CVE-2026-2141 WuKongOpenSource WukongCRM URL PermissionServiceImpl.java improper authorization

A security flaw has been discovered in WuKongOpenSource WukongCRM up to 11.3.3. This affects an unknown part of the file gateway/src/main/java/com/kakarote/gateway/service/impl/PermissionServiceImpl.java of the component URL Handler. Performing a manipulation results in improper authorization...

CVE-2026-2141 WuKongOpenSource WukongCRM URL PermissionServiceImpl.java improper authorization

A security flaw has been discovered in WuKongOpenSource WukongCRM up to 11.3.3. This affects an unknown part of the file gateway/src/main/java/com/kakarote/gateway/service/impl/PermissionServiceImpl.java of the component URL Handler. Performing a manipulation results in improper authorization...

CVE-2026-2139

A vulnerability was determined in Tenda TX9 up to 22.03.02.10multi. Affected by this vulnerability is the function sub432580 of the file /goform/fastsettingwifiset. This manipulation of the argument ssid causes buffer overflow. The attack may be initiated remotely. The exploit has been publicly...

CVE-2026-2136

A flaw has been found in projectworlds Online Food Ordering System 1.0. This affects an unknown function of the file /view-ticket.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be use...

CVE-2026-2138 Tenda TX9 SetStaticRouteCfg sub_42D03C buffer overflow

A vulnerability was found in Tenda TX9 up to 22.03.02.10multi. Affected is the function sub42D03C of the file /goform/SetStaticRouteCfg. The manipulation of the argument list results in buffer overflow. The attack can be launched remotely. The exploit has been made public and could be used...

EUVD-2026-5811

A vulnerability has been found in Tenda TX3 up to 16.03.13.11multi. This impacts an unknown function of the file /goform/SetIpMacBind. The manipulation of the argument list leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used...

CVE-2026-2133

A weakness has been identified in code-projects Online Music Site 1.0. Impacted is an unknown function of the file /Administrator/PHP/AdminUpdateCategory.php. This manipulation of the argument txtimage causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has...

CVE-2026-2131

A vulnerability was identified in XixianLiang HarmonyOS-mcp-server 0.1.0. This vulnerability affects the function inputtext. The manipulation of the argument text leads to os command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used...

CVE-2026-2132 code-projects Online Music Site AdminUpdateCategory.php sql injection

A security flaw has been discovered in code-projects Online Music Site 1.0. This issue affects some unknown processing of the file /Administrator/PHP/AdminUpdateCategory.php. The manipulation of the argument txtcat results in sql injection. The attack can be executed remotely. The exploit has bee...

CVE-2026-2131 XixianLiang HarmonyOS-mcp-server input_text os command injection

A vulnerability was identified in XixianLiang HarmonyOS-mcp-server 0.1.0. This vulnerability affects the function inputtext. The manipulation of the argument text leads to os command injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used...

CVE-2026-2131

CVE-2026-2131 affects XixianLiang HarmonyOS-mcp-server 0.1.0, specifically the input_text function. The vulnerability allows remote OS command injection due to manipulation of the text argument. Exploitation is described as remote with a publicly available exploit. Documented impact includes pote...

CVE-2026-2129

The CVE-2026-2129 affects D-Link DIR-823X (firmware 250416). The vulnerability resides in /goform/set_ac_status where manipulating ac_ipaddr, ac_ipstatus, or ap_randtime can trigger an OS command injection. The issue can be exploited remotely, and public exploit code exists. Multiple sources corr...

CVE-2026-2120 D-Link DIR-823X Configuration Parameter set_server_settings os command injection

A vulnerability was identified in D-Link DIR-823X 250416. This affects an unknown function of the file /goform/setserversettings of the component Configuration Parameter Handler. The manipulation of the argument terminaladdr/serverip/serverport leads to os command injection. The attack may be...

PT-2026-7026

Name of the Vulnerable Software and Affected Versions D-Link DI-7100G C1 version 24.04.18D1 Description A flaw exists in the set jhttpd info function that allows for command injection. Manipulating the usb username argument can lead to remote exploitation. Recommendations Apply updates to address...

PT-2026-7008

Name of the Vulnerable Software and Affected Versions code-projects Contact Management System version 1.0 Description A security issue exists in code-projects Contact Management System. The problem involves the processing of the index.py file and manipulation of the selecteditem0 argument, leadin...

PT-2026-7007

Name of the Vulnerable Software and Affected Versions D-Link DIR-823X version 250416 Description A weakness exists in D-Link DIR-823X version 250416 related to command injection. The issue affects the sub 420618 function within the /goform/set upnp file. Manipulation of the upnp enable argument c...

PT-2026-6981

Name of the Vulnerable Software and Affected Versions mwielgoszewski doorman versions prior to 0.7 Description A flaw exists in the is safe url function within the doorman/users/views.py file. Manipulation of the Next argument can result in an open redirect. This issue can be exploited remotely...

PT-2026-7015

Name of the Vulnerable Software and Affected Versions Great Developers Certificate Generation System affected versions not specified Description A security issue exists in Great Developers Certificate Generation System. The issue involves unrestricted upload due to manipulation of the file...

PT-2026-6986

Name of the Vulnerable Software and Affected Versions Tenda AC8 version 16.03.33.05 Description A buffer overflow issue exists in the Embedded Httpd Service component of Tenda AC8. The flaw is located in the file '/goform/fast setting wifi set' and is triggered by manipulating the timeZone...

PT-2026-6955

Name of the Vulnerable Software and Affected Versions XixianLiang HarmonyOS-mcp-server version 0.1.0 Description A flaw exists in the input text function of XixianLiang HarmonyOS-mcp-server. Manipulation of the text argument can result in operating system command injection. Remote exploitation is...