CVE-2026-52691

CVE-2026-52691 is a SQL injection vulnerability (CWE-89) in the Apache Griffin Hive Metastore Module , affecting all versions of the project. The root cause is improper neutralization of special elements in SQL commands. The CVSS 3.1 score is 8.8 (HIGH) , with network-based attack vector, low com...

EUVD-2026-71100

UNSUPPORTED WHEN ASSIGNED Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Apache Griffin Hive Metastore Module. This issue affects Apache Griffin Hive Metastore Module: all versions. As this project is retired, we do not plan to release a versio...

zoneminder-rce-poc

just wait and see Proof of concept for an OS command injection vulnerability in ZoneMinder's event export functionality web/includes/downloadfunctions.php. Monitor names are interpolated directly into shell commands using manual single-quote wrapping instead of escapeshellarg. An attacker who can...

CVE-2026-85516

A vulnerability was detected in code-projects Vehicle Management System 1.0. The affected element is an unknown function of the file /busprofile.php. Performing a manipulation of the argument busid results in sql injection. It is possible to initiate the attack remotely. The exploit is now public...

CVE-2026-74237

GFI Exinda AI and ClearView before 7.6.5 contains an argument injection vulnerability in the Tools Iperf Client functionality. The webtoolscmd function constructs an iperf command using the server and options parameters without sanitization, permitting injection of arbitrary iperf flags. An...

CVE-2026-18198

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in TAC Information Services Internal and External Trade Inc. GOLDENHORN ONEIT allows Blind SQL Injection. This issue affects GOLDENHORN ONEIT: before Göbeklitepe...

EUVD-2026-71097

A vulnerability was detected in code-projects Vehicle Management System 1.0. The affected element is an unknown function of the file /busprofile.php. Performing a manipulation of the argument busid results in sql injection. It is possible to initiate the attack remotely. The exploit is now public...

CVE-2026-85516 code-projects Vehicle Management System busprofile.php sql injection

A vulnerability was detected in code-projects Vehicle Management System 1.0. The affected element is an unknown function of the file /busprofile.php. Performing a manipulation of the argument busid results in sql injection. It is possible to initiate the attack remotely. The exploit is now public...

CVE-2026-85516

A SQL injection vulnerability exists in code-projects Vehicle Management System 1.0 , specifically in the busid parameter of the file /busprofile.php. The vulnerability can be exploited remotely without authentication via manipulation of that argument. CVSS 3.1 rates it 7.3 (HIGH) with low impact...

CVE-2026-74237 GFI Exinda AI / ClearView < 7.6.5 Argument Injection via Tools Iperf Client

GFI Exinda AI and ClearView before 7.6.5 contains an argument injection vulnerability in the Tools Iperf Client functionality. The webtoolscmd function constructs an iperf command using the server and options parameters without sanitization, permitting injection of arbitrary iperf flags. An...

EUVD-2026-71086

GFI Exinda AI and ClearView before 7.6.5 contains an argument injection vulnerability in the Tools Iperf Client functionality. The webtoolscmd function constructs an iperf command using the server and options parameters without sanitization, permitting injection of arbitrary iperf flags. An...

CVE-2026-74237

GFI Exinda AI versions before 7.6.5 contain an argument injection vulnerability in the Tools Iperf Client functionality. The web_tools_cmd() function constructs an iperf command from user-supplied server and options parameters without sanitization, allowing injection of arbitrary iperf flags. An ...

CVE-2026-85599

Grav Shortcode Core before 6.2.5 contains stored cross-site scripting vulnerabilities in the lorem tag parameter and details summary parameter that are written to rendered pages without escaping. Attackers with page-edit access can inject arbitrary HTML and JavaScript that executes in the browser...

CVE-2026-85600

Grav Admin getgrav/grav-plugin-admin2 versions , ", or ', allowing an attacker to register a username containing an HTML payload. When an administrator views a UI surface that renders the username through tHtml—such as the two-factor force-disable confirmation prompt or the 'page is locked' edito...

CVE-2026-85593

phpMyFAQ versions before 4.1.8 contain a stored cross-site scripting vulnerability in FaqHelper::convertOldInternalLinks that calls htmlentitydecode on sanitized FAQ content, reversing entity-encoding protection. Authenticated users with FAQ editing privileges can inject JavaScript payloads that...

CVE-2026-18198

CVE-2026-18198 is a Blind SQL Injection vulnerability in GOLDENHORN ONEIT , a product by TAC Information Services Internal and External Trade Inc. The flaw stems from improper neutralization of special elements in an SQL command, affecting versions prior to Göbeklitepe . The CVSS 3.1 score is 8.8...

EUVD-2026-71082

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in TAC Information Services Internal and External Trade Inc. GOLDENHORN ONEIT allows Blind SQL Injection. This issue affects GOLDENHORN ONEIT: before Göbeklitepe...

CVE-2026-18198 SQL Injection in TAC Information's GoldenHorn

Improper neutralization of special elements used in an SQL command 'SQL injection' vulnerability in TAC Information Services Internal and External Trade Inc. GOLDENHORN ONEIT allows Blind SQL Injection. This issue affects GOLDENHORN ONEIT: before Göbeklitepe...

CVE-2026-85600 Grav Admin before 2.0.21 Stored XSS via username

Grav Admin getgrav/grav-plugin-admin2 versions , ", or ', allowing an attacker to register a username containing an HTML payload. When an administrator views a UI surface that renders the username through tHtml—such as the two-factor force-disable confirmation prompt or the 'page is locked' edito...

CVE-2026-85600

Grav Admin (getgrav/grav-plugin-admin2) versions ≤ 2.0.19 contain a stored XSS vulnerability in the tHtml() function (src/lib/stores/i18n.svelte.ts). The function substitutes untrusted parameters—such as usernames—into translation templates before parsing the result as markdown. Grav's server-sid...