Search Vulnerabilities

Institution scope bypass vulnerability in custom reports

Table scope bypass vulnerability in custom reports

Dgraph Vulnerable to DQL Injection via checkUserPassword GraphQL Query

High-Severity Vulnerability In Web Application Component of BeyondTrust Remote Support and Privileged Remote Access

Apache Camel: Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without vali...

Budibase: Anonymous NoSQL operator injection via published-app query templates

Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User ATO

Rocket.Chat: Pre-Auth NoSQL Injection in CAS Login Handler leading to Arbitrary CAS/SAML User Session Hijack

Open WebUI: RAG ACL Bypass in Milvus Multitenancy Mode

Spring AI vector store metadata filtering to handle special characters in Elasticsearch, OpenSearch, and GemFire Vector Stores

ClipBucket: SQL Wildcard Injection in Subtitle Edit Endpoint Allows Mass Subtitle Overwrite

PenguinMod-BackendApi: NoSQL Injection in Password Reset Endpoint Allows Account Takeover

Spring Data Relational Parameter not Escaped for Query By Example LIKE Pattern

Spring Data MongoDB Bind Parameter Literal Quoting Breakout

BuddyPress 14.4.0 REGEXP Injection via @Mention Username Resolution

Plane: ORM Field Reference Injection via `segment` Parameter in Saved Analytics

Strapi may leak sensitive data via relational filtering due to lack of query sanitization

ShellHub: Crash-DoS via field injection in filter and sort-by parameters

Flowsint: Cypher query injection in node type on node creation

KQL injection via kusto.tables.topics.mapping in kafka-sink-azure-kusto