CVE-2026-90498 lenve vhr vhr.sql default credentials

A vulnerability was identified in lenve vhr 1.0-SNAPSHOT. Affected by this issue is some unknown functionality of the file vhr.sql. The manipulation leads to use of default credentials. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor...

CVE-2026-90498 lenve vhr vhr.sql default credentials

A vulnerability was identified in lenve vhr 1.0-SNAPSHOT. Affected by this issue is some unknown functionality of the file vhr.sql. The manipulation leads to use of default credentials. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor...

CVE-2026-90498

A vulnerability was identified in lenve vhr 1.0-SNAPSHOT , where the vhr.sql file allows exploitation through the use of default credentials . The issue permits remote exploitation with no authentication required and low attack complexity. The CVSS 3.1 base score is 7.3 (HIGH) and CVSS 4.0 is 6.9...

CVE-2026-90495

A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance-findAll of the file application/models/CompanyWebsite.class.php of the component Legacy API. Such manipulation of the argument auth leads to sql injection. The attack can be...

EUVD-2026-76922

A vulnerability was determined in Xuxueli xxl-job up to 3.4.2. This affects the function GroovyClassLoader.parseClass of the file xxl-job-core/src/main/java/com/xxl/job/core/glue/GlueFactory.java. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploit...

CVE-2026-90488

A vulnerability was determined in Xuxueli xxl-job up to 3.4.2. This affects the function GroovyClassLoader.parseClass of the file xxl-job-core/src/main/java/com/xxl/job/core/glue/GlueFactory.java. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploit...

PT-2026-90988

A security flaw has been discovered in Totolink A3002MU Hh-B20211125.1046. This affects an unknown part of the component Anchor Tag Handler. Performing a manipulation results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and ma...

PT-2026-90953

Name of the Vulnerable Software and Affected Versions cym1102 nginxWebUI versions prior to 4.4.3 Description Remote code injection is possible through the manipulation of the url argument within the MainController.autoUpdate function located in the /adminPage/main/autoUpdate file. Recommendations...

PT-2026-90864

Name of the Vulnerable Software and Affected Versions SourceCodester School Registration and Fee System version 1.0 Description An issue exists in the /bilal/save class.php file where the manipulation of the Category argument allows for SQL injection, a technique used to interfere with the querie...

CVE-2026-90526: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in SourceCodester School Registration and Fee System 1.0. This impacts an unknown function of the file /bilal/saveclass.php. The manipulation of the argument Category leads to sql injection. Remote exploitation of the attack is possible. The exploit has...

PT-2026-90779

Name of the Vulnerable Software and Affected Versions webgjc web robot version 2.4.0 webgjc web robot version 2.5.0 webgjc web robot version 2.8.0 Description Remote os command injection is possible through the manipulation of the case name argument. This issue occurs within the controller listen...

PT-2026-90866

Name of the Vulnerable Software and Affected Versions TDuckApp tduck-platform versions prior to 5.4 Description A flaw in the Form Write View component, specifically within the file tduck-front/src/views/form/write/index.vue, allows for remote cross-site scripting. This occurs through the...

PT-2026-90868

A vulnerability was determined in maliangnansheng bbs-springboot 3.0.0. This affects the function utils.toToc of the file ArticleController.java. This manipulation causes cross site scripting. The attack is possible to be carried out remotely...

PT-2026-90876

Name of the Vulnerable Software and Affected Versions Exrick xmall versions up to 19e7917d5ed3bd2a2421a3a246ad494c133ba94c Description An issue exists in the Order Printing component within the file xmall-manager-web/src/main/webapp/WEB-INF/jsp/order-print.jsp. A manipulation of an unknown functi...

CVE-2026-90594: Missing Authorization

A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0. This vulnerability affects the function PermissionService.checkUserPermission of the file /rpc/service/PermissionService.java of the component Permission Service. The manipulation leads to missing authorization. Remote...

CVE-2026-90571: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in Exrick xmall up to 19e7917d5ed3bd2a2421a3a246ad494c133ba94c. Impacted is an unknown function of the file xmall-manager-web/src/main/webapp/WEB-INF/jsp/order-print.jsp of the component Order Printing. Performing a manipulation results in cross site scripting. Remote...

PT-2026-90971

A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0. This vulnerability affects the function PermissionService.checkUserPermission of the file /rpc/service/PermissionService.java of the component Permission Service. The manipulation leads to missing authorization. Remote...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libvpx (UTSA-2023-003033)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-003033 advisory. Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap...

PT-2026-90853

A weakness has been identified in PHPGurukul Bank Locker Management System 1.0. Affected is an unknown function of the file /blms/banker/add-locker-form.php. This manipulation of the argument addressproof causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has...

CVE-2026-90488: Improper Control of Generation of Code

A vulnerability was determined in Xuxueli xxl-job up to 3.4.2. This affects the function GroovyClassLoader.parseClass of the file xxl-job-core/src/main/java/com/xxl/job/core/glue/GlueFactory.java. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploit...