Export limit exceeded: 40010 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (40010 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-19355 | 1 Mingsoft | 1 Mcms | 2026-08-10 | 7.3 High |
| A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of the component ms-mdiy. Executing a manipulation of the argument formFields can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way. | ||||
| CVE-2026-19344 | 1 Code-projects | 1 Task Management System | 2026-08-10 | 7.3 High |
| A vulnerability has been found in code-projects Task Management System 1.0. Affected by this issue is some unknown functionality of the file /user/comment_count_user.php. The manipulation of the argument task_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. | ||||
| CVE-2026-19211 | 1 Sourcecodester | 1 Photo Share Website | 2026-08-10 | 7.3 High |
| A vulnerability was found in SourceCodester Photo Share Website 1.0. This affects an unknown function of the file /social/ajax.php?action=signup. Performing a manipulation of the argument email results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used. | ||||
| CVE-2026-13692 | 2 Payu, Wordpress | 2 Payu Commercepro Plugin, Wordpress | 2026-08-10 | 5.3 Medium |
| The PayU CommercePro Plugin WordPress plugin before 3.9.0 does not verify the payment-gateway signature before applying order modifications, allowing unauthenticated attackers to tamper with the totals, shipping and metadata of arbitrary WooCommerce orders. | ||||
| CVE-2026-71852 | 1 Py-pdf | 1 Pypdf | 2026-08-10 | 5.5 Medium |
| pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause long runtimes and large memory consumption when pypdf/_font.py function Font._collect_cid_character_widths expands unusually large CID font /W width ranges or excessive width entries during text extraction. This issue is fixed in 6.15.0. | ||||
| CVE-2026-19231 | 1 Sourcecodester | 1 Simple Doctors Appointment System | 2026-08-10 | 7.3 High |
| A security flaw has been discovered in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=delete_appointment. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. | ||||
| CVE-2026-66058 | 1 Frappe | 1 Frappe | 2026-08-10 | N/A |
| Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API (update_follow) is possible for an authenticated user. This issue is fixed in versions 16.20.0 and 15.112.0. | ||||
| CVE-2026-3843 | 3 Bukts, Linux, Nefteprodukttekhnika Llc | 3 Buk Ts-g Gas Station Automation System, Linux Kernel, Buk Ts-g Gas Station Automation System | 2026-08-10 | 9.8 Critical |
| Nefteprodukttekhnika BUK TS-G Gas Station Automation System 2.9.1 on Linux contains a SQL Injection vulnerability (CWE-89) in the system configuration module. A remote attacker can send specially crafted HTTP POST requests to the /php/request.php endpoint via the sql parameter in application/x-www-form-urlencoded data (e.g., action=do&sql=<query_here>&reload_driver=0) to execute arbitrary SQL commands and potentially achieve remote code execution. | ||||
| CVE-2026-71292 | 1 Intelliants | 1 Subrion | 2026-08-10 | 7.2 High |
| Subrion CMS's admin grid sorting helper, _gridGetSorting in includes/classes/ia.base.controller.admin.php, whitelists the (ASC/DESC) request parameter via in_array, but falls back to the raw, attacker-supplied GET parameter whenever the requested key is not present in the per-controller whitelist array: , which is then placed into %s with only backtick-quoting and no escaping. | ||||
| CVE-2026-71288 | 1 Koha-community | 1 Koha | 2026-08-10 | 8.8 High |
| Koha's guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders, this requires an explicit allowlist, which does not exist. | ||||
| CVE-2026-71282 | 1 Chirpstack | 1 Chirpstack | 2026-08-10 | 6.5 Medium |
| ChirpStack's SQLite-backend device tag filtering (chirpstack/src/storage/device.rs, in both get_count and list) interpolates the user-supplied tag KEY directly into a raw SQL fragment via Rust's format! macro , while only the tag VALUE is safely parameter-bound via Diesel's .bind. | ||||
| CVE-2026-71276 | 1 Absmach | 1 Magistrala | 2026-08-10 | 7.1 High |
| Magistrala (formerly Mainflux)'s message-readers API reads a value from the HTTP query string (readers/api/http/transport.go) with no validation and interpolates it directly into raw SQL queries via fmt.Sprintf in both the PostgreSQL reader (readers/postgres/messages.go: ) and the TimescaleDB reader (readers/timescale/messages.go, same pattern), enabling SQL injection by any authenticated user able to query channel messages. | ||||
| CVE-2026-71264 | 1 Aircoookie | 1 Wled | 2026-08-10 | 8.2 High |
| WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly checks correctPIN, disclosing the device's general configuration (network, hardware, LED setup) to any unauthenticated client on the network. | ||||
| CVE-2026-71252 | 1 Raghav993 | 1 Toner-management | 2026-08-10 | 8.2 High |
| toner-management's admin state-changing handlers (add.php, edit.php, delete.php under admin/toners, admin/toner-brands, admin/printers, and related admin subdirectories) executed INSERT/UPDATE/DELETE database operations with no authentication or authorization check, while access control was enforced only in listing views. | ||||
| CVE-2026-71248 | 1 Harsh21patel | 1 Inventory-management-system-php | 2026-08-10 | 9.8 Critical |
| Inventory-Management-System-PHP's login.php constructs its authentication query via direct string concatenation of raw POST parameters: = "select * from user where email = '' and password = ''", with no escaping or parameterization, allowing authentication bypass via a payload such as email=' OR 1=1 LIMIT 1-- -. | ||||
| CVE-2026-71247 | 1 Documenso | 1 Documenso | 2026-08-10 | 6.5 Medium |
| Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. A newer V2 signing path (sign-envelope-field.ts) explicitly blocks assistants from completing SIGNATURE fields, and the project's own test suite comments confirm this guard is absent from the V1 path used here. | ||||
| CVE-2026-71237 | 1 Miantang | 1 Iot-php | 2026-08-10 | 9.8 Critical |
| Miantang/IoT-PHP's index.php implements a POST /userlogin route that reads the password directly from ['pwd'] with no sanitization and concatenates it into a raw SQL string: mysql_query("select * from userlists where username='' and password='' limit 1"). An unauthenticated attacker can submit a payload such as pwd=' OR '1'='1 to bypass authentication and, via UNION-based injection, extract arbitrary data from the database. | ||||
| CVE-2026-71234 | 1 Documize | 1 Community | 2026-08-10 | 7.5 High |
| Documize Community's attachment download route (domain/attachment/endpoint.go, Download function, registered via AddPublic with no auth middleware) accepts a query parameter and grants access whenever the parameter is simply non-empty (len(secureToken) > 0), without comparing it to any server-stored value. | ||||
| CVE-2026-71231 | 1 Thebradleysanders | 1 Iotsmarthome | 2026-08-10 | 9.8 Critical |
| IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT * FROM users WHERE ID='<decoded lastLogin cookie>' after base64-decoding the client-supplied lastLogin cookie via safe_decode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated into the SQL string. | ||||
| CVE-2026-71212 | 1 Indravoyager | 1 Xidown | 2026-08-10 | 4.4 Medium |
| xidown (a yt-dlp/ffmpeg GUI wrapper) builds its yt-dlp command-line invocation (xidown/core/scanner.py and downloader.py) by appending the user-provided or scanned URL as a bare trailing positional argument, with no '--' end-of-options marker and no scheme validation anywhere in the codebase. | ||||