Monthly
SQL injection in AipexBase through commit 690adb9 allows an authenticated low-privilege attacker to read other users' database rows and tables by injecting SQL through the order_by and group_by fields of the /api/data/invoke endpoint. The attacker can supply subqueries or MySQL error-based functions (EXTRACTVALUE/UPDATEXML) to bypass the SqlGuard denylist and row-level security, but impact is limited to confidentiality with no write or modification path described. No public exploit identified at time of analysis; CVSS 7.1 with PR:L indicates a moderate-severity issue requiring valid authentication and a MySQL-style backend.
Authenticated SQL injection in WebVella ERP through 1.8.8 allows any valid user account to read unauthorized entities, including user and role tables, by sending crafted single-quoted literals in WHERE clauses to the EQL query API at POST /api/v3/en_US/eql. The flaw is CWE-89 in EqlBuilder's unsanitized SQL string interpolation, and the CVSS vector confirms PR:L, so unauthenticated attackers cannot exploit it directly. No public exploit code was identified at time of analysis, and although CVSS 4.0 scores this 7.1, the independent assessment correctly frames it as a genuine but moderate-priority issue rather than an overstated high-CVSS finding.
Unauthenticated SQL injection in Thecosy IceCMS through 4.1.5 allows remote attackers to read arbitrary database contents by appending crafted SQL after the LIMIT clause that is concatenated into a MyBatis-Plus QueryWrapper for the num path parameter of /WebArticle/findarticlesbynum. Exploitation requires no authentication, no user interaction, and no special conditions beyond network reachability of the endpoint (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5); the supplied CVSS 4.0 vector scores 8.7 with the same confidentiality-only impact. There is no CISA KEV listing and no confirmed public exploit code at time of analysis, though a public technical write-up describing the injection point is referenced, so exposure should be treated as a genuine high-priority data-disclosure risk for internet-facing instances that have not moved past 4.1.5.
Unauthenticated SQL injection in IceCMS (Thecosy IceCMS) through 4.1.5 lets any remote attacker who can reach the /WebResource/findresourcebynum endpoint read arbitrary data from the backend database by supplying a crafted 'num' path parameter. The parameter is concatenated after the SQL LIMIT clause via MyBatis-Plus QueryWrapper.last() with no parameterization, so union-based or blind injection can be used to exfiltrate table contents. The assessed impact is confidentiality-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) - no data modification, denial of service, or code execution - and no authentication, user interaction, or non-default configuration is required. The issue is not listed in CISA KEV and no confirmed active exploitation has been reported, but a detailed public write-up of the injection point exists, making the flaw straightforward to reproduce against network-reachable instances.
Authenticated SQL injection in ZR.Admin.NET through 3.8.2 allows any account holding the system:user:list permission to inject subquery or CASE expressions into the ORDER BY clause of the shared ToPage paging helper by supplying a crafted PagerInfo.Sort query parameter to GET /system/user/list, enabling blind extraction of database contents such as stored credentials. The flaw is read-only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; vendor-published CVSS 4.0 base of 7.1) and requires a valid low-privileged session with that specific list permission, so it is not remotely exploitable without authentication. No public exploit code and no confirmed active exploitation were identified at time of analysis, though a public technical writeup describing the ORDER BY injection path exists; a vendor patch is available.
SQL injection in Helical Insight through 7.0.0 allows authenticated users with at least viewer privileges to execute arbitrary SQL queries via crafted Numeric or String placeholder values sent to the /executeDatasource endpoint, bypassing the broken SqlDetect guard. This enables reading unexposed database tables and modifying data within the report's configured data source, with impact limited by the privileges of the database account used by the application. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated SQL injection (CWE-89) in FilePress through version 3.0.1 lets any low-privilege logged-in user inject arbitrary SQL into the ORDER BY clause through the unvalidated 'asc' parameter, enabling blind boolean- or time-based extraction of database contents including administrator credential hashes. The affected endpoints are dzz/pichome/library/filelist.php and dzz/collection/filelist.php; exploitation requires a valid authenticated session (PR:L) rather than anonymous access, and the injected queries are read/inference-based so the assessed impact is confidentiality-only. No active exploitation is confirmed (not in CISA KEV) and no public exploit identified at time of analysis, though the CVE record references a public technical writeup describing the injection point; rated CVSS 7.1 (4.0) / 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, making this a moderate, contained priority.
Improper quoting during SQL serialization in MariaDB Server 10.6.1 through 10.6.27, 10.11.18, 11.4.12, 11.8.8, 12.3.2 and 13.0.1 and earlier allows a low-privileged authenticated attacker who can create a foreign-data-wrapper SERVER, USER, UDF, plugin, or trigger with crafted identifiers or option values to inject arbitrary SQL into the output of SHOW CREATE SERVER, SHOW CREATE USER, or mariadb-dump; the injected statements execute only when a privileged operator later replays that generated SQL, such as during a dump restore. Exploitation requires both a pre-existing low-privileged account (CVSS PR:L) and a victim-initiated action (UI:R), so this is a conditional, stored-injection-style threat rather than an unauthenticated remote compromise. No public exploit code has been identified at time of analysis, and the issue is fixed in MariaDB 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2.
SQL injection in the MapSVG WordPress plugin (mapsvg-lite-interactive-vector-maps) affects all versions through 8.16.1 and lets an authenticated low-privileged user, such as a subscriber, contributor or customer account, inject arbitrary SQL through the plugin's vulnerable request handling, exposing database contents. The issue is remotely reachable with low attack complexity and needs no victim interaction, but it does require a valid account on a site that both runs the affected plugin and permits untrusted low-privilege registration; sites that do not hand out such accounts face materially lower real-world exposure. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so the practical risk is driven by the population of sites exposing low-privileged authenticated access to the plugin.
Unauthenticated SQL injection in Apache Kylin 5.0.0 through 5.0.4 allows a remote attacker who can reach a specific backend cache API endpoint to bypass the missing authentication check and reach SQL-executing logic, with the injected statement executed by the Kylin service (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L). Per Apache's advisory, practical exposure is concentrated on Kylin instances directly reachable from the public internet - the vendor characterizes this as uncommon - while in-house deployments confined to trusted internal networks are mostly not impacted, so the operative precondition is network reachability of the service rather than any configuration toggle. No CVSS vector from the vendor, EPSS score, KEV listing, or public exploit code was provided in the available intelligence, so no public exploit has been identified at time of analysis and quantitative exploitation signals are absent; severity rests on the vulnerability class and the vendor's own scoping. A fixed release exists in Apache Kylin 5.0.5.
SQL injection in AipexBase through commit 690adb9 allows an authenticated low-privilege attacker to read other users' database rows and tables by injecting SQL through the order_by and group_by fields of the /api/data/invoke endpoint. The attacker can supply subqueries or MySQL error-based functions (EXTRACTVALUE/UPDATEXML) to bypass the SqlGuard denylist and row-level security, but impact is limited to confidentiality with no write or modification path described. No public exploit identified at time of analysis; CVSS 7.1 with PR:L indicates a moderate-severity issue requiring valid authentication and a MySQL-style backend.
Authenticated SQL injection in WebVella ERP through 1.8.8 allows any valid user account to read unauthorized entities, including user and role tables, by sending crafted single-quoted literals in WHERE clauses to the EQL query API at POST /api/v3/en_US/eql. The flaw is CWE-89 in EqlBuilder's unsanitized SQL string interpolation, and the CVSS vector confirms PR:L, so unauthenticated attackers cannot exploit it directly. No public exploit code was identified at time of analysis, and although CVSS 4.0 scores this 7.1, the independent assessment correctly frames it as a genuine but moderate-priority issue rather than an overstated high-CVSS finding.
Unauthenticated SQL injection in Thecosy IceCMS through 4.1.5 allows remote attackers to read arbitrary database contents by appending crafted SQL after the LIMIT clause that is concatenated into a MyBatis-Plus QueryWrapper for the num path parameter of /WebArticle/findarticlesbynum. Exploitation requires no authentication, no user interaction, and no special conditions beyond network reachability of the endpoint (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5); the supplied CVSS 4.0 vector scores 8.7 with the same confidentiality-only impact. There is no CISA KEV listing and no confirmed public exploit code at time of analysis, though a public technical write-up describing the injection point is referenced, so exposure should be treated as a genuine high-priority data-disclosure risk for internet-facing instances that have not moved past 4.1.5.
Unauthenticated SQL injection in IceCMS (Thecosy IceCMS) through 4.1.5 lets any remote attacker who can reach the /WebResource/findresourcebynum endpoint read arbitrary data from the backend database by supplying a crafted 'num' path parameter. The parameter is concatenated after the SQL LIMIT clause via MyBatis-Plus QueryWrapper.last() with no parameterization, so union-based or blind injection can be used to exfiltrate table contents. The assessed impact is confidentiality-only (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) - no data modification, denial of service, or code execution - and no authentication, user interaction, or non-default configuration is required. The issue is not listed in CISA KEV and no confirmed active exploitation has been reported, but a detailed public write-up of the injection point exists, making the flaw straightforward to reproduce against network-reachable instances.
Authenticated SQL injection in ZR.Admin.NET through 3.8.2 allows any account holding the system:user:list permission to inject subquery or CASE expressions into the ORDER BY clause of the shared ToPage paging helper by supplying a crafted PagerInfo.Sort query parameter to GET /system/user/list, enabling blind extraction of database contents such as stored credentials. The flaw is read-only (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N; vendor-published CVSS 4.0 base of 7.1) and requires a valid low-privileged session with that specific list permission, so it is not remotely exploitable without authentication. No public exploit code and no confirmed active exploitation were identified at time of analysis, though a public technical writeup describing the ORDER BY injection path exists; a vendor patch is available.
SQL injection in Helical Insight through 7.0.0 allows authenticated users with at least viewer privileges to execute arbitrary SQL queries via crafted Numeric or String placeholder values sent to the /executeDatasource endpoint, bypassing the broken SqlDetect guard. This enables reading unexposed database tables and modifying data within the report's configured data source, with impact limited by the privileges of the database account used by the application. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated SQL injection (CWE-89) in FilePress through version 3.0.1 lets any low-privilege logged-in user inject arbitrary SQL into the ORDER BY clause through the unvalidated 'asc' parameter, enabling blind boolean- or time-based extraction of database contents including administrator credential hashes. The affected endpoints are dzz/pichome/library/filelist.php and dzz/collection/filelist.php; exploitation requires a valid authenticated session (PR:L) rather than anonymous access, and the injected queries are read/inference-based so the assessed impact is confidentiality-only. No active exploitation is confirmed (not in CISA KEV) and no public exploit identified at time of analysis, though the CVE record references a public technical writeup describing the injection point; rated CVSS 7.1 (4.0) / 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, making this a moderate, contained priority.
Improper quoting during SQL serialization in MariaDB Server 10.6.1 through 10.6.27, 10.11.18, 11.4.12, 11.8.8, 12.3.2 and 13.0.1 and earlier allows a low-privileged authenticated attacker who can create a foreign-data-wrapper SERVER, USER, UDF, plugin, or trigger with crafted identifiers or option values to inject arbitrary SQL into the output of SHOW CREATE SERVER, SHOW CREATE USER, or mariadb-dump; the injected statements execute only when a privileged operator later replays that generated SQL, such as during a dump restore. Exploitation requires both a pre-existing low-privileged account (CVSS PR:L) and a victim-initiated action (UI:R), so this is a conditional, stored-injection-style threat rather than an unauthenticated remote compromise. No public exploit code has been identified at time of analysis, and the issue is fixed in MariaDB 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3 and 13.0.2.
SQL injection in the MapSVG WordPress plugin (mapsvg-lite-interactive-vector-maps) affects all versions through 8.16.1 and lets an authenticated low-privileged user, such as a subscriber, contributor or customer account, inject arbitrary SQL through the plugin's vulnerable request handling, exposing database contents. The issue is remotely reachable with low attack complexity and needs no victim interaction, but it does require a valid account on a site that both runs the affected plugin and permits untrusted low-privilege registration; sites that do not hand out such accounts face materially lower real-world exposure. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so the practical risk is driven by the population of sites exposing low-privileged authenticated access to the plugin.
Unauthenticated SQL injection in Apache Kylin 5.0.0 through 5.0.4 allows a remote attacker who can reach a specific backend cache API endpoint to bypass the missing authentication check and reach SQL-executing logic, with the injected statement executed by the Kylin service (assessed CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L). Per Apache's advisory, practical exposure is concentrated on Kylin instances directly reachable from the public internet - the vendor characterizes this as uncommon - while in-house deployments confined to trusted internal networks are mostly not impacted, so the operative precondition is network reachability of the service rather than any configuration toggle. No CVSS vector from the vendor, EPSS score, KEV listing, or public exploit code was provided in the available intelligence, so no public exploit has been identified at time of analysis and quantitative exploitation signals are absent; severity rests on the vulnerability class and the vendor's own scoping. A fixed release exists in Apache Kylin 5.0.5.