CVE-2026-19361 macrozheng mall mall-portal getAuthCode password recovery

A flaw has been found in macrozheng mall 0504e86. This vulnerability affects unknown code of the file /sso/getAuthCode of the component mall-portal Module. Executing a manipulation can lead to weak password recovery. The attack may be launched remotely. This attack is characterized by high...

CVE-2026-19357

MingSoft MCMS

CVE-2026-19355

A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of the component ms-mdiy. Executing a manipulation of the argument formFields can lead to sql injection. The attack may be performed from remot...

CVE-2026-19356

A vulnerability was identified in MingSoft MCMS up to 3.0.6. This impacts an unknown function of the file /mdiy/form/data/list of the component ms-mdiy. The manipulation leads to information disclosure. It is possible to initiate the attack remotely. The exploit is publicly available and might be...

CVE-2026-19356

MingSoft MCMS (up to 3.0.6) is affected in the ms-mdiy component, specifically via an issue in the /mdiy/form/data/list path. The vulnerability enables information disclosure and is exploitable remotely. Public exploits are noted in the sources. The vendor was contacted about the disclosure but d...

CVE-2026-19355 MingSoft MCMS ms-mdiy list.do ModelDataImpl.queryDiyFormData sql injection

A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of the component ms-mdiy. Executing a manipulation of the argument formFields can lead to sql injection. The attack may be performed from remot...

EUVD-2026-54923

A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of the component ms-mdiy. Executing a manipulation of the argument formFields can lead to sql injection. The attack may be performed from remot...

CVE-2026-19355

Affected software: MingSoft MCMS up to version 3.0.6, specifically the ms-mdiy component. Vulnerable surface: the function ModelDataImpl.queryDiyFormData in /mdiy/form/data/list.do can be triggered by manipulating the argument formFields, leading to SQL injection. Impact: remote attacker could po...

CVE-2026-19354

CVE-2026-19354 affects lock-upme OPMS. The vulnerability is a SQL injection in an unknown function of controllers/messages/message.go within the IN Clause Handler. Manipulating the argument ids can be exploited remotely (attack vector: network). The product uses a rolling release, so specific aff...

CVE-2026-19354 lock-upme OPMS IN Clause message.go sql injection

A vulnerability was found in lock-upme OPMS up to 831440f37a92c1568f2e071d5233bc873a9d8b09. The impacted element is an unknown function of the file controllers/messages/message.go of the component IN Clause Handler. Performing a manipulation of the argument ids results in sql injection. The attac...

EUVD-2026-54921

A vulnerability has been found in DedeCMS up to 5.7.118 UTF8SP2. The affected element is the function 4Setup of the file install/index.php of the component Installation Wizard. Such manipulation leads to file inclusion. The attack can be executed remotely. This attack is characterized by high...

CVE-2026-19353

A vulnerability has been found in DedeCMS up to 5.7.118 UTF8SP2. The affected element is the function 4Setup of the file install/index.php of the component Installation Wizard. Such manipulation leads to file inclusion. The attack can be executed remotely. This attack is characterized by high...

CVE-2026-19351 dresende node-sql-query Request Parameter Select.js SelectQuery.build sql injection

A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery.from/SelectQuery.build in the library lib/Select.js of the component Request Parameter Handler. Performing a manipulation results in sql injection. It is...

CVE-2026-19351 dresende node-sql-query Request Parameter Select.js SelectQuery.build sql injection

A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery.from/SelectQuery.build in the library lib/Select.js of the component Request Parameter Handler. Performing a manipulation results in sql injection. It is...

CVE-2026-19351

A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery.from/SelectQuery.build in the library lib/Select.js of the component Request Parameter Handler. Performing a manipulation results in sql injection. It is...

CVE-2026-19350

Dolibarr ERP TakePOS module vulnerability CVE-2026-19350 affects the function fail in htdocs/takepos/invoice.php. The issue enables manipulation that leads to missing authorization, with remote exploitation potential. A patch identified as 8992ce8704da947b6abe7b65a6fe59aed736bb81 is available; ap...

CVE-2026-19345

A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown part of the file /user/UpdateTaskStatus.php. The manipulation of the argument taskid/val results in missing authorization. It is possible to launch the attack remotely. The exploit has been made public...

EUVD-2026-54916

A vulnerability was identified in itsourcecode Hospital Management System 1.0. This issue affects some unknown processing of the file /viewdoctor.php. Such manipulation of the argument delid leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might b...

CVE-2026-19347

The CVE-2026-19347 entry concerns itsourcecode Hospital Management System 1.0. A vulnerability exists in /viewdoctor.php where manipulating the delid argument enables SQL injection. This is a network-based issue with LOW/LOW- to MEDIUM-impact characteristics across confidentiality, integrity, and...

CVE-2026-19346 Tenda CH22 CertListInfo formCertListInfo command injection

A vulnerability was determined in Tenda CH22 1.0.0.1. This vulnerability affects the function formCertListInfo of the file /goform/CertListInfo. This manipulation of the argument Name causes command injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may b...