CVE-2026-86235

A flaw has been found in itsourcecode Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /pages/postransac.php?action=add. This manipulation of the argument Customer causes sql injection. The attack can be initiated remotely. The exploit has been published and may...

CVE-2026-86234

A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/custtransac.php?action=add. The manipulation of the argument firstname results in sql injection. It is possible to launch the attack remotely. The exploit is now public and...

CVE-2026-86237

A server-side request forgery (SSRF) vulnerability affects the openagents-org/openagents Python SDK in versions up to 0.8.19 / 0.9.3.post20 . The vulnerable function is test_default_model in sdk/src/openagents/sdk/transports/http.py, where an unvalidated base_url argument allows a remote, unauthe...

PT-2026-86633

A flaw has been found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This issue affects some unknown processing of the file db.php. Executing a manipulation can lead to hard-coded credentials. The attack can be executed remotely. The exploit has been published an...

PT-2026-86614

Name of the Vulnerable Software and Affected Versions itsourcecode Sales and Inventory System version 1.0 Description A SQL injection flaw exists in the /pages/sup transac.php endpoint. This issue occurs when the companyname argument is manipulated, allowing a remote attacker to execute arbitrary...

PT-2026-86616

Name of the Vulnerable Software and Affected Versions sfturing hosp order versions prior to 627f426331da8086ce8fff2017d65b1ddef384f8 Description A remote authorization bypass exists within the Order Controller component. The issue occurs in an unknown function located in the file ssm...

PT-2026-86601

In Audio HAL, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS11191981; Issue ID: MSV-9126...

PT-2026-86591

Name of the Vulnerable Software and Affected Versions liufee FeehiCMS versions prior to 2.1.2 Description An issue in the UEditor Widget component allows for unrestricted file upload. The flaw exists within the UeditorAction::init function located in the backend/widgets/ueditor/UeditorAction.php...

PT-2026-86593

Name of the Vulnerable Software and Affected Versions liufee FeehiCMS versions prior to 2.1.2 Description An issue exists in the Cookie Validation component within the file environments/prod/backend/config/main-local.php. The manipulation of the cookieValidationKey argument leads to the use of a...

PT-2026-86624

Name of the Vulnerable Software and Affected Versions itsourcecode School Management System version 1.0 Description A remote SQL injection is possible due to improper handling of the email argument within a function in the User Login.php file. SQL injection is a technique where malicious SQL...

PT-2026-86619

Name of the Vulnerable Software and Affected Versions sfturing hosp order versions prior to 627f426331da8086ce8fff2017d65b1ddef384f8 Description An authorization bypass exists in the Order Cancellation component. A remote attacker can manipulate the ID argument within the...

PT-2026-86621

Name of the Vulnerable Software and Affected Versions sfturing ssm pro versions prior to 627f426331da8086ce8fff2017d65b1ddef384f8 Description A cross site scripting issue exists in the Order Endpoint component within the file ssm pro/src/main/java/cn/sfturing/web/OrderController.java. A remote...

VulnCheck KEV: CVE-2025-14208

A security flaw has been discovered in D-Link DIR-823X up to 20250416. This affects the function sub415028 of the file /goform/setwansettings. The manipulation of the argument pppusername results in command injection. It is possible to launch the attack remotely. The exploit has been released to...

PT-2026-86630

A weakness has been identified in projeto-siga siga up to 11.1.1. Affected by this issue is the function DownloadExterno.getUrl of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExUtilController.java of the component HTML-to-PDF Endpoint. This manipulation of the argument html causes...

PT-2026-86647

A security flaw has been discovered in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This impacts an unknown function. Performing a manipulation results in cross-site request forgery. The attack can be initiated remotely. The exploit has been released to the public...

PT-2026-86646

A vulnerability was identified in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This affects an unknown function of the file cict portal.sql. Such manipulation leads to cleartext storage of sensitive information. It is possible to launch the attack remotely. The...

PT-2026-86648

A weakness has been identified in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. Affected is an unknown function of the file travel/src/main/java/com/controller/CommonController.java of the component CommonDao. Executing a manipulation of the argument...

PT-2026-86635

A vulnerability was identified in Advantech WISE-6610-NB, WISE-6610-EB, WISE-6610-TB, WISE-6610-JB, WISE-6610-CB, WISE-6610-EL-NB, WISE-6610-EL-EB, WISE-6610-EL-TB, WISE-6610-EL-JB, WISE-6610-EL-CB, WISE-6610P-DEA, WISE-6610P-DNA and WISE-6610P-DTA 1.2.1 20251110. This vulnerability affects the...

PT-2026-86662

A weakness has been identified in SourceCodester Online Voting System 1.0. This affects an unknown function of the file /voting/ajax.php?action=save category. This manipulation of the argument Category causes sql injection. The attack can be initiated remotely. The exploit has been made available...

PT-2026-86684

A vulnerability was detected in Linksys RE7000 2.0.15. This affects the function platform event pingTest of the file /cgi-bin/json.cgi?PingTest of the component PingTest Handler. The manipulation of the argument pingTestIp/pingTestPktSize/pingTestTimes results in os command injection. The attack...