Sar2Html
Monthly
SQL injection in sar2html 4.0.0's Search component permits remote low-privileged attackers to manipulate backend SQL queries by supplying crafted input to the Search argument in sar2html.py. Public exploit code exists (CVSS 4.0 E:P), though the vulnerability has not been confirmed as actively exploited in the wild via CISA KEV. The vendor did not respond to coordinated disclosure, leaving no official patch available and no timeline for remediation.
SQL injection in sar2html 4.0.0's Search component permits remote low-privileged attackers to manipulate backend SQL queries by supplying crafted input to the Search argument in sar2html.py. Public exploit code exists (CVSS 4.0 E:P), though the vulnerability has not been confirmed as actively exploited in the wild via CISA KEV. The vendor did not respond to coordinated disclosure, leaving no official patch available and no timeline for remediation.