Все уязвимости

Rocket.Chat: Pre-Auth NoSQL Injection in OAuth2 Token Endpoint leading to Arbitrary User ATO

Rocket.Chat: Pre-Auth NoSQL Injection in CAS Login Handler leading to Arbitrary CAS/SAML User Session Hijack

Yeti: Authenticated AQL injection via unvalidated search sorting and filter_aliases parameters

ExecuteUpdate may evaluate caller-supplied values as MongoDB expressions

Waline login accepts a non-string email as a match-all MongoDB query

Jpom 2.10.0 through 2.11.12 Authentication Bypass via JPOM-USER-TOKEN Header

NoSQL injection via dot and dollar characters in LINQ filter field names and dictionary keys

NoSQL operator injection via unvalidated replacement document in findOneAndReplace

Microsoft Discovery Studio Information Disclosure Vulnerability

Asterisk: LDAP Filter Injection in res_config_ldap via SIP Username (Unauthenticated Information Disclosure)

Update operator injection via single-element list rewriting in the update builder

Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content

SPL Injection through the REST API in Splunk Secure Gateway

Trudesk through 1.2.11 MongoDB $where Injection via tickets search API

n8n before 2.36.2 Query Injection via Elasticsearch Firestore Nodes

n8n before 1.123.85, 2.43.5, and 2.44.1 Filter Injection via Quick Base Node Where Parameter

n8n before 1.123.85, 2.43.5, and 2.44.1 OData $filter Injection via Outlook and SharePoint Nodes

Goobi viewer: Solr injection via unvalidated region parameter in spatial search

Goobi viewer: Solr query injection via the legacy RSS servlet q and filterQuery parameters

Trudesk through 1.2.11 Username Enumeration via Regex Injection in /api/v1/login

NoSQL injection via mismatched BSON size prefix in raw document splice to the wire protocol

Tandoor Recipes: ORM ORDER BY Injection via FK Traversal in Tandoor Recipes

Parse Server 9.0.0 before 9.10.5-alpha.6 ACL Bypass via $relatedTo Query

Ghost 5.9.0 before 6.44.1 Authorization Bypass via Comment Like

SPL Injection through Splunk Web in Splunk Secure Gateway

FastGPT: NoSQL Injection in loginByPassword leads to Authentication Bypass

Flowise: Cypher Injection in GraphCypherQAChain

FastGPT: NoSQL Injection in updatePasswordByOld Leads to Account Takeover

Azure Data Explorer MCP Server: KQL Injection in multiple tools allows MCP client to execute arbitrary Kusto queries

There is a cypher injection issue in LogonTracer prior to v2.0.0. If specially crafted Windows event