Aggregator

CVE-2025-57833：Potential SQL injection in FilteredRelation column aliases

先知技术社区
3 weeks ago
Django时隔一年爆出来的SQL注入漏洞，大概一看大概是别名引起的注入（毕竟别名是无法预编译的） 该漏洞影响 Django 框架中的 FilteredRelation 功能，当使用 QuerySet.annotate() 或 QuerySet.alias() 方法，并通过 Python 的字典扩展 (**kwargs) 提供列别名时，存在 SQL 注入风险。这是由于对字典键（即列别名）未进行充分

Vulnerable Codes in Legacy Python Packages Enables Attacks on Python Package Index Via Domain Compromise

Cyber Security News
3 weeks ago

Hidden vulnerabilities in legacy code often create unseen risks for modern development environments. One such issue recently surfaced within the Python ecosystem, where outdated bootstrap scripts associated with the zc.buildout tool expose users to domain takeover attacks. These scripts, designed to automate the installation of package dependencies, contain hardcoded references to external domains that are […]

The post Vulnerable Codes in Legacy Python Packages Enables Attacks on Python Package Index Via Domain Compromise appeared first on Cyber Security News.

Tushar Subhra Dutta

CVE-2010-0693 | CommodityRentals Trade Manager Script products.php cid sql injection (EDB-11412 / XFDB-56223)

Vuldb Updates
3 weeks ago
A vulnerability described as critical has been identified in CommodityRentals Trade Manager Script. The impacted element is an unknown function of the file products.php. Such manipulation of the argument cid leads to sql injection. This vulnerability is listed as CVE-2010-0693. The attack may be performed from remote. In addition, an exploit is available.
vuldb.com

CVE-2010-0707 | Timeclock-software Employee Timeclock Software 0.99 add_user.php cross-site request forgery (EDB-11516 / XFDB-56410)

Vuldb Updates
3 weeks ago
A vulnerability, which was classified as problematic, was found in Timeclock-software Employee Timeclock Software 0.99. The affected element is an unknown function of the file add_user.php. Executing manipulation can lead to cross-site request forgery. This vulnerability is registered as CVE-2010-0707. It is possible to launch the attack remotely. Furthermore, an exploit is available.
vuldb.com

Managed ad