PT-2026-35561

Name of the Vulnerable Software and Affected Versions SourceCodester Pharmacy Sales and Inventory System version 1.0 Description A cross-site scripting issue exists in the '/index.php?page=types' endpoint. A remote attacker can execute the attack by manipulating the ID argument. Cross-site...

PT-2026-35454

A vulnerability has been found in Totolink A8000RU 7.1cu.643 b20200521. Impacted is the function CsteSystem of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument HTTP leads to os command injection. The attack may be performed from remote. The exploit has...

PT-2026-35516

Name of the Vulnerable Software and Affected Versions dexhunter kaggle-mcp versions prior to 406127ffcb2b91b8c10e20e6c2ca787fbc1dc92d Description A path traversal issue exists in the prepare kaggle dataset function within the src/kaggle mcp/server.py file. This flaw allows a remote attacker to...

PT-2026-35356

A vulnerability was detected in code-projects Chat System 1.0. This affects an unknown function of the file /admin/send message.php of the component Chat Interface. The manipulation of the argument msg results in cross site scripting. The attack may be launched remotely. The exploit is now public...

PT-2026-35459

A vulnerability was found in vllm up to 0.19.0. The affected element is the function has mamba layers of the file vllm/v1/kv cache interface.py of the component KV Block Handler. Performing a manipulation results in uninitialized resource. It is possible to initiate the attack remotely. The attac...

PT-2026-35533

A vulnerability was determined in Tenda HG3 2.0. This vulnerability affects the function formTracert of the file /boaform/formTracert. Executing a manipulation of the argument datasize can lead to command injection. The attack may be performed from remote. The exploit has been publicly disclosed...

PT-2026-35377

Name of the Vulnerable Software and Affected Versions Tenda F456 version 1.0.0.5 Description A flaw in the httpd component allows a remote attack to cause a buffer overflow, which occurs when a program writes more data to a storage area than it can hold. The issue is located in the fromNatlimitof...

PT-2026-35366

A weakness has been identified in Tenda F456 1.0.0.5. This issue affects the function fromwebExcptypemanFilter of the file /goform/webExcptypemanFilter of the component httpd. This manipulation of the argument page causes buffer overflow. The attack can be initiated remotely. The exploit has been...

PT-2026-35380

A weakness has been identified in code-projects Invoice System in Laravel 1.0. The impacted element is an unknown function of the file /company. This manipulation of the argument logo causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made availabl...

PT-2026-35411

A vulnerability has been found in Totolink A8000RU 7.1cu.643 b20200521. This impacts the function setUPnPCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Such manipulation of the argument enable leads to os command injection. It is possible to launch the attack remotely. The...

PT-2026-35353

A security flaw has been discovered in SourceCodester Pharmacy Sales and Inventory System 1.0. Impacted is an unknown function of the file /ajax.php?action=save sales. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been...

PT-2026-35541

Name of the Vulnerable Software and Affected Versions SourceCodester Pharmacy Sales and Inventory System version 1.0 Description A SQL injection flaw exists in the '/ajax.php?action=save product' endpoint. This issue allows a remote attacker to manipulate the ID argument to execute arbitrary SQL...

PT-2026-35531

Name of the Vulnerable Software and Affected Versions dmitryglhf mcp-url-downloader versions prior to 4b8cf2de55f6e8864a77d108e8a94a5b8e4394c6 Description An issue in the validate url safe function within the src/mcp url downloader/server.py file allows for server-side request forgery SSRF, a fla...

PT-2026-35513

A flaw has been found in CodeAstro Online Classroom 1.0. This affects an unknown part of the file /addnewfaculty. Executing a manipulation of the argument fname can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used...

PT-2026-35338

A vulnerability was determined in itsourcecode Courier Management System 1.0. Impacted is an unknown function of the file /edit branch.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed...

PT-2026-35420

A security flaw has been discovered in SourceCodester Pharmacy Sales and Inventory System 1.0. This affects an unknown part of the file /ajax.php?action=save category. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released ...

SourceCodester Pharmacy Sales and Inventory System 注入漏洞

SourceCodester Pharmacy Sales and Inventory System is an open-source medication sales and inventory management system developed by SourceCodester. Version 1.0 of the SourceCodester Pharmacy Sales and Inventory System contains a SQL injection vulnerability. This vulnerability arises from improper...

PT-2026-35542

Name of the Vulnerable Software and Affected Versions CodeAstro Online Classroom version 1.0 Description A remote SQL injection exists in the /guestdetails file. The issue occurs when the deleteid argument is manipulated, allowing an attacker to execute arbitrary SQL commands. Recommendations As ...

PT-2026-35432

A flaw has been found in SourceCodester Pharmacy Sales and Inventory System 1.0. The affected element is an unknown function of the file /ajax.php?action=delete category. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit ha...

PT-2026-35450

A weakness has been identified in Totolink A8000RU 7.1cu.643 b20200521. Affected by this issue is the function setDmzCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. Executing a manipulation of the argument wanIdx can lead to os command injection. The attack may be launched...