CVE-2022-24407High· 8.8▾ TwilightIn Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.8 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
4.1%
In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.
cyrus-sasl >= 2.1.17, <= 2.1.27debian_linux = 9.0debian_linux = 10.0debian_linux = 11.0fedora = 34fedora = 35fedora = 36active_iq_unified_managerontap_select_deploy_administration_utilitycommunications_cloud_native_core_console = 22.2.0communications_cloud_native_core_network_function_cloud_native_environment = 22.2.0communications_cloud_native_core_security_edge_protection_proxy = 22.1.1Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2019-19906High· 7.5cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet
CVE-2026-107161High· 7.5A heap-based buffer overflow flaw was found in Cyrus SASL
CVE-2022-29155Critical· 9.8In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query
CVE-2019-19242Medium· 5.9SQLite 3.30.1 mishandles pExpr->y.pTab, as demonstrated by the TK_COLUMN case in sqlite3ExprCodeTarget in expr.c.
CVE-2025-10079High· 7.3A flaw has been found in PHPGurukul Small CRM 4.0
CVE-2025-10405High· 7.3A vulnerability was determined in itsourcecode Baptism Information Management System 1.0