CVE-2026-51748: Improper Access Control

Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to update stored slave inventory records via sending a crafted MQTT message to the csbroker component...

CVE-2026-51748

Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to update stored slave inventory records via sending a crafted MQTT message to the csbroker component...

CVE-2026-51748

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is vulnerable to an incorrect access control flaw in the sendStaticInfoToMaster function. This vulnerability allows unauthenticated attackers to update stored slave inventory records by sending a crafted MQTT message to the cs_broker ...

PT-2026-84167

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description An unauthenticated client can query the Security Domain hosts inventory through the 'GET /ca/rest/securityDomain/hosts' endpoint. This allows the retrieval of a...

CVE-2026-51754

Incorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to overwrite the slave IP inventory state via sending a crafted MQTT message to the csbroker component...

CVE-2026-51754

The TOTOLINK T6 running firmware version 4.1.5cu.748_B20211015 is affected by an incorrect access control vulnerability in the updateSlaveIpList function. This flaw allows unauthenticated attackers to overwrite the slave IP inventory state by sending a crafted MQTT message to the cs_broker compon...

EUVD-2026-69206

Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to update stored slave inventory records via sending a crafted MQTT message to the csbroker component...

PT-2026-84220

Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6 4.1.5cu.748 B20211015 allows unauthenticated attackers to update stored slave inventory records via sending a crafted MQTT message to the cs broker component...

CVE-2026-51748

Incorrect access control in the sendStaticInfoToMaster function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to update stored slave inventory records via sending a crafted MQTT message to the csbroker component...

EUVD-2026-69202

Incorrect access control in the updateSlaveIpList function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to overwrite the slave IP inventory state via sending a crafted MQTT message to the csbroker component...

CVE-2026-82696

A weakness has been identified in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/invsearchfrm.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to t...

CVE-2026-82696 itsourcecode Sales and Inventory System inv_searchfrm.php sql injection

A weakness has been identified in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/invsearchfrm.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to t...

CVE-2026-82696

itsourcecode Sales and Inventory System 1.0 is affected by a SQL injection vulnerability in the file /pages/inv_searchfrm.php. The vulnerability is triggered by manipulating the ID argument and can be exploited remotely with low privileges (no user interaction required). The exploit is described ...

CVE-2026-82696 itsourcecode Sales and Inventory System inv_searchfrm.php sql injection

A weakness has been identified in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/invsearchfrm.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to t...

EUVD-2026-68510

A weakness has been identified in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/invsearchfrm.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to t...

CVE-2026-82625

A vulnerability has been found in code-projects Simple Inventory System 1.0. This affects an unknown part of the file /register.php of the component User Registration. Such manipulation of the argument lastname leads to cross site scripting. The attack may be launched remotely. The exploit has be...

CVE-2026-82624

A flaw has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file inventorymanagement.sql of the component Database Backup File Handler. This manipulation causes information disclosure. The attack may be initiated remotely. The...

CVE-2026-82625 code-projects Simple Inventory System User Registration register.php cross site scripting

A vulnerability has been found in code-projects Simple Inventory System 1.0. This affects an unknown part of the file /register.php of the component User Registration. Such manipulation of the argument lastname leads to cross site scripting. The attack may be launched remotely. The exploit has be...

CVE-2026-82625

code-projects Simple Inventory System 1.0 contains a stored cross-site scripting (XSS) vulnerability in the /register.php file, specifically in the User Registration component. An attacker can manipulate the last_name argument to inject malicious scripts, with the attack launchable remotely and r...

CVE-2026-82625 code-projects Simple Inventory System User Registration register.php cross site scripting

A vulnerability has been found in code-projects Simple Inventory System 1.0. This affects an unknown part of the file /register.php of the component User Registration. Such manipulation of the argument lastname leads to cross site scripting. The attack may be launched remotely. The exploit has be...