Do Son A 3-flaw chain (CRLF, Auth Bypass, SQLi) achieves root RCE on Synology BeeStation. The exploit uses a "Dirty File Write" SQLi to inject a malicious crontab entry, bypassing the lack of a PHP interpreter.
sql injection
Django patched CVE-2025-13372, a High-severity SQLi flaw affecting PostgreSQL FilteredRelation via kwargs, and a DoS flaw in the XML serializer (CVE-2025-64460). Update to v5.2.9+.
Devolutions Server patched a Critical SQLi flaw (CVE-2025-13757) allowing authenticated users to exfiltrate or modify data via log parameters. Update to v2025.2.21 or v2025.3.9 immediately.
ASUS fixes 8 severe router flaws, including a critical AiCloud authentication bypass (CVSS 9.4). Users must update firmware immediately to patch vulnerabilities.
Zoho issued an urgent patch for a Critical (CVSS 9.8) Unauthenticated SQL Injection flaw (CVE-2025-8324) in Analytics Plus. The bug risks remote query execution and account takeover. Update to Build 6171.
SuiteCRM released an urgent patch (v8.9.1) for two SQL Injection flaws. The time-based SQLi (CVSS 8.8) and GraphQL SQLi allow authenticated users to extract sensitive customer data from the backend database.
Django released urgent patches (v5.2.8+) for a Critical SQL Injection flaw (CVE-2025-64459) affecting QuerySet methods via the _connector keyword, risking remote database compromise.
Esri released a patch for a Critical (CVSS 10.0) SQL Injection flaw in ArcGIS Server v11.3, 11.4, and 11.5 that allows RCE and data access. Update immediately.
QNAP patches NetBak Replicator and Qsync Central. Flaws include a DLL hijacking risk and critical SQL Injection that allows remote attackers to execute code.
The Django team released urgent updates (v5.2.7, 5.1.13, 4.2.25) to fix a High-severity SQL Injection flaw (CVE-2025-59681) affecting QuerySet methods in MySQL/MariaDB.
A new report reveals a high-severity SQL injection flaw (CVE-2025-57833) in Django's FilteredRelation. A PoC is public with technical details. Patching is urgent.
A critical SQL injection flaw (CVE-2025-58450) in pREST allows attackers to read sensitive files, steal credentials, and manipulate databases. Patching is urgent.
A new report reveals a high-severity SQL injection flaw (CVE-2025-57833) in Django's FilteredRelation. The bug allows attackers to manipulate queries.
IBM has issued a security advisory for a SQL injection flaw (CVE-2025-0165) in watsonx Orchestrate. The high-severity bug could allow attackers to manipulate backend databases.
A critical SQL injection flaw (CVE-2025-50979) in NodeBB allows remote attackers to access sensitive data. Admins are urged to patch immediately.
Two critical flaws in the open-source BI tool DataEase allow attackers to achieve remote code execution and arbitrary file writes, exposing unpatched systems to compromise.
A new security update for PostgreSQL fixes three vulnerabilities, including two critical flaws that could lead to remote code execution.
A critical SQL injection flaw (CVE-2025-54119, CVSS 10.0) in ADOdb’s SQLite3 driver allows arbitrary SQL execution via improperly escaped table names.
Salesforce patched eight critical flaws in Tableau Server, including RCE, database exposure, and SSRF vulnerabilities, urging users to update immediately.
High-Severity SQL Injection (CVE-2025-52914) in Mitel MiCollab Allows Data Access, Command Execution
High-Severity SQL Injection (CVE-2025-52914) in Mitel MiCollab Allows Data Access, Command Execution
Mitel issued patches for a high-severity SQL injection flaw (CVE-2025-52914) in MiCollab, allowing authenticated attackers to access user provisioning data and execute arbitrary database commands.
Lenovo issued patches for three vulnerabilities in Lenovo Vantage (CVE-2025-6230, CVE-2025-6231, CVE-2025-6232) allowing local privilege escalation on PCs. Update immediately.
CISA added CVE-2025-25257, a critical FortiWeb SQL injection vulnerability (CVSS 9.6), to its KEV Catalog, confirming active exploitation in the wild. Update immediately!