The vulnerability of SAP Business One’s resource management system, which exists due to the lack of measures taken to protect the website structure, allows attackers to perform cross-site scripting attacks (XSS).

The vulnerability of SAP Business One’s resource management system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

The vulnerability of SAP NetWeaver Application Server ABAP software integration platforms lies in the absence of authentication procedures, which allows attackers to compromise the integrity and accessibility of protected information.

The vulnerability of SAP NetWeaver Application Server ABAP software integration platforms is related to the absence of an authentication process. Exploiting this vulnerability allows a malicious actor to compromise the integrity and accessibility of protected information from a remote location...

CVE-2026-90606

CVE-2026-90606 is a buffer overflow in the boa component of Totolink A3002MU (firmware Hh-B20211125.1046). The vulnerable function is formIpv6Setup in the file /boafrm/formIpv6Setup; manipulation of the argument static_ipv6 triggers the overflow. The vulnerability is exploitable remotely with low...

CVE-2026-90604 Totolink A3002MU Anchor Tag cross site scripting

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. This affects an unknown part of the component Anchor Tag Handler. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and ma...

CVE-2026-90604

A cross-site scripting (XSS) flaw exists in the Anchor Tag Handler component of the Totolink A3002MU router running firmware Hh-B20211125.1046 . The vulnerability is remotely exploitable and requires low privileges plus user interaction. A proof-of-concept exploit has been released to the public ...

CVE-2026-90604 Totolink A3002MU Anchor Tag cross site scripting

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. This affects an unknown part of the component Anchor Tag Handler. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and ma...

CVE-2026-90597 itsourcecode Sales and Inventory System sup_edit1.php sql injection

A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/supedit1.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been...

CVE-2026-90594

A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0. This vulnerability affects the function PermissionService.checkUserPermission of the file /rpc/service/PermissionService.java of the component Permission Service. The manipulation leads to missing authorization. Remote...

CVE-2026-90594

A missing authorization (fail-open) vulnerability in the Permission Service of wxiaoqi Spring-Cloud-Platform versions 3.0.1 and 3.1.0 affects the function PermissionService.checkUserPermission in /rpc/service/PermissionService.java. The flaw allows remote attackers with low privileges to bypass p...

EUVD-2026-77092

A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0. This vulnerability affects the function PermissionService.checkUserPermission of the file /rpc/service/PermissionService.java of the component Permission Service. The manipulation leads to missing authorization. Remote...

CVE-2026-90594 wxiaoqi Spring-Cloud-Platform Permission Service PermissionService.java PermissionService.checkUserPermission authorization

A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0. This vulnerability affects the function PermissionService.checkUserPermission of the file /rpc/service/PermissionService.java of the component Permission Service. The manipulation leads to missing authorization. Remote...

CVE-2026-90594 wxiaoqi Spring-Cloud-Platform Permission Service PermissionService.java PermissionService.checkUserPermission authorization

A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0. This vulnerability affects the function PermissionService.checkUserPermission of the file /rpc/service/PermissionService.java of the component Permission Service. The manipulation leads to missing authorization. Remote...

CVE-2026-90581

A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2. This issue affects the function MainController.autoUpdate of the file /adminPage/main/autoUpdate. This manipulation of the argument url causes code injection. Remote exploitation of the attack is possible. The exploit has been...

CVE-2026-90581 cym1102 nginxWebUI autoUpdate MainController.autoUpdate code injection

A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2. This issue affects the function MainController.autoUpdate of the file /adminPage/main/autoUpdate. This manipulation of the argument url causes code injection. Remote exploitation of the attack is possible. The exploit has been...

EUVD-2026-77071

A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2. This issue affects the function MainController.autoUpdate of the file /adminPage/main/autoUpdate. This manipulation of the argument url causes code injection. Remote exploitation of the attack is possible. The exploit has been...

CVE-2026-90581

nginxWebUI (by cym1102, versions up to 4.4.2 ) is vulnerable to code injection in the MainController.autoUpdate function located at /adminPage/main/autoUpdate. The root cause is manipulation of the url argument, allowing a remote attacker with low privileges (no user interaction required) to exec...

CVE-2026-90581 cym1102 nginxWebUI autoUpdate MainController.autoUpdate code injection

A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2. This issue affects the function MainController.autoUpdate of the file /adminPage/main/autoUpdate. This manipulation of the argument url causes code injection. Remote exploitation of the attack is possible. The exploit has been...

CVE-2026-90581 cym1102 nginxWebUI autoUpdate MainController.autoUpdate code injection

A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2. This issue affects the function MainController.autoUpdate of the file /adminPage/main/autoUpdate. This manipulation of the argument url causes code injection. Remote exploitation of the attack is possible. The exploit has been...

EUVD-2026-77064

A vulnerability has been found in cheshire-cat-ai Cheshire Cat AI up to 1.9.2. This affects the function authorizehttpkey of the file core/cat/factory/customauthhandler.py. The manipulation of the argument userid leads to missing authentication. The attack may be initiated remotely. The exploit h...

CVE-2026-90571

A vulnerability was found in Exrick xmall up to 19e7917d5ed3bd2a2421a3a246ad494c133ba94c. Impacted is an unknown function of the file xmall-manager-web/src/main/webapp/WEB-INF/jsp/order-print.jsp of the component Order Printing. Performing a manipulation results in cross site scripting. Remote...