EUVD-2026-117486

Path traversal and missing authorization check in the imageCrop and imageRotate services in Apache OFBiz through 24.09.07 on all platforms allows a remote authenticated attacker with only Catalog view permission to read arbitrary image-parseable files readable by the OFBiz process, disclosed via...

CVE-2026-76152

Apache OFBiz versions through 24.09.07 on all platforms are vulnerable to path traversal and missing authorization checks within the imageCrop and imageRotate services. A remote authenticated attacker with only Catalog view permission can exploit this by providing crafted productId and imageName ...

CVE-2026-110109

JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/productId. Because the endpoint lacks @SaveAction, attackers can save arbitrary codec...

CVE-2026-110109 JetLinks Community through 2.10.0 Missing Authorization via Product-Level Transparent Codec Save

JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/productId. Because the endpoint lacks @SaveAction, attackers can save arbitrary codec...

CVE-2026-110109 JetLinks Community through 2.10.0 Missing Authorization via Product-Level Transparent Codec Save

JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/productId. Because the endpoint lacks @SaveAction, attackers can save arbitrary codec...

CVE-2026-110109

JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/productId. Because the endpoint lacks @SaveAction, attackers can save arbitrary codec...

EUVD-2026-98942

JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/productId. Because the endpoint lacks @SaveAction, attackers can save arbitrary codec...

CVE-2026-110109

Versions of JetLinks Community through 2.10.0 are susceptible to a missing authorization vulnerability (CWE-862) in the transparent-codec component. An attacker with only query access can exploit the POST /device/transparent-codec/{productId} endpoint, which lacks the required @SaveAction permiss...

CVE-2026-110109 JetLinks Community through 2.10.0 Missing Authorization via Product-Level Transparent Codec Save

JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/productId. Because the endpoint lacks @SaveAction, attackers can save arbitrary codec...

CVE-2026-110109: Missing Authorization

JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/productId. Because the endpoint lacks @SaveAction, attackers can save arbitrary codec...

PT-2026-111703

JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/productId. Because the endpoint lacks @SaveAction, attackers can save arbitrary codec...

JetLinks IoT Platform: Authorization Issues Vulnerability

The JetLinks IoT Platform versions 2.10.0 and earlier have an authorization issue vulnerability. This vulnerability stems from the lack of @SaveAction authorization verification in the POST /device/transparent-codec/productId interface. Only users with the permission to query transparent-codecs c...

CVE-2026-75340

The device metadata import interface /device/instance/productId/property-metadata/import of jetlinks community 2.11 is vulnerable to Server-side request forgery SSRF...

EUVD-2008-5612

Malware in sbrugna...

EUVD-2006-4869

Malware in sbrugna...

EUVD-2022-46320

Malicious code in bioql PyPI...

Inventory Management System removeProduct.php File SQL Injection Vulnerability

Inventory Management System is an inventory management system. The Inventory Management System suffers from a SQL injection vulnerability that originates from the /phpaction/removeProduct.php file not securely filtering the productId parameter. An attacker can exploit this vulnerability to remote...

CVE-2025-6822: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in code-projects Inventory Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /phpaction/removeProduct.php. The manipulation of the argument productId leads to sql injection. The attack can be initiated remotely...

CVE-2022-43276

Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the productId parameter at /phpaction/fetchSelectedfood.php...

CVE-2024-3211: Improper Neutralization of Special Elements used in an SQL Command

The Shopping Cart & eCommerce Store plugin for WordPress is vulnerable to SQL Injection via the 'productid' attribute of the ecaddtocart shortcode in all versions up to, and including, 5.6.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...