Other injection.

Spring Framework response splitting in ContentDisposition

• Spring Framework
• Other injection

Server Sent Event stream corruption in Spring MVC functional web framework

• Spring Framework
• Other injection

openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to r...

• Other injection

<1.4.9 · fixed in 1.4.9

openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious key_id con...

• Other injection

<1.4.9 · fixed in 1.4.9

openssl-encrypt (pip package, versions <= 1.4.8) fails to sanitize filenames read from untrusted drive data (outside the AES-GCM authenticated manifest) before printing them in the verify-usb comma...

• Other injection

<1.4.9 · fixed in 1.4.9

Tutor LMS < 4.0.6 - Unauthenticated Arbitrary Zero-Argument Function Invocation via Template Variable Shadowing

• Tutor LMS
• Other injection

Formula Injection in dool project

• scottchiefbaker dool
• Other injection

Apache APISIX: ldap-auth plugin cross-subtree identity impersonation

• Apache Software Foundation Apache APISIX
• Other injection

Spring Framework Server Sent Event stream corruption while rendering fragments

• Other injection

>=6.2.0, <=6.2.19 || >=7.0.0, <7.0.9 · fixed in 7.0.9

go-wind-cms (GoWind) before 1.0.0 has a missing authorization vulnerability.

• Other injection

SourceCodester Simple Online Food Ordering System ajax.php login2 sql injection

• SourceCodester Simple Online Food Ordering System
• Other injection
• SQL injection

Injection in WebPros Plesk

• WebPros Plesk
• Other injection

@logtape/syslog: syslog log injection via unescaped control characters and unvalidated SD-NAME keys

• Other injection

<1.3.11 || >=2.0.0, <2.0.14 || >=2.1.0, <2.1.5 · fixed in 1.3.11, 2.0.14, 2.1.5

Blind LDAP Injection in Sign-In Endpoint in TÜBİTAK BİLGEM's Liderahenk

• TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk
• Other injection

Remote Code Execution in BigQuery Data Transfer Service via JDBC Connection String Injection

• Google Cloud BigQuery Data Transfer Service
• Other injection

CRLF injection in Ubiquiti Inc UniFi OS Server and others

• Ubiquiti Inc UniFi OS Server
• Ubiquiti Inc Cloud Keys
• Other injection

CRLF injection in Ubiquiti Inc UniFi OS Server and others

• Ubiquiti Inc UniFi OS Server
• Ubiquiti Inc Cloud Keys
• Other injection

TOTOLINK N600R cstecgi.cgi getCurrentTime command injection

• TOTOLINK N600R
• Other injection
• Command injection

code-projects Simple Inventory System edit.php sql injection

• code-projects Simple Inventory System
• Other injection
• SQL injection

SililaWijesinghe Food Ordering System search.php sql injection

• SililaWijesinghe Food Ordering System
• Other injection
• SQL injection

Injection in Google Chrome

• Google Chrome
• Other injection

Injection in Google Chrome

• Google Chrome
• Other injection

liketrek TREK Journey Entry Update journey.controller.t journeyService.updateEntry sql injection

• TREK
• Other injection
• SQL injection

TYPO3-EXT-SA-2026-025: Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

• Other injection

<11.2.8 || >=11.5.0, <11.6.6 || >=12.0.0, <12.1.4 || >=13.0.0, <13.1.4 · fixed in 11.2.8, 11.6.6, 12.1.4, 13.1.4

TYPO3-EXT-SA-2026-025: Information Disclosure in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)

• Other injection

<11.2.8 || >=11.5.0, <11.6.6 || >=12.0.0, <12.1.4 || >=13.0.0, <13.1.4 · fixed in 11.2.8, 11.6.6, 12.1.4, 13.1.4

itsourcecode Sales and Inventory System cust_del.php sql injection

• itsourcecode Sales and Inventory System
• Other injection
• SQL injection

Fdawgs node-poppler Argument Injection index.js pdfUnite argument injection

• Fdawgs node-poppler
• Other injection
• Command injection

netfoil vulnerable to improper handling of untrusted DoH response data

• Other injection

<0.5.0 · fixed in 0.5.0

Apache Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy

• Other injection
• CWE-20

>=3.15.0, <4.14.9 || >=4.15.0, <4.18.4 || >=4.19.0, <4.22.0 · fixed in 4.14.9, 4.18.4, 4.22.0

TIM Flow < 26.0.6 CRLF Injection via rt Parameter

• TIM Solutions TIM Flow
• Other injection

SourceCodester Simple Online Food Ordering System ajax.php save_settings sql injection

• SourceCodester Simple Online Food Ordering System
• Other injection
• SQL injection

SourceCodester Simple Online Food Ordering System ajax.php confirm_order sql injection

• SourceCodester Simple Online Food Ordering System
• Other injection
• SQL injection

itsourcecode Online Clinic Management System Admin Login login.php sql injection

• itsourcecode Online Clinic Management System
• Other injection
• SQL injection

itsourcecode Real Estate Management System search.php sql injection

• itsourcecode Real Estate Management System
• Other injection
• SQL injection

itsourcecode Payroll System admin_class.php login sql injection

• itsourcecode Payroll System
• Other injection
• SQL injection

itsourcecode Library Management System editbooks.php sql injection

• itsourcecode Library Management System
• Other injection
• SQL injection

SourceCodester Simple Online Food Ordering System view_prod.php sql injection

• SourceCodester Simple Online Food Ordering System
• Other injection
• SQL injection

SourceCodester Simple Online Food Ordering System ajax.php add_to_cart sql injection

• SourceCodester Simple Online Food Ordering System
• Other injection
• SQL injection

SourceCodester Simple Online Food Ordering System ajax.php save_user sql injection

• SourceCodester Simple Online Food Ordering System
• Other injection
• SQL injection

itsourcecode Sales and Inventory System cust_edit.php sql injection

• itsourcecode Sales and Inventory System
• Other injection
• SQL injection

Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System plansImmediate PlanController.getImmediatePlans sql injection

• Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System
• Other injection
• SQL injection

itsourcecode Sales and Inventory System processlogin.php sql injection

• itsourcecode Sales and Inventory System
• Other injection
• SQL injection

provectus kafka-ui Groovy Code MessagesController.java executeSmartFilterTest code injection

• provectus kafka-ui
• Other injection
• Code injection

exceljs through 4.4.0 CSV Formula Injection via Unescaped Cell Values

• exceljs
• Other injection

code-projects Barangay Resident Profiling Management System Resident Search Functionality residents.php sql injection

• code-projects Barangay Resident Profiling Management System
• Other injection
• SQL injection

Tenda CH22 exeCommand formexeCommand command injection

• Tenda CH22
• Other injection
• Command injection

Reverse::Proxy versions before 0.04 for Perl allow HTTP request smuggling via a percent-decoded PATH_INFO written unencoded to the upstream request line

• Other injection
• HTTP request smuggling

itsourcecode Hospital Management System Project in PHP viewservicetype.php sql injection

• itsourcecode Hospital Management System Project in PHP
• Other injection
• SQL injection

Tenda CH22 editFileName formeditFileName command injection

• Tenda CH22
• Other injection
• Command injection

sambitraj Student-Management-System Management Mutation sql injection

• sambitraj Student-Management-System
• Other injection
• SQL injection

sambitraj Student-Management-System Dashboard sql injection

• sambitraj Student-Management-System
• Other injection
• SQL injection

TRENDnet TEW-823DRU CLI Configuration Tool nvram_get command injection

• TRENDnet TEW-823DRU
• Other injection
• Command injection

TRENDnet TEW-821DAP ssi upload.cgi command injection

• TRENDnet TEW-821DAP
• Other injection
• Command injection

ProfilePress < 4.17.1 - Unauthenticated Arbitrary Shortcode Execution via Display Name

• ProfilePress
• Other injection

Micrometer StatsD and Logging meter registries line-protocol and log injection vulnerability

• Spring Micrometer
• Other injection

Comfast CF-N1-S mbox-config system command injection

• Comfast CF-N1-S
• Other injection
• Command injection

Element and Attribute Names Injected Verbatim into XML Output in xml_builder

• Other injection

>=0.0.1, <2.4.1 · fixed in 2.4.1

CDATA Section Breakout via Unsanitised ]]> in xml_builder

• Other injection

>=0.0.7, <2.4.1 · fixed in 2.4.1

SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP submit.php saveUser sql injection

• SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP
• Other injection
• SQL injection

HTTP/2 header field values containing CR, LF or NUL are passed to the application unvalidated in Bandit

• Other injection

>=1.4.0, <1.12.5 · fixed in 1.12.5