CVE-2018-25176

The record

Alive Parish 2.0.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the key parameter in the search endpoint. Attackers can also upload arbitrary files via the person photo upload functionality to the images/uploaded directory for remote code execution.

Affected packages

Related vulnerabilities

• CVE-2026-96388 Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application… CWE-352
• CVE-2026-96374 Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross… CWE-352
• CVE-2026-114719 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation… CWE-352
• CVE-2026-114662 Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow… CWE-352
• CVE-2026-111883 Locust through 2.46.7 contains a cross-site request forgery vulnerability that allows… CWE-352
• CVE-2026-62139 Unauthenticated Cross Site Request Forgery (CSRF) in Site Kit by Google <= 1.186.0… CWE-352
• CVE-2026-62133 Subscriber Cross Site Request Forgery (CSRF) in RTMKit <= 2.1.5 versions. CWE-352
• CVE-2026-89245 WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a cross-site… CWE-352