CVE-2026-105291

A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function GroupController::index of the file App/Feelcrm/Index/Controller/GroupController.class.php of the component Department Search Endpoint. The manipulation of the argument keyword leads to cross...

CVE-2026-105290

A vulnerability was determined in feelec-yishu feelcrm-os 1.0.0. This affects an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php of the component getCurlData Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. It is...

CVE-2026-105291 feelec-yishu feelcrm-os Department Search Endpoint GroupController.class.php index cross site scripting

A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function GroupController::index of the file App/Feelcrm/Index/Controller/GroupController.class.php of the component Department Search Endpoint. The manipulation of the argument keyword leads to cross...

CVE-2026-105291

The software feelec-yishu feelcrm-os 1.0.0 contains a cross-site scripting (XSS) vulnerability in the Department Search Endpoint component. The root cause is located in the GroupController::index function within the file App/Feelcrm/Index/Controller/GroupController.class.php, where the manipulati...

CVE-2026-105290

The software feelec-yishu feelcrm-os version 1.0.0 is vulnerable to a server-side request forgery (SSRF) . The flaw exists within the getCurlData endpoint, specifically involving an unknown part of the file App/Feelcrm/Index/Controller/GoogleController.class.php. An attacker can remotely launch t...

CVE-2026-105287

A flaw has been found in feelec-yishu feelcrm-os 1.0.0. Affected is an unknown function of the file App/Feelcrm/Crm/Controller/AjaxRequestController.class.php of the component getMemberByGroups Endpoint. This manipulation of the argument groups causes sql injection. The attack is possible to be...

CVE-2026-105286

A vulnerability was detected in Totolink A3002MU 1.0.0-B20230403.1455. This impacts the function sub44B250 of the file /boafrm/formUploadFile of the component File Upload Handler. The manipulation of the argument filename results in path traversal. The attack can be executed remotely. The exploit...

CVE-2026-105289 feelec-yishu feelcrm-os Create Customer Endpoint CrmDefineFormModel.class.php htmlspecialchars_decode cross site scripting

A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialcharsdecode of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the component Create Customer Endpoint. Performing a manipulation of the argument customerformremark resul...

CVE-2026-105289 feelec-yishu feelcrm-os Create Customer Endpoint CrmDefineFormModel.class.php htmlspecialchars_decode cross site scripting

A vulnerability was found in feelec-yishu feelcrm-os 1.0.0. Affected by this issue is the function htmlspecialcharsdecode of the file App/Feelcrm/Common/Model/CrmDefineFormModel.class.php of the component Create Customer Endpoint. Performing a manipulation of the argument customerformremark resul...

CVE-2026-105287 feelec-yishu feelcrm-os getMemberByGroups Endpoint AjaxRequestController.class.php sql injection

A flaw has been found in feelec-yishu feelcrm-os 1.0.0. Affected is an unknown function of the file App/Feelcrm/Crm/Controller/AjaxRequestController.class.php of the component getMemberByGroups Endpoint. This manipulation of the argument groups causes sql injection. The attack is possible to be...

CVE-2026-105287

A SQL injection vulnerability exists in feelec-yishu feelcrm-os 1.0.0 within the getMemberByGroups endpoint. The flaw is caused by the manipulation of the groups[] argument in an unknown function of the file App/Feelcrm/Crm/Controller/AjaxRequestController.class.php . This vulnerability can be ex...

CVE-2026-105287 feelec-yishu feelcrm-os getMemberByGroups Endpoint AjaxRequestController.class.php sql injection

A flaw has been found in feelec-yishu feelcrm-os 1.0.0. Affected is an unknown function of the file App/Feelcrm/Crm/Controller/AjaxRequestController.class.php of the component getMemberByGroups Endpoint. This manipulation of the argument groups causes sql injection. The attack is possible to be...

CVE-2026-105286 Totolink A3002MU File Upload formUploadFile sub_44B250 path traversal

A vulnerability was detected in Totolink A3002MU 1.0.0-B20230403.1455. This impacts the function sub44B250 of the file /boafrm/formUploadFile of the component File Upload Handler. The manipulation of the argument filename results in path traversal. The attack can be executed remotely. The exploit...

CVE-2026-105263

A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/MetadataController.php of the component Admin Metadata Endpoint. Performing a manipulation of the argument url results in server-side...

CVE-2026-105251

A vulnerability was detected in vgmstream up to r2117. Affected by this vulnerability is the function psfindpadding of the file src/coding/psxdecoder.c of the component VAG File Handler. Performing a manipulation results in out-of-bounds read. The attack is possible to be carried out remotely. Th...

CVE-2026-105253

A vulnerability was determined in itsourcecode Online Admission System Project 1.0. This issue affects some unknown processing of the file /admin/login1.php. This manipulation of the argument User causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed...

EUVD-2026-92331

A weakness has been identified in Totolink A3002MU 1.0.0-B20230403.1455. The impacted element is the function sub40FCFC of the file /bin/boa of the component Authentication Check. Executing a manipulation can lead to improper authorization. The attack may be launched remotely. The exploit has bee...

EUVD-2026-92316

A security flaw has been discovered in Shaarli up to 0.16.3. The affected element is the function MetadataController of the file application/front/controller/admin/MetadataController.php of the component Admin Metadata Endpoint. Performing a manipulation of the argument url results in server-side...

EUVD-2026-92297

A vulnerability was identified in itsourcecode Online Admission System 1.0. Impacted is an unknown function of the file /admin/schoolyear.php. Such manipulation of the argument sy leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used...

CVE-2026-105254 itsourcecode Online Admission System schoolyear.php sql injection

A vulnerability was identified in itsourcecode Online Admission System 1.0. Impacted is an unknown function of the file /admin/schoolyear.php. Such manipulation of the argument sy leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used...