Astra Linux – Vulnerability in binutils

A vulnerability was discovered in GNU Binutils 2.43 and is classified as problematic. The affected component is the function linkorderscan in the file ld/ldelfgen.c. Manipulation of this function leads to a memory leak. The attack can be launched remotely. The complexity of such an attack is quit...

EUVD-2026-1918

Enhancesoft osTicket versions up to and including 1.18.2 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficiently sanitized before bein...

CVE-2026-0851

A vulnerability was identified in code-projects Online Music Site 1.0. The affected element is an unknown function of the file /Administrator/PHP/AdminAddUser.php. The manipulation of the argument txtusername leads to sql injection. Remote exploitation of the attack is possible. The exploit is...

CVE-2026-0851

A vulnerability was identified in code-projects Online Music Site 1.0. The affected element is an unknown function of the file /Administrator/PHP/AdminAddUser.php. The manipulation of the argument txtusername leads to sql injection. Remote exploitation of the attack is possible. The exploit is...

CVE-2026-0852 code-projects Online Music Site AdminUpdateUser.php sql injection

A security flaw has been discovered in code-projects Online Music Site 1.0. The impacted element is an unknown function of the file /Administrator/PHP/AdminUpdateUser.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been...

The vulnerability of the “Create User” function of the Nagios Log Server monitoring and analysis software allows a perpetrator to perform cross-site scripting attacks.

The vulnerability of the “Create User” function in the Nagios Log Server monitoring and analysis software exists due to insufficient validation or filtering of data entered by users. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

The vulnerability of the MICROSENS NMP Web+ network management platform lies in the use of pre-installed security-related data, which allows attackers to circumvent existing security restrictions.

The vulnerability of the MICROSENS NMP Web+ network management platform lies in the use of pre-installed data related to security. Exploiting this vulnerability could allow a malicious actor to bypass existing security restrictions remotely...

The vulnerability of the LenelS2 NetBox access control and event monitoring system, due to the lack of measures taken to protect the website structure, allows attackers to perform cross-site scripting attacks (XSS).

The vulnerability of the LenelS2 NetBox access control and event monitoring system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to perform cross-site scripting attacks XSS remotely...

The vulnerability of the Logstash data collection system allows a malicious user to execute arbitrary code with root privileges and gain full control over the application. This vulnerability in Nagios Log Server enables a hacker to perform unauthorized actions.

The vulnerability of the Logstash data collection system, a software monitoring and logging analysis tool for Nagios Log Servers, is related to errors in privilege management. Exploiting this vulnerability allows an attacker, operating remotely, to execute arbitrary code with root privileges and...

The vulnerability of the Snapshots module of the Nagios Log Server monitoring and analysis software allows a hacker to perform cross-site scripting attacks.

The vulnerability of the Snapshots module of the Nagios Log Server monitoring and analysis software exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

The vulnerability of the microprogrammed software of the DVP-12SE11T controllers, related to bypassing authentication using an alternative path or channel, allows a perpetrator to circumvent security restrictions.

The vulnerability of the DVP-12SE11T controller’s microprogramming software relates to the ability to bypass authentication using an alternative path or channel. Exploiting this vulnerability allows a malicious actor to circumvent security restrictions from a remote location...

PT-2026-2045

Name of the Vulnerable Software and Affected Versions Merit LILIN IP Camera models affected versions not specified Description Certain IP Camera models developed by Merit LILIN are susceptible to an OS Command Injection issue. Authenticated remote attackers can exploit this to inject and execute...

CVE-2026-0851: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in code-projects Online Music Site 1.0. The affected element is an unknown function of the file /Administrator/PHP/AdminAddUser.php. The manipulation of the argument txtusername leads to sql injection. Remote exploitation of the attack is possible. The exploit is...

CVE-2026-0851

Code-projects Online Music Site 1.0 contains an SQL injection in /Administrator/PHP/AdminAddUser.php via the txtusername parameter. The vulnerability allows remote exploitation and is supported by a publicly available exploit. The issue is tied to an unknown function in AdminAddUser.php and is co...

CVE-2026-0851 code-projects Online Music Site AdminAddUser.php sql injection

A vulnerability was identified in code-projects Online Music Site 1.0. The affected element is an unknown function of the file /Administrator/PHP/AdminAddUser.php. The manipulation of the argument txtusername leads to sql injection. Remote exploitation of the attack is possible. The exploit is...

CVE-2026-0851 code-projects Online Music Site AdminAddUser.php sql injection

A vulnerability was identified in code-projects Online Music Site 1.0. The affected element is an unknown function of the file /Administrator/PHP/AdminAddUser.php. The manipulation of the argument txtusername leads to sql injection. Remote exploitation of the attack is possible. The exploit is...

CVE-2026-0836 UTT 进取 520W formConfigFastDirectionW strcpy buffer overflow

A vulnerability was determined in UTT 进取 520W 1.7.7-180627. The impacted element is the function strcpy of the file /goform/formConfigFastDirectionW. This manipulation of the argument ssid causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclos...

CVE-2026-0836 UTT 进取 520W formConfigFastDirectionW strcpy buffer overflow

A vulnerability was determined in UTT 进取 520W 1.7.7-180627. The impacted element is the function strcpy of the file /goform/formConfigFastDirectionW. This manipulation of the argument ssid causes buffer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclos...

CVE-2025-15505 Luxul XWR-600 Web Administration cross site scripting

A vulnerability was found in Luxul XWR-600 up to 4.0.1. The affected element is an unknown function of the component Web Administration Interface. The manipulation of the argument Guest Network/Wireless Profile SSID results in cross site scripting. The attack may be launched remotely. The exploit...

CVE-2025-15505 Luxul XWR-600 Web Administration cross site scripting

A vulnerability was found in Luxul XWR-600 up to 4.0.1. The affected element is an unknown function of the component Web Administration Interface. The manipulation of the argument Guest Network/Wireless Profile SSID results in cross site scripting. The attack may be launched remotely. The exploit...