https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 23:35:10 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-266832 EUVD-2026-266832 https://cve.radiocsirt.org/vuln/euvd-2026-266832 https://cve.radiocsirt.org/vuln/fkie_cve-2026-22243 <p>EGroupware is a Web based groupware server written in PHP. A SQL Injection vulnerability exists in the core components of EGroupware prior to versions 23.1.20260113 and 26.0.20260113, specifically in the `Nextmatch` filter processing. The flaw allows authenticated attackers to inject arbitrary SQL commands into the `WHERE` clause of database queries. This is achieved by exploiting a PHP type juggling issue where JSON decoding converts numeric strings into integers, bypassing the `is_int()` security check used by the application. Versions 23.1.20260113 and 26.0.20260113 patch the vulnerability.</p> <p>EGroupware is a Web based groupware server written in PHP. A SQL Injection vulnerability exists in the core components of EGroupware prior to versions 23.1.20260113 and 26.0.20260113, specifically in the `Nextmatch` filter processing. The flaw allows authenticated attackers to inject arbitrary SQL commands into the `WHERE` clause of database queries. This is achieved by exploiting a PHP type juggling issue where JSON decoding converts numeric strings into integers, bypassing the `is_int()` security check used by the application. Versions 23.1.20260113 and 26.0.20260113 patch the vulnerability.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-22243 https://cve.radiocsirt.org/vuln/ghsa-rvxj-7f72-mhrx <p><strong>Affected:</strong> Packagist: egroupware/egroupware</p> <p>### Summary **Critical Authenticated SQL Injection in Nextmatch Widget Filter Processing**</p> <p>A critical SQL Injection vulnerability exists in the core components of EGroupware, specifically in the `Nextmatch` filter processing. The flaw allows authenticated attackers to inject arbitrary SQL commands into the `WHERE` clause of database queries. This is achieved by exploiting a PHP type juggling issue where JSON decoding converts numeric strings into integers, bypassing the `is_int()` security check used by the application.</p> <p>### Details **Root Cause Analysis** The vulnerability exists in how the database abstraction layer (`Api\Db`) and high-level storage classes (`Api\Storage\Base`, `infolog_so`) process the `col_filter` array used in &#34;Nextmatch&#34; widgets.</p> <p>The application attempts to validate input using `is_int($key)` to determine if an array key represents a raw SQL fragment that should be trusted. However, when processing JSON-based POST requests, PHP&#39;s `json_decode` automatically converts numeric string keys (e.g., `&#34;0&#34;`) into native integers.</p> <p>Consequently, an attacker can send a JSON payload with an associative array containing numeric keys. The application interprets these keys as integers (`is_int` returns true) and blindly appends the associated values - containing malicious SQL - directly to the query.</p> <p>**Vulnerable Code Locations**</p> <p>1. **File:** `sources/egroupware/api/src/Db.php` (Approx. Line 1776) Method: `column_data_implode`</p> <p>```php // In function column_dat…</p> <p><strong>Affected:</strong> Packagist: egroupware/egroupware</p> <p>### Summary **Critical Authenticated SQL Injection in Nextmatch Widget Filter Processing**</p> <p>A critical SQL Injection vulnerability exists in the core components of EGroupware, specifically in the `Nextmatch` filter processing. The flaw allows authenticated attackers to inject arbitrary SQL commands into the `WHERE` clause of database queries. This is achieved by exploiting a PHP type juggling issue where JSON decoding converts numeric strings into integers, bypassing the `is_int()` security check used by the application.</p> <p>### Details **Root Cause Analysis** The vulnerability exists in how the database abstraction layer (`Api\Db`) and high-level storage classes (`Api\Storage\Base`, `infolog_so`) process the `col_filter` array used in &#34;Nextmatch&#34; widgets.</p> <p>The application attempts to validate input using `is_int($key)` to determine if an array key represents a raw SQL fragment that should be trusted. However, when processing JSON-based POST requests, PHP&#39;s `json_decode` automatically converts numeric string keys (e.g., `&#34;0&#34;`) into native integers.</p> <p>Consequently, an attacker can send a JSON payload with an associative array containing numeric keys. The application interprets these keys as integers (`is_int` returns true) and blindly appends the associated values - containing malicious SQL - directly to the query.</p> <p>**Vulnerable Code Locations**</p> <p>1. **File:** `sources/egroupware/api/src/Db.php` (Approx. Line 1776) Method: `column_data_implode`</p> <p>```php // In function column_dat…</p> https://cve.radiocsirt.org/vuln/ghsa-rvxj-7f72-mhrx