All CVEs — page 268 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
A post-authentication OS command injection vulnerability in the SMA1000 appliance allows authenticated attackers to execute arbitrary operating system commands with administrator privileges, potentially leading to full system compromise.
A pre-authentication SSRF vulnerability allows remote unauthenticated attackers to exploit the SMA1000 Appliance Work Place interface to issue requests on behalf of the appliance, potentially accessing internal functionality and performing unauthorized operations.
A SQL injection vulnerability in 10Web Slider allows attackers to perform blind SQL injection attacks, potentially leading to unauthorized data access and manipulation. This affects versions through 1.2.63.
This vulnerability allows authenticated attackers to perform blind SQL injection attacks against the WP Post Author plugin, potentially enabling them to extract database information without direct output feedback. The flaw occurs when user input is not properly sanitized before being included in SQL queries.
GitAhead through 2.7.1 on macOS allows attackers to execute shell commands by crafting repository filenames, posing a significant risk due to the high privilege level of the victim user.
GitAhead allows attackers to inject OS commands through crafted filenames in git filters, enabling arbitrary command execution when victims check out or stage files from malicious repositories.
The patool library contains a command injection vulnerability in its Windows shell quoting implementation, allowing attackers to execute arbitrary commands when processing specially crafted archive filenames. This affects systems that use patool with shell=True parameter and can lead to full system compromise.
Rundeck contains an OS command injection vulnerability in its Windows node executor that allows authenticated users to execute arbitrary commands with node executor credentials. This affects Windows nodes specifically and can lead to full system compromise.
A code injection vulnerability exists in the upgrade script of Movable Type, allowing unauthenticated attackers to execute arbitrary Perl scripts or SQL queries, potentially leading to full system compromise.
This vulnerability allows attackers to perform blind SQL injection attacks against the Pix por Piggly plugin for WooCommerce, potentially enabling them to extract sensitive data from the database without proper authentication. The flaw occurs due to improper neutralization of special elements in SQL commands.
A SQL injection vulnerability exists in the Post title marquee scroll plugin that allows attackers to perform blind SQL injection attacks. This flaw enables attackers to extract data from the database through carefully crafted SQL commands, potentially leading to unauthorized access to sensitive information.
An SQL Injection vulnerability in Movable Type's Site Search function allows unauthenticated attackers to execute arbitrary SQL queries, potentially leading to data theft or manipulation.
This vulnerability allows attackers to perform blind SQL injection attacks against the affiliate-toolkit plugin, potentially enabling them to extract data from the database through specially crafted SQL commands. The flaw is particularly concerning because it can lead to unauthorized data access and potential system compromise.
This vulnerability allows attackers to perform blind SQL injection attacks against the Dynamic User Directory plugin, potentially enabling them to extract data from the database through carefully crafted SQL commands. The flaw occurs due to improper neutralization of special elements in SQL commands.