection

BIG-IP Configuration utility vulnerability

• F5 BIG-IP
• Other injection

Flowsint: Cypher query injection in node type on node creation

• reconurge flowsint
• Other injection

Subnet Solutions PowerSYSTEM Center CRLF injection

• Subnet Solutions PowerSYSTEM Center 2020
• Subnet Solutions PowerSYSTEM Center 2024
• Other injection

Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability

• Microsoft Edge (Chromium-based)
• Other injection

Azure Machine Learning Notebook Spoofing Vulnerability

• Microsoft Azure Machine Learning
• Other injection

GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability

• Microsoft Visual Studio Code
• Other injection

D-Link DIR-816 portForward command injection

• D-Link DIR-816
• Other injection
• Command injection

D-Link DIR-816 singlePortForward sub_445E7C command injection

• D-Link DIR-816
• Other injection
• Command injection

D-Link DIR-816 formDMZ.cgi sub_445E7C command injection

• D-Link DIR-816
• Other injection
• Command injection

HTTP::Tiny versions before 0.093 for Perl do not validate CRLF in HTTP request lines or control field header values

• HAARG HTTP::Tiny
• Other injection

CR Injection in SSE Encoder Enables Event Splitting via cow_sse:event/1

• Other injection

>=2.6.0, <2.16.1 · fixed in 2.16.1

Cookie Request Header Injection via Unvalidated Encoder in cow_cookie:cookie/1

• Other injection

>=2.9.0, <2.21.0 · fixed in 2.21.0

KQL injection via kusto.tables.topics.mapping in kafka-sink-azure-kusto

• kafka-sink-azure-kusto
• Other injection

CSV injection in Dell ECS and others

• Dell ECS
• Dell ObjectScale
• Other injection

HTTP Header Injection via Webhook API in Multiple WSO2 Products Allows Response Header Manipulation

• WSO2 API Manager
• WSO2 Universal Gateway
• Other injection

CodeAstro Online Catering Ordering System deleteorder.php sql injection

• CodeAstro Online Catering Ordering System
• Other injection
• SQL injection

codelibs Fess JSP File AdminDesignAction.java update code injection

• codelibs Fess
• Other injection
• Code injection

aandrew-me tgpt Update helper.go helper.Update command injection

• aandrew-me tgpt
• Other injection
• Command injection

Hono has CSS Declaration Injection via Style Object Values in JSX SSR

• Other injection
• CWE-116

<4.12.18 · fixed in 4.12.18

eventsource-encoder vulnerable to SSE event injection via unsanitized `event` and `id` fields

• Other injection

<1.0.2 · fixed in 1.0.2

ZITADEL has LDAP Filter Injection in Login Flow

• Other injection

>=2.71.11, <=2.71.19 || >=3.1.0, <3.4.10 || >=4.0.0, <4.15.0 · fixed in 3.4.10, 4.15.0

fast-xml-builder allows attribute values with unwanted quotes to bypass malicious or unwanted attributes

• Other injection
• XML external entities (XXE)

<1.1.7 · fixed in 1.1.7

fast-xml-builder Comment Value regex can be bypassed

• Other injection

>=1.1.5, <1.1.6 · fixed in 1.1.6

Dolibarr has an Authenticated Remote Code Execution via eval() injection in user extrafields

• dolibarr
• Other injection

zyx0814 FilePress Shares Filelist API admin.php sql injection

• zyx0814 FilePress
• Other injection
• SQL injection

CodeAstro Leave Management System login.php sql injection

• CodeAstro Leave Management System
• Other injection
• SQL injection

SourceCodester SUP Online Shopping replymsg.php sql injection

• SourceCodester SUP Online Shopping
• Other injection
• SQL injection

SourceCodester SUP Online Shopping message.php sql injection

• SourceCodester SUP Online Shopping
• Other injection
• SQL injection

SourceCodester SUP Online Shopping wishlist.php sql injection

• SourceCodester SUP Online Shopping
• Other injection
• SQL injection

SourceCodester SUP Online Shopping viewmsg.php sql injection

• SourceCodester SUP Online Shopping
• Other injection
• SQL injection

SourceCodester Comment System post_comment.php sql injection

• SourceCodester Comment System
• Other injection
• SQL injection

code-projects Simple Chat System sendMessage.php sql injection

• code-projects Simple Chat System
• Other injection
• SQL injection

JeecgBoot JSON Object loadTreeData sql injection

• JeecgBoot
• Other injection
• SQL injection

M365 Copilot Information Disclosure Vulnerability

• Microsoft 365 Copilot's Business Chat
• Other injection

code-projects Feedback System checklogin.php sql injection

• code-projects Feedback System
• Other injection
• SQL injection

CodeAstro Online Classroom askquery.php sql injection

• CodeAstro Online Classroom
• Other injection
• SQL injection

SourceCodester Pharmacy Sales and Inventory System ajax.php save_user sql injection

• SourceCodester Pharmacy Sales and Inventory System
• Other injection
• SQL injection