42896 matches found
CVE-2026-19375 dmitriiweb article-scraper-mcp server.py fetch_article server-side request forgery
A vulnerability was detected in dmitriiweb article-scraper-mcp 1.0.0. This vulnerability affects the function fetcharticle of the file newsscrapermcp/server.py. The manipulation of the argument url results in server-side request forgery. The attack may be performed from remote. The exploit is now...
Cobbler 'XML-RPC' - Authentication Bypass
Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in version 3.0.0 and prior to versions 3.2.3 and 3.3.7. utils.getsharedsecret always returns -1, which allows anyone to connect to cobbler...
WeiYe-Jing datax-web <= 2.1.2 - OS Command Injection
A vulnerability, which was classified as critical, has been found in WeiYe-Jing datax-web 2.1.2. Affected by this issue is some unknown functionality of the file /api/log/killJob of the component HTTP POST Request Handler. The manipulation of the argument processId leads to os command injection...
PHPGurukul Hospital Management System 4.0 - SQL Injection
PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\user-login.php. Remote unauthenticated users can exploit the vulnerability to obtain sensitive database information. id: CVE-2020-22165 info: name: PHPGurukul Hospital Management System 4.0 - SQL Injection...
Discuz! X5.0 - Authentication Bypass
Discuz! X5.0 20260320 through 20260501 contains an authentication bypass caused by exploitation of a shared cryptographic key and encryption oracle in dbbak.php and loggingctl::loggingmore, letting unauthenticated remote attackers access database backup and restore functions, exploit requires...
Hongjing e-HR 2020 - SQL Injection
A vulnerability, which was classified as critical, has been found in Hongjing e-HR 2020. Affected by this issue is some unknown functionality of the file /wselfservice/oauthservlet/%2e./.%2e/general/inform/org/loadhistroyorgtree of the component Login Interface. The manipulation of the argument...
HuangDou UTCMS V9 - OS Command Injection
A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9. Affected by this issue is some unknown functionality of the file app/modules/ut-cac/admin/cli.php. The manipulation of the argument o leads to os command injection.The attack may be launched remotely. The...
CVE-2026-19364
The CVE concerns itsourcecode Hospital Management System 1.0. The vulnerability is in an unknown function in /viewdoctorconsultancycharge.php where manipulating the delid argument leads to SQL injection. Attacks can be performed remotely, and public disclosure of the exploit is noted. The connect...
EUVD-2026-54936
A vulnerability was determined in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /viewdoctorconsultancycharge.php. This manipulation of the argument delid causes sql injection. The attack is possible to be carried out remotely. The exploit has...
CVE-2026-19361
CVE-2026-19361 affects macrozheng mall (version 0504e86) in the mall-portal Module, specifically the /sso/getAuthCode component. The description states a flaw in an unknown code path that enables a weak password recovery, with the attack described as remotely executable and high complexity. The e...
EUVD-2026-54932
A flaw has been found in macrozheng mall 0504e86. This vulnerability affects unknown code of the file /sso/getAuthCode of the component mall-portal Module. Executing a manipulation can lead to weak password recovery. The attack may be launched remotely. This attack is characterized by high...
CVE-2026-19361 macrozheng mall mall-portal getAuthCode password recovery
A flaw has been found in macrozheng mall 0504e86. This vulnerability affects unknown code of the file /sso/getAuthCode of the component mall-portal Module. Executing a manipulation can lead to weak password recovery. The attack may be launched remotely. This attack is characterized by high...
CVE-2026-19355
A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of the component ms-mdiy. Executing a manipulation of the argument formFields can lead to sql injection. The attack may be performed from remot...
CVE-2026-19356
A vulnerability was identified in MingSoft MCMS up to 3.0.6. This impacts an unknown function of the file /mdiy/form/data/list of the component ms-mdiy. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit is publicly available and might be...
CVE-2026-19356
MingSoft MCMS (up to 3.0.6) is affected in the ms-mdiy component, specifically via an issue in the /mdiy/form/data/list path. The vulnerability enables information disclosure and is exploitable remotely. Public exploits are noted in the sources. The vendor was contacted about the disclosure but d...
CVE-2026-19355 MingSoft MCMS ms-mdiy list.do ModelDataImpl.queryDiyFormData sql injection
A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of the component ms-mdiy. Executing a manipulation of the argument formFields can lead to sql injection. The attack may be performed from remot...
CVE-2026-19355
Affected software: MingSoft MCMS up to version 3.0.6, specifically the ms-mdiy component. Vulnerable surface: the function ModelDataImpl.queryDiyFormData in /mdiy/form/data/list.do can be triggered by manipulating the argument formFields, leading to SQL injection. Impact: remote attacker could po...
EUVD-2026-54923
A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of the component ms-mdiy. Executing a manipulation of the argument formFields can lead to sql injection. The attack may be performed from remot...
CVE-2026-19354
CVE-2026-19354 affects lock-upme OPMS. The vulnerability is a SQL injection in an unknown function of controllers/messages/message.go within the IN Clause Handler. Manipulating the argument ids can be exploited remotely (attack vector: network). The product uses a rolling release, so specific aff...