Latest SQL injection news

A weekend batch of 198 CVEs includes a BACnet plaintext flaw (CVSS 9.1) exposing building automation to traffic interception. WordPress gets hit with five privilege escalation bugs, cookie-based SQL injection bypassing WAFs, and a strpos() admin takeover.

SQL injection meets RAG pipelines. Spring AI flaws turn chatbot queries into database commands. An unpatched ONNX bypass silences model trust checks. A CVSS 9.8 WordPress healthcare plugin leaks patient records with just an email address.

Two Chrome Mojo sandbox escapes (CVSS 9.6 and 8.3), a chainable Unraid NAS auth bypass + root RCE, and an AnythingLLM SQL injection lead 87 notable CVEs from March 16. One Unraid flaw targets the same file patched in 2020.

Five critical vulnerabilities lead the March 14-15 batch of 215 new CVEs. A CVSS 9.8 unauthenticated WordPress RCE, OneUptime's fourth CVSS 9.9 in six weeks, and three unpatched D-Link buffer overflows top the list.

Two CVSS 10.0 flaws top the March 12 CVE digest, with Himmelblau's Azure Entra ID bypass letting attackers authenticate to any tenant and a Jellyfin GitHub Actions flaw enabling full repo takeover. 644 new CVEs in one day.

A nother ingress-nginx annotation injection (CVSS 8.8) continues a year-long chain of Kubernetes controller flaws that started with IngressNightmare. Seven Unisoc NR modem bugs can crash Android phones remotely. Budibase leaks shell commands through its PostgreSQL integration.

March 9 brought 117 new CVEs but no critical-severity entries. The two worth tracking are an unpatched UltraVNC DLL hijack with a public exploit, and two Tiandy surveillance flaws from a vendor that has ignored disclosures since 2017.