CVE-2026-86264

sfturing ssm_pro (a Java-based hospital ordering system) contains a cross-site scripting (XSS) vulnerability in the Order Endpoint (OrderController.java). An attacker can manipulate the hospitalName, officesName, or doctorName arguments to inject script, which executes in a victim's browser upon ...

EUVD-2026-72240

A vulnerability was detected in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. This impacts the function orderRecordsService.cancelOrder of the file ssmpro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Cancellation. The manipulation of the argument ...

CVE-2026-86244

A security vulnerability has been detected in FastAdmin up to 1.2.0.20210401beta. Affected is the function register/login of the file application/index/controller/User.php of the component User Controller. Such manipulation of the argument url leads to cross site scripting. The attack may be...

CVE-2026-86241

A weakness has been identified in liufee FeehiCMS up to 2.1.1. This impacts an unknown function of the file environments/prod/backend/config/main-local.php of the component Cookie Validation. This manipulation of the argument cookieValidationKey causes use of hard-coded cryptographic key . The...

CVE-2026-86239

A vulnerability was identified in liufee FeehiCMS up to 2.1.1. The impacted element is the function UeditorAction::init of the file backend/widgets/ueditor/UeditorAction.php of the component UEditor Widget. The manipulation leads to unrestricted upload. Remote exploitation of the attack is...

EUVD-2026-72237

A weakness has been identified in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. The impacted element is an unknown function of the file ssmpro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Controller. Executing a manipulation of the argument...

CVE-2026-86261 sfturing hosp_order Order Controller OrderController.java authorization

A weakness has been identified in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. The impacted element is an unknown function of the file ssmpro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Controller. Executing a manipulation of the argument...

CVE-2026-86261 sfturing hosp_order Order Controller OrderController.java authorization

A weakness has been identified in sfturing hosporder up to 627f426331da8086ce8fff2017d65b1ddef384f8. The impacted element is an unknown function of the file ssmpro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Controller. Executing a manipulation of the argument...

CVE-2026-86260

CVE-2026-86260 affects the Password Recovery component of sfturing hosp_order (a Java/SSM-based hospital order management system). The flaw resides in the modifyPassWord function within ssm_pro/src/main/java/cn/sfturing/web/CommonUserController.java, where a password can be changed without proper...

CVE-2026-20511

A memory corruption vulnerability exists in SurfaceFlinger caused by a use after free condition. This flaw could allow a malicious actor who has already obtained System privilege to achieve a local escalation of privilege . Exploitation does not require user interaction. Remediation is available ...

EUVD-2026-72192

A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/suptransac.php. Performing a manipulation of the argument companyname results in sql injection. It is possible to initiate the attack remotely...

CVE-2026-86237

A vulnerability was found in openagents-org openagents up to 0.8.19/0.9.3.post20. Impacted is the function testdefaultmodel of the file sdk/src/openagents/sdk/transports/http.py. Performing a manipulation of the argument baseurl results in server-side request forgery. The attack may be initiated...

CVE-2026-86241

liufee FeehiCMS (up to 2.1.1 ) is affected by a hard-coded cryptographic key vulnerability in the Cookie Validation component, specifically in the file environments/prod/backend/config/main-local.php. Manipulation of the cookieValidationKey argument leads to use of a fixed key, allowing remote at...

CVE-2026-86241 liufee FeehiCMS Cookie Validation main-local.php hard-coded key

A weakness has been identified in liufee FeehiCMS up to 2.1.1. This impacts an unknown function of the file environments/prod/backend/config/main-local.php of the component Cookie Validation. This manipulation of the argument cookieValidationKey causes use of hard-coded cryptographic key . The...

CVE-2026-86240

liufee FeehiCMS up to version 2.1.1 contains a server-side request forgery (SSRF) vulnerability in the catchImage function of the file backend/widgets/ueditor/Uploader.php (UEditor component). Manipulation of the source[] argument enables remote attackers to forge server-side requests. A proof-of...

CVE-2026-86240 liufee FeehiCMS UEditor Uploader.php catchImage server-side request forgery

A security flaw has been discovered in liufee FeehiCMS up to 2.1.1. This affects the function catchImage of the file backend/widgets/ueditor/Uploader.php of the component UEditor. The manipulation of the argument source results in server-side request forgery. The attack can be executed remotely...

CVE-2026-86239 liufee FeehiCMS UEditor Widget UeditorAction.php init unrestricted upload

A vulnerability was identified in liufee FeehiCMS up to 2.1.1. The impacted element is the function UeditorAction::init of the file backend/widgets/ueditor/UeditorAction.php of the component UEditor Widget. The manipulation leads to unrestricted upload. Remote exploitation of the attack is...

CVE-2026-86239 liufee FeehiCMS UEditor Widget UeditorAction.php init unrestricted upload

A vulnerability was identified in liufee FeehiCMS up to 2.1.1. The impacted element is the function UeditorAction::init of the file backend/widgets/ueditor/UeditorAction.php of the component UEditor Widget. The manipulation leads to unrestricted upload. Remote exploitation of the attack is...

EUVD-2026-72180

A weakness has been identified in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/supdel.php?type=supplier. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. Th...

EUVD-2026-72182

A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/custtransac.php?action=add. The manipulation of the argument firstname results in sql injection. It is possible to launch the attack remotely. The exploit is now public and...