CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HIn PHP versions 8.2.* before 8.2.31, 8.3.* before 8.3.31, 8.4.* before 8.4.21, and 8.5.* before 8.5.6, the PDO Firebird driver improperly handles NUL bytes when preparing SQL queries. During token-by-token query construction, a string token containing a NUL byte is copied via strncat(), which stops at the NUL byte, dropping the closing quote and causing subsequent SQL tokens to be interpreted as part of the string. This allows SQL injection when attacker-controlled values are quoted via PDO::quote() and embedded in SQL statements.
Multiple vulnerabilities have been discovered in Tenable products, including vulnerabilities that could lead to arbitrary code execution, data integrity compromise, and SQL injection attacks. These vulnerabilities span a…
Multiple vulnerabilities have been discovered within Tenable Security Center, including remote code execution, SQL injection, and policy bypass. These vulnerabilities, spanning from 2026-06 to 2026-07, allow attackers to…
This week’s security news is dominated by a concerning trend: vulnerabilities are being exploited faster than patches can be applied, leading to a surge in attacks. Notable events include a ShareFile threat urging users…
