CVE-2026-86675

A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/usedit.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used...

CVE-2026-86675 itsourcecode Sales and Inventory System us_edit.php sql injection

A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/usedit.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used...

CVE-2026-86675 itsourcecode Sales and Inventory System us_edit.php sql injection

A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/usedit.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used...

CVE-2026-86675

itsourcecode Sales and Inventory System 1.0 contains a SQL injection vulnerability in the file /pages/us_edit.php, triggered through manipulation of the ID argument. The attack can be launched remotely and requires low-level privileges (authenticated access). The CVSS 3.1 base score is 6.3 (MEDIU...

EUVD-2026-74042

A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/usedit.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used...

CVE-2026-79569

MovieRecommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...

CVE-2026-79570

mfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability in the tableName parameter at /sys/dbConnect/data. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...

CVE-2026-86667 aircheng-org iWebShop-5 member.php member_list sql injection

A weakness has been identified in aircheng-org iWebShop-5 up to 5.15. The affected element is the function memberlist of the file controllers/member.php. This manipulation of the argument Search causes sql injection. The attack is possible to be carried out remotely. The exploit has been made...

CVE-2026-86667

A SQL injection vulnerability exists in aircheng-org iWebShop-5 (up to version 5.15), specifically in the member_list function within controllers/member.php. The flaw is triggered by manipulation of the Search argument , allowing a remote, authenticated attacker to execute arbitrary SQL queries. ...

CVE-2026-86667 aircheng-org iWebShop-5 member.php member_list sql injection

A weakness has been identified in aircheng-org iWebShop-5 up to 5.15. The affected element is the function memberlist of the file controllers/member.php. This manipulation of the argument Search causes sql injection. The attack is possible to be carried out remotely. The exploit has been made...

CVE-2026-86732

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteriawithTransforms0class that...

CVE-2026-79573

L-ONE v1.0.0 was discovered to contain multiple SQL injection vulnerabilities in the /attachment/getBusinessUploadList component via the busid, id, and taskid parameters. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...

CVE-2026-78837

A SQL injection vulnerability in the apformid parameter in AppNitro MachForm v30 allows attackers to access sensitive database information via a crafted SQL statement...

EUVD-2026-72868

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteriawithTransforms0class that...

CVE-2026-86732 Craft CMS before 5.10.12 Remote Code Execution via element-index

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteriawithTransforms0class that...

CVE-2026-86732 Craft CMS before 5.10.12 Remote Code Execution via element-index

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteriawithTransforms0class that...

CVE-2026-86732 Craft CMS before 5.10.12 Remote Code Execution via element-index

Craft CMS versions before 5.10.12 contain a remote code execution vulnerability in the element-index endpoint that allows authenticated content editors to instantiate arbitrary classes through the criteria parameter. Attackers can inject a malicious class via criteriawithTransforms0class that...

EUVD-2026-72808

Netis NX10 firmware V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler that allows authenticated administrators to execute arbitrary shell commands as root by injecting into the IpAddr parameter. The parameter is interpolated directly into a...

CVE-2026-61517

Netis NX10 firmware versions V4.0.1.5808 and V3.0.0.4142 contain an OS command injection vulnerability in the ping diagnostic handler . An authenticated administrator can inject into the IpAddr parameter, which is interpolated directly into a shell command executed via system() . Input validation...

CVE-2026-78838

A reflected cross-site scripting XSS vulnerability in the griddatasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary Javascript in the context of the victim's browser via injecting a crafted payload into the filterfilters0field parameter...