CVE-2026-78247

A SQL injection vulnerability exists in SourceCodester Simple Online Food Ordering System 1.0 , triggered through manipulation of the ID argument in the file /fos/admin/ajax.php?action=confirm_order. The flaw allows a remote, unauthenticated attacker to inject SQL commands, leading to low impact ...

EUVD-2026-64838

A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /fos/admin/ajax.php?action=confirmorder. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has be...

Ruijie RG-EW1200G Router Background - Login Bypass

A vulnerability was found in Ruijie RG-EW1200G 07161417 r483. It has been rated as critical. Affected by this issue is some unknown functionality of the file /api/sys/login. The manipulation leads to improper authentication. The attack may be launched remotely. The exploit has been disclosed to t...

Cobbler 'XML-RPC' - Authentication Bypass

Cobbler, a Linux installation server that allows for rapid setup of network installation environments, has an improper authentication vulnerability starting in version 3.0.0 and prior to versions 3.2.3 and 3.3.7. utils.getsharedsecret always returns -1, which allows anyone to connect to cobbler...

WeiYe-Jing datax-web <= 2.1.2 - OS Command Injection

A vulnerability, which was classified as critical, has been found in WeiYe-Jing datax-web 2.1.2. Affected by this issue is some unknown functionality of the file /api/log/killJob of the component HTTP POST Request Handler. The manipulation of the argument processId leads to os command injection...

Hongjing e-HR 2020 - SQL Injection

A vulnerability, which was classified as critical, has been found in Hongjing e-HR 2020. Affected by this issue is some unknown functionality of the file /wselfservice/oauthservlet/%2e./.%2e/general/inform/org/loadhistroyorgtree of the component Login Interface. The manipulation of the argument...

PHPGurukul Hospital Management System 4.0 - SQL Injection

PHPGurukul Hospital Management System in PHP v4.0 has a SQL injection vulnerability in \hms\user-login.php. Remote unauthenticated users can exploit the vulnerability to obtain sensitive database information. id: CVE-2020-22165 info: name: PHPGurukul Hospital Management System 4.0 - SQL Injection...

HuangDou UTCMS V9 - OS Command Injection

A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9. Affected by this issue is some unknown functionality of the file app/modules/ut-cac/admin/cli.php. The manipulation of the argument o leads to os command injection.The attack may be launched remotely. The...

Discuz! X5.0 - Authentication Bypass

Discuz! X5.0 20260320 through 20260501 contains an authentication bypass caused by exploitation of a shared cryptographic key and encryption oracle in dbbak.php and loggingctl::loggingmore, letting unauthenticated remote attackers access database backup and restore functions, exploit requires...

CVE-2026-78197

A SQL injection vulnerability exists in SourceCodester Simple Online Food Ordering System 1.0 , specifically in the file /fos/admin/ajax.php when the action=save_user parameter is set. Manipulating the Username argument allows an unauthenticated remote attacker to inject SQL, potentially leading ...

CVE-2026-78186

A remote reachable assertion vulnerability exists in the HSS component of Open5GS up to version 2.8.0, specifically in the file src/hss/hss-cx-path.c. The flaw is triggered by manipulation of the User-Name argument, leading to an assertion failure that impacts availability . The attack requires l...

CVE-2026-78185

A SQL injection vulnerability exists in itsourcecode Sales and Inventory System 1.0 , specifically in an unknown function of the file /pages/cust_edit.php . An authenticated remote attacker can exploit this by manipulating the ID parameter, achieving partial impact on confidentiality, integrity, ...

CVE-2026-78169

A stack-based buffer overflow in the UTT HiPER 1250GW (up to 3.2.7-210907-180535 ) affects the strcpy function within the file /goform/aspRemoteApConfTempSend of the HTTP Request Handler component. Manipulation of the Profile argument triggers the overflow, allowing a remote attack. CVSS 4.0 rate...

CVE-2026-78169 UTT HiPER 1250GW HTTP Request aspRemoteApConfTempSend strcpy stack-based overflow

A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. This impacts the function strcpy of the file /goform/aspRemoteApConfTempSend of the component HTTP Request Handler. Performing a manipulation of the argument Profile results in stack-based buffer overflow. The attack is...

CVE-2026-78166

A code injection vulnerability was identified in provectus kafka-ui (up to 0.7.2), affecting the Groovy Code Handler component. Specifically, the executeSmartFilterTest function in MessagesController.java can be exploited remotely to inject and execute arbitrary code. The exploit has been release...

CVE-2026-78060

A cross-site scripting (XSS) vulnerability exists in SourceCodester Stock Management System 1.0 in the file /php_action/getOrderReport.php. Manipulating the clientName or clientContact arguments allows remote, unauthenticated attackers to inject malicious scripts, resulting in a low integrity imp...

EUVD-2026-63793

A weakness has been identified in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This impacts the function saveUser of the file /public/submit.php. This manipulation of the argument Researcher causes sql injection. The attack may be initiated remotely. The exploit has...

CVE-2026-77392

The "Researcher" argument in the saveUser function of /public/submit.php (SourceCodester Dynamic Input Field Generator v1.0) is passed unsanitized to SQL queries, enabling remote SQL injection. CVSS 6.3 (MEDIUM). A public PoC exploit exists at https://gist.github.com/rionyxraiza/6b22a5e02da6b8581...

CVE-2026-77392 SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP submit.php saveUser sql injection

A weakness has been identified in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This impacts the function saveUser of the file /public/submit.php. This manipulation of the argument Researcher causes sql injection. The attack may be initiated remotely. The exploit has...

CVE-2026-77391

SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0 is vulnerable to cross-site request forgery (CSRF) via an unidentified function. CVSS 4.0 scores it MEDIUM (5.3); the attack is remote, requires no privileges and passive user interaction, with integrity impact. A proof-of-...