CVE-2026-86672 ningzichun Student Management System Backup example.7z information disclosure

A vulnerability has been found in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected is an unknown function of the file example.7z of the component Backup Handler. The manipulation leads to information disclosure. The attack can be initiated remotely. Th...

CVE-2026-86672

CVE-2026-86672 affects the ningzichun Student Management System (up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf). The vulnerability resides in the Backup Handler component, specifically in the file example.7z , where an unknown function allows remote, unauthenticated information disclosure...

CVE-2026-86672 ningzichun Student Management System Backup example.7z information disclosure

A vulnerability has been found in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected is an unknown function of the file example.7z of the component Backup Handler. The manipulation leads to information disclosure. The attack can be initiated remotely. Th...

CVE-2026-86733

Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client mysql without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as ! as local shell commands. An authenticated...

Command Injection

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Command Injection via the restore process. An attacker can execute arbitrary operating system commands as the web application's user by uploading a crafted backup archive an...

EUVD-2026-72869

Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client mysql without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as ! as local shell commands. An authenticated...

CVE-2026-86733 Snipe-IT before 8.7.0 Remote Code Execution via Backup Restore

Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client mysql without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as ! as local shell commands. An authenticated...

CVE-2026-86733 Snipe-IT before 8.7.0 Remote Code Execution via Backup Restore

Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client mysql without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as ! as local shell commands. An authenticated...

CVE-2026-86733 Snipe-IT before 8.7.0 Remote Code Execution via Backup Restore

Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client mysql without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as ! as local shell commands. An authenticated...

CVE-2026-86733

Snipe-IT before 8.7.0 is vulnerable to remote code execution via its backup restore feature. The application streams SQL from an uploaded backup archive directly into the MySQL/MariaDB command-line client without the --binary-mode flag, causing the client to interpret backslash commands (e.g., \!...

CVE-2026-86519

A vulnerability was found in code-projects Student Crud Operation 1.0. This impacts an unknown function of the file /cardactivation.sql of the component Backup File Handler. The manipulation results in information disclosure. The attack can be launched remotely. The exploit has been made public a...

CVE-2026-86519

code-projects Student Crud Operation 1.0 is affected by an information disclosure vulnerability in its Backup File Handler component, specifically through the /card_activation.sql file. A remote, unauthenticated attacker can access this exposed database file, potentially revealing sensitive infor...

CVE-2026-86519 code-projects Student Crud Operation Backup File card_activation.sql information disclosure

A vulnerability was found in code-projects Student Crud Operation 1.0. This impacts an unknown function of the file /cardactivation.sql of the component Backup File Handler. The manipulation results in information disclosure. The attack can be launched remotely. The exploit has been made public a...

CVE-2026-86519 code-projects Student Crud Operation Backup File card_activation.sql information disclosure

A vulnerability was found in code-projects Student Crud Operation 1.0. This impacts an unknown function of the file /cardactivation.sql of the component Backup File Handler. The manipulation results in information disclosure. The attack can be launched remotely. The exploit has been made public a...

EUVD-2026-72642

A vulnerability was found in code-projects Student Crud Operation 1.0. This impacts an unknown function of the file /cardactivation.sql of the component Backup File Handler. The manipulation results in information disclosure. The attack can be launched remotely. The exploit has been made public a...

PT-2026-87130

Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client mysql without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as ! as local shell commands. An authenticated...

CVE-2026-78624: Improper Limitation of a Pathname to a Restricted Directory

The Okta Access Gateway backup restore function does not validate the filename embedded in an encrypted backup payload. This results in writing file contents to unintended locations on the appliance filesystem...

CVE-2026-86733: Improper Neutralization of Special Elements used in an OS Command

Snipe-IT before 8.7.0 streams the SQL entry from an uploaded backup archive directly into the MySQL/MariaDB command-line client mysql without the --binary-mode flag, so the client interprets lines beginning with backslash commands such as ! as local shell commands. An authenticated...

Cron Job Injection in Remote Backup

...

CVE-2026-86672: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability has been found in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected is an unknown function of the file example.7z of the component Backup Handler. The manipulation leads to information disclosure. The attack can be initiated remotely. Th...