CVE Feed

    Dashboard / CVE / CVE-2012-5648

    CVE-2012-5648

    Multiple SQL injection vulnerabilities in Foreman before 1.0.2 allow remote attackers to execute arbitrary SQL commands via unspecified parameters to (1) app/models/hostext/search.rb or (2) app/models/puppetclass.rb, related to the search mechanism.

    Published:Apr 4, 2014
    Last Modified:Apr 12, 2025
    EPS:Apr 4, 2014
    EPSS Score:0.00605
    CVSS Score:7.5

    Affected Products

    Vendor
    Theforeman
    Product
    Foreman

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-5135 (CVSS 6.5) — A flaw was found in Foreman. This broken access control vulnerability allows an authenticated user with host-e…
    CVE-2025-9572 (CVSS 5) — n authorization flaw in Foreman's GraphQL API allows low-privileged users to access metadata beyond their assi…
    CVE-2024-7700 (CVSS 6.5) — A command injection flaw was found in the "Host Init Config" template in the Foreman application via the "Inst…
    CVE-2023-4886 (CVSS 6.7) — A sensitive information exposure vulnerability was found in foreman. Contents of tomcat's server.xml file, whi…
    CVE-2022-3874 (CVSS 8) — A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on…
    CVE-2023-0462 (CVSS 8) — An arbitrary code execution flaw was found in Foreman. This issue may allow an admin user to execute arbitrary…
    CVE-2023-0118 (CVSS 9.1) — An arbitrary code execution flaw was found in Foreman. This flaw allows an admin user to bypass safe mode in t…
    CVE-2020-10710 (CVSS 4.4) — A flaw was found where the Plaintext Candlepin password is disclosed while updating Red Hat Satellite through …
    CVE-2021-3584 (CVSS 7.2) — A server side remote code execution vulnerability was found in Foreman project. A authenticated attacker could…
    CVE-2021-3590 (CVSS 8.8) — A flaw was found in Foreman project. A credential leak was identified which will expose Azure Compute Profile …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High