---METADATA---
VENDOR: Crocus
PRODUCT: Crocus
AFFECTED_VERSIONS: Crocus <= 1.3.44
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An SQL injection vulnerability in the Crocus DeviceInfoMapper.xml file allows remote, unauthenticated attackers to execute arbitrary SQL commands and escalate privileges.

Executive Summary:
A critical SQL injection vulnerability in Crocus allows unauthenticated remote attackers to achieve full database compromise and escalate privileges.

Vulnerability Details

CVE-ID: CVE-2026-52469

Affected Software: Crocus

Affected Versions: Crocus <= 1.3.44

Vulnerability: The application is susceptible to SQL injection via the DeviceInfoMapper.xml file. This allows an unauthenticated remote attacker to inject arbitrary SQL statements, leading to unauthorized database interaction and privilege escalation.

Business Impact

With a CVSS score of 9.8, this vulnerability is critical. Successful exploitation provides an attacker with complete control over the underlying database, enabling them to steal sensitive information, modify data, or gain administrative access to the application, resulting in a total compromise of the affected system.

Remediation Plan

Immediate Action: Upgrade Crocus to a version greater than 1.3.44 to patch the vulnerable mapper file.

Proactive Monitoring: Monitor database query logs for unusual or malformed SQL statements that deviate from standard application behavior.

Compensating Controls: Use a Web Application Firewall (WAF) to filter incoming requests for common SQL injection patterns and sanitize input before it reaches the application backend.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists.

Analyst Notes: As of July 20, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication and the potential for total system impact.

Analyst Recommendation

Given the critical severity of this vulnerability, immediate patching is required. Organizations should treat this as a high-priority remediation task to avoid total database compromise and unauthorized administrative access.

---METADATA---
VENDOR: Open Library Foundation
PRODUCT: VuFind
AFFECTED_VERSIONS: 11.0.3, 4.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Open Library Foundation VuFind v11.0.3 and v4.1 suffer from an incorrect access control vulnerability where requests continue processing despite failed authorization checks.

Executive Summary:
A critical access control flaw in VuFind allows unauthenticated attackers to trigger unauthorized function execution despite receiving an initial access denied response.

Vulnerability Details

CVE-ID: CVE-2026-52466

Affected Software: Open Library Foundation VuFind

Affected Versions: 11.0.3, 4.1

Vulnerability: This is an improper access control vulnerability located in the VuFind Controller AbstractBase::validateAccessPermission method. The application fails to terminate request processing after identifying that controller level permissions do not grant access, allowing the intended function to execute regardless of the authorization failure.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized data access, modification, or system-wide disruption. With a CVSS score of 9.8, the potential for total impact on confidentiality, integrity, and availability is high, posing a significant risk to the security posture of library systems utilizing this software.

Remediation Plan

Immediate Action: Monitor the vendor security advisory at https://vufind.org/wiki/security:cve-2026-52466 for the release of a patch and apply it immediately upon availability.

Proactive Monitoring: Review application and access logs for unusual patterns of denied requests followed by successful administrative function execution.

Compensating Controls: Implement strict network perimeter controls and Web Application Firewall (WAF) rules to restrict access to the application to known, trusted IP ranges until a patch is applied.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the failure of the security gatekeeper logic.

Analyst Recommendation

Given the critical nature of this vulnerability and its potential for total system compromise, organizations should treat this as a high-priority item. Administrators must maintain awareness of the vendor security portal and prioritize the deployment of the official fix as soon as it is released.

---METADATA---
VENDOR: xiandafu
PRODUCT: beetl
AFFECTED_VERSIONS: 3.20.2
CONFIDENCE: high
MISSING: patch, technical_details
SOURCES_JSON: [{"url":"https://gitee.com/xiandafu/beetl","name":null,"tags":[]},{"url":"https://gitee.com/xiandafu/beetl/issues/IJO1HM","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
The beetl template engine contains a remote code execution vulnerability in version 3.20.2 triggered via the type.new function and property reflection mechanism.

Executive Summary:
A critical remote code execution vulnerability in the xiandafu beetl template engine allows unauthenticated attackers to gain full system control.

Vulnerability Details

CVE-ID: CVE-2026-52439

Affected Software: xiandafu beetl

Affected Versions: 3.20.2

Vulnerability: This vulnerability involves an insecure implementation of the type.new function and property reflection mechanism, which permits an unauthenticated remote attacker to execute arbitrary code on the underlying host.

Business Impact

The ability for an unauthenticated remote attacker to execute arbitrary code represents a total compromise of the affected system. This risk is classified as critical with a CVSS score of 9.8, as it facilitates unauthorized data access, potential lateral movement within the network, and complete service disruption.

Remediation Plan

Immediate Action: Since no specific patch version is currently identified, verify if your environment is utilizing beetl version 3.20.2 and consider isolating affected systems or restricting access to the application until a vendor-supplied update is released.

Proactive Monitoring: Monitor server logs for suspicious HTTP requests involving template processing or unexpected calls to reflection-based functions, as well as any unusual outbound network traffic originating from the application server.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block requests containing patterns associated with the beetl type.new function or suspicious property reflection payloads.

Exploitation Status

Public Exploit Available: No — there is no confirmed public exploit or weaponized code available in the provided data.

Analyst Notes: As of July 24, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The nature of this flaw, involving reflection-based code execution, makes it a high-value target for attackers looking to achieve remote code execution without authentication.

Analyst Recommendation

Given the critical severity of this vulnerability and the existence of a proof-of-concept, administrators should prioritize the identification of all instances of beetl 3.20.2 within their infrastructure. Until an official patch is available, apply restrictive network controls and monitor for signs of exploitation to mitigate the risk of full system compromise.

---METADATA---
VENDOR: MIA Technology
PRODUCT: MIA Technology Inc (Software)
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A CSV formula injection vulnerability in MIA Technology software allows attackers to execute arbitrary system commands when a malicious CSV file is opened.

Executive Summary:
MIA Technology software is vulnerable to CSV formula injection, which can facilitate remote command execution on a user's local system.

Vulnerability Details

CVE-ID: CVE-2026-5242

Affected Software: MIA Technology MIA Technology Inc

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability involves the improper neutralization of formula elements within CSV files. An attacker can craft a malicious CSV file that, when opened in spreadsheet software, triggers unauthorized commands or data exfiltration.

Business Impact

With a CVSS score of 8.8, this flaw poses a significant danger to client-side environments. Successful exploitation could lead to data theft, malware infection, or unauthorized system access, making it a major concern for any organization that processes user-uploaded CSV files.

Remediation Plan

Immediate Action: Install the latest security update from the vendor to remediate the CSV handling logic.

Proactive Monitoring: Monitor for unexpected process launches or network connections following the opening of generated CSV reports.

Compensating Controls: Educate users on the risks of opening untrusted files and implement input validation on the server side to sanitize CSV output content.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 16, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

MIA Technology users should prioritize updating their software to the latest version. In the interim, organizations should implement strict controls over file uploads and sanitize all data exported into CSV formats to prevent the injection of malicious formulas.

---METADATA---
VENDOR: itsourcecode
PRODUCT: Payroll Management System
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
CREDITS: s1incere (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/354389","name":"VDB-354389 | itsourcecode Payroll Management System Parameter view_employee.php sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/354389/cti","name":"VDB-354389 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/780475","name":"Submit #780475 | itsourcecode Payroll Management System - V1.0 Argument Injection","tags":["third-party-advisory"]},{"url":"https://github.com/K4ptor/itsourcecode-Payroll-Management-System-V1.0-SQL-Injection2","name":null,"tags":["exploit"]},{"url":"https://itsourcecode.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.167Z
---END_METADATA---

Description Summary:
The itsourcecode Payroll Management System version 1.0 is vulnerable to remote SQL injection via the ID parameter in the view_employee.php file.

Executive Summary:
A critical SQL injection vulnerability in the itsourcecode Payroll Management System allows unauthenticated remote attackers to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2026-5238

Affected Software: itsourcecode Payroll Management System

Affected Versions: 1.0

Vulnerability: This flaw is a SQL injection vulnerability (CWE-89) located in the view_employee.php script. The application fails to properly sanitize the ID argument, allowing an unauthenticated remote attacker to execute arbitrary SQL commands.

Business Impact

The ability to perform unauthenticated SQL injection poses a significant risk to data confidentiality and integrity. Attackers could potentially extract sensitive payroll information, modify employee records, or bypass authentication mechanisms, leading to severe reputational damage and legal liability. With a CVSS score of 7.3, this high-severity vulnerability necessitates immediate attention to prevent unauthorized database access.

Remediation Plan

Immediate Action: Since no official vendor patch is currently available, administrators should restrict network access to the application or take the system offline until a secure version is released.

Proactive Monitoring: Review web server access logs for anomalous GET or POST requests containing SQL syntax, such as UNION, SELECT, or sleep commands, directed at view_employee.php.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection filtering rules to block malicious payloads targeting the vulnerable parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the provided GitHub repository reference.

Analyst Notes: As of April 1, 2026, there is no information indicating active exploitation in the wild; however, a functional public exploit is available. The vulnerability is inherently exploitable due to the lack of input validation on the ID parameter.

Analyst Recommendation

The presence of a public exploit for this unauthenticated SQL injection vulnerability makes it a high-priority target for malicious actors. Given the lack of a vendor-provided patch, organizations must prioritize implementing compensating controls, such as WAF rules, and restricting access to the affected system to mitigate the risk of data exfiltration.

---METADATA---
VENDOR: itsourcecode
PRODUCT: Payroll Management System
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
CREDITS: s1incere (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/354388","name":"VDB-354388 | itsourcecode Payroll Management System Parameter manage_user.php sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/354388/cti","name":"VDB-354388 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/780474","name":"Submit #780474 | itsourcecode Payroll Management System - V1.0 Argument Injection","tags":["third-party-advisory"]},{"url":"https://github.com/K4ptor/itsourcecode-Payroll-Management-System-V1.0-SQL-Injection","name":null,"tags":["exploit"]},{"url":"https://itsourcecode.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.167Z
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the Payroll Management System 1.0 allows remote, unauthenticated attackers to manipulate the ID argument in manage_user.php.

Executive Summary:
The Payroll Management System 1.0 contains a critical SQL injection vulnerability that allows remote, unauthenticated attackers to compromise database integrity.

Vulnerability Details

CVE-ID: CVE-2026-5237

Affected Software: itsourcecode Payroll Management System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the manage_user.php file. The flaw exists within the Parameter Handler component, where an unauthenticated attacker can manipulate the ID argument to execute arbitrary SQL commands.

Business Impact

Successful exploitation of this vulnerability allows an unauthenticated attacker to interact directly with the backend database. This may lead to the unauthorized disclosure, modification, or deletion of sensitive payroll data, resulting in significant privacy breaches and potential regulatory non-compliance. Given the CVSS score of 7.3, this represents a high-risk scenario that could lead to full compromise of the application data layer.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the application or take the system offline until a secure version is released.

Proactive Monitoring: Review web server access logs for anomalous URL patterns targeting manage_user.php and monitor database logs for unexpected SQL syntax errors or unauthorized queries.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection payloads targeting the ID parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the GitHub repository provided in the vulnerability references.

Analyst Notes: As of April 1, 2026, there is no public information indicating active exploitation in the wild, though the availability of a public exploit significantly lowers the bar for potential attackers. The flaw is inherently dangerous due to the lack of required authentication.

Analyst Recommendation

The presence of a public exploit for an unauthenticated SQL injection vulnerability makes this a high-priority concern for any organization utilizing the Payroll Management System. Organizations should prioritize isolating the affected system from public-facing networks until the vendor provides a remediation path. Continuous monitoring of database activity is essential to detect any attempts to leverage this vulnerability.

---METADATA---
VENDOR: Menyoo
PRODUCT: MenyooSP
AFFECTED_VERSIONS: Menyoo 2.0 Versions before commit 729aa48
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A directory traversal vulnerability in Menyoo 2.0 allows a local attacker to execute arbitrary code via multiple file management functions.

Executive Summary:
A critical directory traversal vulnerability in Menyoo 2.0 allows local attackers to achieve arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-52349

Affected Software: Menyoo MenyooSP

Affected Versions: Menyoo 2.0 Versions before commit 729aa48

Vulnerability: This is a directory traversal vulnerability that stems from inadequate input validation and path sanitization within the Spooner, VehicleSpawner, and WeaponOptions file management functionalities. It requires a local attacker to interact with these specific components to trigger the flaw and execute arbitrary code.

Business Impact

Successful exploitation of this vulnerability permits a local user to execute arbitrary code on the host system. Given the CVSS score of 7.8, the potential for full system compromise is significant, potentially leading to unauthorized data access, lateral movement, or complete loss of system integrity.

Remediation Plan

Immediate Action: Upgrade to the latest version of Menyoo or apply the patch provided in commit 729aa48 immediately.

Proactive Monitoring: Monitor local system logs for unusual file access patterns or attempts to access restricted directory paths via the affected management functions.

Compensating Controls: Restrict local user access to the application directories and ensure that the software is executed with the minimum necessary privileges to limit the impact of potential code execution.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of July 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While the vulnerability allows for code execution, it is limited by the requirement for local access.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention to prevent local privilege escalation or system takeover. Administrators should prioritize applying the fix provided in commit 729aa48 to neutralize the directory traversal path.

---METADATA---
VENDOR: cool-team-official
PRODUCT: cool-admin-java
AFFECTED_VERSIONS: 8.0.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the order() method of CrudOption.java within cool-admin-java 8.0.0 allows unauthenticated attackers to compromise the database.

Executive Summary:
A critical SQL injection vulnerability in cool-admin-java 8.0.0 allows unauthenticated remote attackers to gain full control over the database.

Vulnerability Details

CVE-ID: CVE-2026-52348

Affected Software: cool-admin-java

Affected Versions: 8.0.0

Vulnerability: This vulnerability is a SQL injection flaw found in the order() method of CrudOption.java. It allows an unauthenticated remote attacker to execute arbitrary SQL commands, resulting in full impact to confidentiality, integrity, and availability.

Business Impact

The CVSS score of 9.8 indicates a critical risk to the entire application stack. Successful exploitation grants an attacker the ability to read, modify, or delete database contents, which could lead to a total compromise of the application and its underlying data.

Remediation Plan

Immediate Action: Check the vendor repository for security updates and apply the latest version once available to address the flawed method.

Proactive Monitoring: Monitor database query logs for evidence of SQL injection attempts, such as unexpected syntax or commands originating from the web application layer.

Compensating Controls: Use a Web Application Firewall with SQL injection protection enabled to inspect and block malicious payloads directed at the application.

Exploitation Status

Public Exploit Available: No (Note: While public proof-of-concept code exists, there is no confirmed weaponized exploit available.)

Analyst Notes: As of July 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the nature of SQL injection.

Analyst Recommendation

Due to the critical nature of this SQL injection vulnerability and the existence of a public proof-of-concept, immediate action is required. Administrators should restrict access to the affected component and prioritize updating the application as soon as a fix is released by the maintainers.

---METADATA---
VENDOR: Veronalabs
PRODUCT: WP Statistics
AFFECTED_VERSIONS: 0 through 14.16.4
CONFIDENCE: high
MISSING: none
CREDITS: daroo (finder)
SOURCES_JSON: [{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/9b350b48-05ba-4054-895f-36d7ad71459d?source=cve","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/wp-statistics/trunk/assets/dev/javascript/chart.js#L498","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.16.4/assets/dev/javascript/chart.js#L498","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/wp-statistics/trunk/src/Service/Analytics/Referrals/ReferralsParser.php#L62","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/wp-statistics/tags/14.16.4/src/Service/Analytics/Referrals/ReferralsParser.php#L62","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3503795%40wp-statistics%2Ftrunk&old=3483860%40wp-statistics%2Ftrunk&sfp_email=&sfph_mail=","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.687Z
---END_METADATA---

Description Summary:
The WP Statistics WordPress plugin is vulnerable to stored Cross-Site Scripting via the utm_source parameter, allowing unauthenticated attackers to execute arbitrary scripts in administrative dashboards.

Executive Summary:
An unauthenticated stored Cross-Site Scripting vulnerability in the WP Statistics plugin for WordPress allows attackers to execute malicious scripts within the administrative interface, posing a significant risk of account compromise.

Vulnerability Details

CVE-ID: CVE-2026-5231

Affected Software: Veronalabs WP Statistics

Affected Versions: 0 through 14.16.4

Vulnerability: This is a stored Cross-Site Scripting (XSS) vulnerability caused by improper input sanitization and output escaping in the referral parser. Unauthenticated attackers can inject malicious scripts into the source_name field, which then execute when an administrator views the Referrals Overview or Social Media analytics pages.

Business Impact

The ability for an unauthenticated attacker to execute arbitrary scripts in the context of an administrator's browser can lead to full site compromise, unauthorized configuration changes, and the theft of administrative session cookies. With a CVSS score of 7.2, this vulnerability is classified as High severity, as it facilitates unauthorized control over the WordPress environment and potentially sensitive analytical data.

Remediation Plan

Immediate Action: Update the WP Statistics plugin to version 14.16.5 or higher to ensure the input sanitization and output escaping fixes are applied.

Proactive Monitoring: Monitor administrative access logs for unusual login patterns or unauthorized changes to plugin settings and site configuration.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block malicious patterns in URL parameters, specifically targeting the utm_source field.

Exploitation Status

Public Exploit Available: No (exploit_available unknown).

Analyst Notes: As of April 18, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the lack of required authentication for triggering the malicious payload.

Analyst Recommendation

This vulnerability presents a high risk to WordPress installations due to the ease of exploitation via unauthenticated network access. Administrators should prioritize updating the WP Statistics plugin immediately to prevent potential script execution within their administrative dashboards. Failure to patch allows attackers to potentially escalate privileges or steal sensitive session data, making rapid remediation essential.

---METADATA---
VENDOR: Form Notify
PRODUCT: Form Notify Plugin for WordPress
AFFECTED_VERSIONS: Up to and including 1.1.10
---END_METADATA---

Description Summary:
The Form Notify plugin for WordPress suffers from an authentication bypass vulnerability due to improper verification of user-controlled cookie data during LINE OAuth login.

Executive Summary:
An authentication bypass vulnerability in the Form Notify plugin for WordPress allows unauthenticated attackers to hijack any user account, including administrator accounts.

Vulnerability Details

CVE-ID: CVE-2026-5229

Affected Software: Form Notify, Form Notify Plugin for WordPress

Affected Versions: Up to and including 1.1.10

Vulnerability: This vulnerability occurs because the plugin trusts user-supplied cookie data to determine account identity during LINE OAuth flows. Unauthenticated attackers can manipulate the 'form_notify_line_email' cookie to impersonate any legitimate user.

Business Impact

The ability for an unauthenticated attacker to gain administrative access poses a critical risk to data integrity, confidentiality, and system availability. With a CVSS score of 9.8, this flaw represents a total compromise of the WordPress environment, potentially leading to unauthorized data exfiltration and complete site takeover.

Remediation Plan

Immediate Action: Update the Form Notify plugin to the latest available version provided by the vendor.

Proactive Monitoring: Review web server access logs for anomalous authentication requests or irregular patterns associated with the LINE OAuth login flow.

Compensating Controls: Implement a Web Application Firewall (WAF) to block suspicious cookie modifications or unauthorized attempts to manipulate authentication parameters.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 15, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS severity of 9.8 and the ease of exploitation, immediate patching is required. Administrators should verify their current version and update the Form Notify plugin immediately to prevent unauthorized administrative access.

---METADATA---
VENDOR: Kurt Software Studio
PRODUCT: WriteUp Mobile App
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
The Kurt Software Studio WriteUp Mobile App contains an improper access control vulnerability that allows unauthorized users to access restricted application functionality.

Executive Summary:
An improper access control flaw in the Kurt Software Studio WriteUp Mobile App poses a critical risk by allowing unauthorized access to protected application functions.

Vulnerability Details

CVE-ID: CVE-2026-5228

Affected Software: Kurt Software Studio, WriteUp Mobile App

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: The application suffers from missing authorization checks, meaning that certain functions are not properly constrained by Access Control Lists (ACLs). This allows authenticated or potentially unauthenticated users to interact with features they should not have permissions to access.

Business Impact

This vulnerability creates a significant risk of unauthorized data access and potential manipulation of application logic. With a CVSS score of 8.8, this flaw could be leveraged to bypass security boundaries, leading to unauthorized disclosure of sensitive information or the performance of administrative actions by unauthorized parties.

Remediation Plan

Immediate Action: Check for and apply the latest security updates provided by Kurt Software Studio to ensure proper authorization enforcement.

Proactive Monitoring: Audit application activity logs to identify instances where users are accessing features that fall outside their defined roles or privilege levels.

Compensating Controls: If a patch is unavailable, restrict network access to the mobile backend services and ensure that API endpoints are secured by robust server-side authentication and authorization checks.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of June 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Authorization vulnerabilities are high-impact issues that require immediate attention. Security teams should verify their current version status and apply the latest vendor patches to ensure that all internal access control mechanisms are functioning as intended.

---METADATA---
VENDOR: MCMS
PRODUCT: MCMS
AFFECTED_VERSIONS: v.6.1.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A vulnerability in MCMS v.6.1.1 allows remote, unauthenticated attackers to retrieve sensitive information by manipulating the source parameter.

Executive Summary:
A high-severity information disclosure vulnerability in MCMS v.6.1.1 allows unauthenticated remote attackers to access sensitive data.

Vulnerability Details

CVE-ID: CVE-2026-52203

Affected Software: MCMS

Affected Versions: v.6.1.1

Vulnerability: The application is susceptible to sensitive information disclosure due to improper validation of the source parameter. This vulnerability is remotely exploitable by an unauthenticated attacker without requiring user interaction.

Business Impact

With a CVSS score of 7.5, this vulnerability represents a significant risk to data confidentiality. Unauthorized access to sensitive information can lead to severe reputational damage, regulatory non-compliance, and the exposure of proprietary or private user data stored within the system.

Remediation Plan

Immediate Action: Since no specific patch version is currently identified, verify with the vendor for the latest security release and apply it immediately.

Proactive Monitoring: Monitor server logs for suspicious requests involving the source parameter that appear to be attempting to traverse directories or access unauthorized files.

Compensating Controls: Implement input validation rules at the network perimeter or via a WAF to restrict or sanitize the source parameter, preventing unauthorized data retrieval attempts.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 16, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Per CISA's SSVC assessment, there is no confirmed active exploitation.

Analyst Recommendation

Organizations utilizing MCMS v.6.1.1 should treat this as a high-priority item. In the absence of a confirmed patch, users should restrict network access to the application to trusted sources only and monitor for any attempts to probe the source parameter.

---METADATA---
VENDOR: Generic OEM
PRODUCT: UZ801_v2.1 4G LTE Router
AFFECTED_VERSIONS: V3.4.3
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://github.com/lamaper/CVE-2026-52199","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
A critical vulnerability in the UZ801_v2.1 4G LTE Router allows remote, unauthenticated attackers to execute arbitrary code via the sbin/adbd component.

Executive Summary:
A critical remote code execution vulnerability in Generic OEM UZ801 4G LTE routers poses a significant risk to network integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-52199

Affected Software: Generic OEM UZ801_v2.1 4G LTE Router

Affected Versions: V3.4.3

Vulnerability: The flaw exists within the sbin/adbd component, which fails to properly validate requests. An unauthenticated remote attacker can leverage this weakness to achieve arbitrary code execution on the device.

Business Impact

The ability for an unauthenticated attacker to execute arbitrary code on a network routing device represents a critical security failure. Successful exploitation could lead to full system compromise, allowing attackers to intercept network traffic, pivot into internal segments, or establish persistent backdoors, resulting in severe data loss and operational disruption. The high CVSS score of 9.1 reflects the ease of exploitation over a network without requiring authentication.

Remediation Plan

Immediate Action: Since a vendor patch is currently unavailable, administrators should immediately restrict access to the device management interface by placing it behind a firewall or VPN, and disable remote access features if they are not strictly required for business operations.

Proactive Monitoring: Monitor device logs for anomalous entries related to the sbin/adbd process and audit network traffic for unexpected command and control patterns originating from the router.

Compensating Controls: Deploy strict egress and ingress filtering to prevent unauthorized external connections to the router management interface, and utilize a Web Application Firewall or similar inspection tool to detect malicious payloads targeting the device.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the linked research repository.

Analyst Notes: As of July 20, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The nature of the vulnerable sbin/adbd component makes this device highly susceptible to remote exploitation given the lack of required authentication.

Analyst Recommendation

Given the critical nature of this vulnerability and the existence of a public proof-of-concept, organizations using the affected Generic OEM hardware must treat this as a high priority. Until a firmware update is released, the device must be isolated from the public internet to prevent potential remote exploitation. Security teams should prioritize replacing or decommissioning these units if vendor support and patching are not forthcoming.

---METADATA---
VENDOR: Softtr Information
PRODUCT: E-Commerce Pack
AFFECTED_VERSIONS: 0 through 30072026
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A Cross-Site Request Forgery (CSRF) vulnerability exists in Softtr Information E-Commerce Pack, allowing unauthorized actions on behalf of a victim.

Executive Summary:
A high-severity Cross-Site Request Forgery vulnerability in the Softtr Information E-Commerce Pack could allow an unauthenticated attacker to perform unauthorized actions on behalf of a user.

Vulnerability Details

CVE-ID: CVE-2026-5219

Affected Software: Softtr Information E-Commerce Pack

Affected Versions: 0 through 30072026

Vulnerability: This is a Cross-Site Request Forgery (CSRF) vulnerability (CWE-352) where an unauthenticated attacker can trick a legitimate user into executing unwanted actions. The vulnerability relies on the victim interacting with a malicious site while authenticated to the target application.

Business Impact

The vulnerability carries a CVSS score of 8.3, indicating a high risk of significant impact. Successful exploitation could lead to unauthorized administrative actions, data modification, or account compromise, potentially resulting in severe operational disruption and reputational damage.

Remediation Plan

Immediate Action: Update the Softtr Information E-Commerce Pack to the version containing the security fix as specified in the official vendor advisory.

Proactive Monitoring: Review web server and application access logs for suspicious patterns or unexpected state-changing requests originating from external referrers.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and validate request headers and enforce CSRF protection tokens for all sensitive endpoints.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 31, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. CSRF flaws are inherently dependent on social engineering or malicious cross-site scripts to execute, increasing the importance of user awareness and browser security policies.

Analyst Recommendation

Given the high CVSS score and the potential for unauthorized state changes, it is critical to prioritize this update. Administrators should verify their current deployment version against the vendor documentation and apply the recommended patch immediately to prevent potential account or system takeover.

---METADATA---
VENDOR: Optimole
PRODUCT: Optimole – Optimize Images in Real Time
AFFECTED_VERSIONS: 0 through 4.2.2
CONFIDENCE: high
MISSING: none
CREDITS: Quốc Huy (finder)
SOURCES_JSON: [{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/50417068-339a-4ae5-9c90-8f08f54ce0af?source=cve","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/optimole-wp/trunk/inc/rest.php#L159","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/optimole-wp/trunk/inc/rest.php#L1008","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/optimole-wp/trunk/inc/tag_replacer.php#L526","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.1/inc/tag_replacer.php#L526","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.1/inc/rest.php#L1008","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.1/inc/rest.php#L159","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.883Z
---END_METADATA---

Description Summary:
The Optimole WordPress plugin is vulnerable to unauthenticated Stored Cross-Site Scripting via the s parameter in the REST API, allowing attackers to inject arbitrary web scripts into pages.

Executive Summary:
A critical Stored Cross-Site Scripting vulnerability in the Optimole WordPress plugin allows unauthenticated attackers to execute malicious scripts in the context of site visitors.

Vulnerability Details

CVE-ID: CVE-2026-5217

Affected Software: Optimole Optimole – Optimize Images in Real Time

Affected Versions: 0 through 4.2.2

Vulnerability: The vulnerability exists due to insufficient input sanitization and output escaping on the s parameter within the REST endpoint. An unauthenticated attacker can bypass HMAC protection and inject malicious payloads into the WordPress options table, which are subsequently rendered in the browser of any visitor.

Business Impact

The exploitation of this vulnerability allows for unauthorized script execution on behalf of site users, which can lead to session hijacking, credential theft, or the distribution of malicious content. With a CVSS score of 7.2, the risk is classified as High, as it permits attackers to compromise the integrity of the user experience and potentially gain administrative access through session manipulation.

Remediation Plan

Immediate Action: Update the Optimole plugin to the latest available version beyond 4.2.2 immediately to ensure the input sanitization and output escaping flaws are resolved.

Proactive Monitoring: Monitor site traffic for unusual requests directed at the /wp-json/optimole/v1/optimizations endpoint and inspect page source code for unexpected JavaScript injections.

Compensating Controls: Deploy a Web Application Firewall with rules configured to block suspicious input patterns in REST API parameters to mitigate the risk of exploit attempts.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of April 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is considered inherently exploitable due to the bypassable authentication mechanism and the lack of proper output encoding in the affected plugin components.

Analyst Recommendation

This vulnerability presents a significant risk to site security, particularly because it can be triggered by unauthenticated actors without requiring administrative interaction. Administrators should prioritize updating the Optimole plugin immediately to remove the vulnerable code path and prevent potential cross-site scripting attacks that could compromise site users.

---METADATA---
VENDOR: D-Link
PRODUCT: NAS (Network Attached Storage)
AFFECTED_VERSIONS: Firmware up to 20260205
CONFIDENCE: high
MISSING: patch
CREDITS: Ziyue Xie (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/354349","name":"VDB-354349 | D-Link DNS-1550-04 account_mgr.cgi cgi_addgroup_get_group_quota_minsize stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/354349/cti","name":"VDB-354349 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/780439","name":"Submit #780439 | D-Link DNS-120/202L/315L/320/320L/320LW/321/322L/323/325/326/327L/326/340L/343/345/726-4/1100-4/1200-05","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_169/169.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.323Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in D-Link NAS devices allows remote authenticated attackers to execute arbitrary code via the name parameter in the cgi_addgroup_get_group_quota_minsize function.

Executive Summary:
A stack-based buffer overflow vulnerability in multiple D-Link NAS devices poses a high risk of remote code execution for authenticated users.

Vulnerability Details

CVE-ID: CVE-2026-5214

Affected Software: D-Link NAS Devices (including DNS-120, DNS-320, DNS-320L, and others)

Affected Versions: Firmware up to 20260205

Vulnerability: The vulnerability exists in the cgi_addgroup_get_group_quota_minsize function within the account_mgr.cgi script. An attacker with low-level privileges can provide a maliciously crafted name parameter that overflows the stack, potentially leading to remote code execution.

Business Impact

Successful exploitation of this vulnerability allows an attacker to achieve full control over the affected NAS device. This could lead to the complete compromise of stored data, unauthorized access to network resources, and total loss of device availability. Given the CVSS score of 8.8, this represents a significant threat to internal data integrity and system reliability.

Remediation Plan

Immediate Action: There is currently no vendor-provided patch. Administrators should immediately restrict access to the web management interface to trusted internal networks only and disable remote management features.

Proactive Monitoring: Monitor system logs for unusual POST requests directed at cgi-bin/account_mgr.cgi, particularly those containing abnormally long strings in the name parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect incoming traffic and block requests containing oversized parameters aimed at the account_mgr.cgi endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the researcher write-up linked in the CVE references.

Analyst Notes: As of April 2, 2026, there is no confirmed active exploitation in the wild: however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable because the software fails to perform boundary checks on user-supplied input before copying it to a local stack variable.

Analyst Recommendation

Given the severity of this remote code execution flaw and the availability of public proof-of-concept code, this issue must be treated as a high priority. Until D-Link releases a firmware update, organizations must implement strict network segmentation to isolate affected NAS units from untrusted networks and monitor all management traffic for signs of attempted exploitation.

---METADATA---
VENDOR: MZ Automation
PRODUCT: libiec61850
AFFECTED_VERSIONS: v1.6
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://github.com/mz-automation/libiec61850","name":null,"tags":[]},{"url":"https://github.com/mz-automation/libiec61850/tree/v1.6/src/goose/goose_receiver.c","name":null,"tags":[]},{"url":"https://github.com/if-forget/CVE-2026-52134-libiec61850","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
The libiec61850 library contains an authentication bypass vulnerability in the parseGoosePayload function that allows unauthenticated attackers to manipulate GOOSE frames.

Executive Summary:
A critical authentication bypass vulnerability in libiec61850 version 1.6 allows unauthenticated attackers to achieve full control over GOOSE frame processing, posing a severe risk to industrial control systems.

Vulnerability Details

CVE-ID: CVE-2026-52134

Affected Software: MZ Automation libiec61850

Affected Versions: v1.6

Vulnerability: This vulnerability exists in the parseGoosePayload function within the goose_receiver.c source file, where insufficient validation of GOOSE frames enables unauthenticated attackers to bypass security controls.

Business Impact

With a CVSS score of 9.8, this vulnerability represents a critical risk to operational technology environments. Successful exploitation allows an attacker to intercept and manipulate industrial communication traffic, potentially resulting in unauthorized command execution, process disruption, or complete compromise of the affected control system.

Remediation Plan

Immediate Action: Monitor official repository releases from MZ Automation for a security patch addressing this flaw in the parseGoosePayload function.

Proactive Monitoring: Implement network intrusion detection systems to monitor for anomalous GOOSE frame traffic patterns and unauthorized access attempts to industrial control interfaces.

Compensating Controls: Restrict network access to devices utilizing libiec61850 to trusted segments only, ensuring that industrial control communication is isolated from public or untrusted networks.

Exploitation Status

Public Exploit Available: Yes, a public proof of concept is available via the GitHub repository referenced in the enrichment data.

Analyst Notes: As of August 26, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof of concept exists, so exploitation risk should be treated as credible. The presence of a public repository containing exploit code increases the likelihood of opportunistic attacks against exposed industrial infrastructure.

Analyst Recommendation

Given the critical severity of this vulnerability and the availability of a public proof of concept, immediate attention is required. Administrators should isolate vulnerable systems from external networks and prepare to apply the vendor patch as soon as it becomes available to prevent potential unauthorized manipulation of critical control processes.

---METADATA---
VENDOR: ggml-org
PRODUCT: llama.cpp
AFFECTED_VERSIONS: b5693 and before
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-03T14:04:09.947Z
SOURCES_JSON: [{"url":"https://github.com/ggml-org/llama.cpp","name":null,"tags":[]},{"url":"https://blog.ph4nt0m.xyz/ko/cves/cve-2026-52130/","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
llama.cpp versions b5693 and earlier are susceptible to a reachable assertion error within the gguf_reader::read function, potentially leading to instability or denial of service.

Executive Summary:
A reachable assertion in the gguf_reader::read function of llama.cpp versions b5693 and prior poses a high-severity risk to system stability via unauthenticated input.

Vulnerability Details

CVE-ID: CVE-2026-52131

Affected Software: ggml-org llama.cpp

Affected Versions: b5693 and before

Vulnerability: The vulnerability is a reachable assertion error in the gguf_reader::read function. An unauthenticated attacker can trigger this condition through specially crafted input, which causes the application to terminate unexpectedly.

Business Impact

Successful exploitation of this vulnerability results in a denial of service, as the application will reach an assertion failure and crash. Given the CVSS score of 7.5, this high-severity flaw could lead to significant operational disruption for environments relying on llama.cpp for machine learning inference tasks. The lack of required authentication makes this particularly concerning for internet-exposed instances.

Remediation Plan

Immediate Action: Monitor the official GitHub repository for the release of a patched version of llama.cpp that addresses the assertion failure in the gguf_reader::read function.

Proactive Monitoring: Review application logs and system error reports for frequent crashes or assertion failure messages associated with GGUF file processing.

Compensating Controls: Restrict access to services utilizing llama.cpp to trusted networks or internal users, and implement input validation layers to sanitize GGUF files before they are processed by the reader.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of September 2, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any actor capable of providing a malformed GGUF file to the application.

Analyst Recommendation

Organizations should treat this vulnerability with high priority due to the ease of remote exploitation. While a specific patch version is currently pending, administrators should prepare for an immediate update once the vendor releases a fix. In the interim, strictly control the source of GGUF files to prevent malicious payloads from triggering the assertion failure.

---METADATA---
VENDOR: D-Link
PRODUCT: DNS and DNR Network Attached Storage (NAS) devices
AFFECTED_VERSIONS: Up to and including 20260205
CONFIDENCE: high
MISSING: patch
CREDITS: Ziyue Xie (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/354350","name":"VDB-354350 | D-Link DNS-1550-04 account_mgr.cgi cgi_adduser_to_session stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/354350/cti","name":"VDB-354350 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/780437","name":"Submit #780437 | D-Link DNS-120/202L/315L/320/320L/320LW/321/322L/323/325/326/327L/326/340L/343/345/726-4/1100-4/1200-05","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_168/168.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.323Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the cgi_adduser_to_session function of /cgi-bin/account_mgr.cgi allows remote authenticated attackers to execute arbitrary code via the read_list parameter.

Executive Summary:
A critical stack-based buffer overflow in various D-Link NAS devices allows remote authenticated attackers to compromise system integrity or cause a denial of service.

Vulnerability Details

CVE-ID: CVE-2026-5213

Affected Software: D-Link DNS and DNR series NAS devices

Affected Versions: All versions up to and including 20260205

Vulnerability: The vulnerability exists in the cgi_adduser_to_session function within the account_mgr.cgi binary, which fails to perform boundary checks on the read_list, write_list, and decline_list parameters. An authenticated attacker can trigger a stack-based buffer overflow by sending a specially crafted HTTP POST request, potentially resulting in remote code execution.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the affected NAS hardware with elevated privileges. This poses a severe risk of data exfiltration, unauthorized access to stored files, or total system compromise. Given the high CVSS score of 8.8, this vulnerability represents a significant threat to operational continuity and data confidentiality.

Remediation Plan

Immediate Action: There is currently no official patch available from the vendor. Users should restrict administrative access to these devices to trusted internal networks only and disable remote management interfaces if they are exposed to the public internet.

Proactive Monitoring: Monitor network traffic and web server access logs for anomalous HTTP POST requests directed at /cgi-bin/account_mgr.cgi, particularly those containing abnormally long strings in the specified parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) with rules designed to detect and block oversized input strings directed at the vulnerable account_mgr.cgi endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the researcher's technical write-up on GitHub.

Analyst Notes: As of April 2, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it requires no complex bypasses once the attacker has authenticated.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention, even in the absence of a vendor-supplied patch. Administrators must prioritize isolating these devices from external networks to prevent remote exploitation. Once D-Link releases a firmware update, it should be tested and deployed across all affected units as a matter of urgency to mitigate the risk of arbitrary code execution.

---METADATA---
VENDOR: D-Link
PRODUCT: NAS devices (various models)
AFFECTED_VERSIONS: Firmware up to 20260205
CONFIDENCE: high
MISSING: patch
CREDITS: Ziyue Xie (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/354348","name":"VDB-354348 | D-Link DNS-1550-04 webdav_mgr.cgi Webdav_Upload_File stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/354348/cti","name":"VDB-354348 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/780435","name":"Submit #780435 | D-Link DNS-120/202L/315L/320/320L/320LW/321/322L/323/325/326/327L/326/340L/343/345/726-4/1100-4/1200-05","tags":["third-party-advisory"]},{"url":"https://vuldb.com/submit/780436","name":"Submit #780436 | D-Link DNS-120/202L/315L/320/320L/320LW/321/322L/323/325/326/327L/326/340L/343/345/726-4/1100-4/1200-05","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_166/166.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.323Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Webdav_Upload_File function of the webdav_mgr.cgi script allows remote authenticated attackers to execute arbitrary code via the f_file parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability in multiple D-Link NAS devices allows authenticated attackers to achieve remote code execution, posing a significant risk to data integrity.

Vulnerability Details

CVE-ID: CVE-2026-5212

Affected Software: D-Link NAS devices (DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05, and DNS-1550-04)

Affected Versions: Firmware versions up to 20260205

Vulnerability: The vulnerability exists within the Webdav_Upload_File function of the webdav_mgr.cgi binary, where improper handling of the f_file argument leads to a stack-based buffer overflow. This flaw requires the attacker to have low-level privileges (authenticated user) to trigger the overflow and potentially execute arbitrary code.

Business Impact

Successful exploitation of this vulnerability allows an authenticated attacker to execute arbitrary code on the affected NAS device. This could lead to a total compromise of stored data, unauthorized access to sensitive files, or permanent denial of service by crashing the device. With a CVSS score of 8.8, this vulnerability represents a high-severity risk that demands prompt attention to prevent lateral movement or data theft within the network.

Remediation Plan

Immediate Action: Check the official D-Link support portal for firmware updates addressing this vulnerability, and apply them immediately to all affected NAS units. If no patch is currently available for your specific model, restrict management interface access to trusted network segments only.

Proactive Monitoring: Review system logs for unusual POST requests directed at /cgi-bin/webdav_mgr.cgi, particularly those containing excessively long filename parameters. Monitor NAS devices for unexpected service interruptions or frequent crashes.

Compensating Controls: Implement a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) to inspect and block malicious multipart/form-data payloads targeting the webdav_mgr.cgi endpoint. Restrict access to the web management interface to authorized administrative IP addresses via firewall rules.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept is documented in the research write-up referenced by the CVE record.

Analyst Notes: As of April 2, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the lack of input validation on the filename parameter, which allows for direct memory corruption.

Analyst Recommendation

Given the availability of a public proof-of-concept and the potential for remote code execution, this vulnerability poses a significant risk to your storage infrastructure. Administrators should prioritize identifying all vulnerable D-Link devices within their environment and apply vendor-supplied firmware updates as soon as they are released. Until updates are applied, minimize the attack surface by isolating vulnerable devices from public-facing networks.

---METADATA---
VENDOR: D-Link
PRODUCT: DNS and DNR Network Attached Storage (NAS) devices
AFFECTED_VERSIONS: Up to 20260205
CONFIDENCE: high
MISSING: patch
CREDITS: Ziyue Xie (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/354347","name":"VDB-354347 | D-Link DNS-1550-04 app_mgr.cgi UPnP_AV_Server_Path_Del stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/354347/cti","name":"VDB-354347 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/780434","name":"Submit #780434 | D-Link DNS-120/202L/315L/320/320L/320LW/321/322L/323/325/326/327L/326/340L/343/345/726-4/1100-4/1200-05","tags":["third-party-advisory"]},{"url":"https://github.com/wudipjq/my_vuln/blob/main/D-Link8/vuln_165/165.md","name":null,"tags":["exploit"]},{"url":"https://www.dlink.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.323Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the UPnP_AV_Server_Path_Del function of the app_mgr.cgi binary allows remote attackers to cause a crash or potentially execute arbitrary code via the f_dir parameter.

Executive Summary:
A critical stack-based buffer overflow vulnerability in multiple D-Link NAS devices, identified as CVE-2026-5211, exposes affected systems to remote code execution and service disruption.

Vulnerability Details

CVE-ID: CVE-2026-5211

Affected Software: D-Link DNS and DNR series NAS devices (including DNS-120, DNS-320, DNS-320L, DNS-320LW, DNS-315L, and DNR-202L)

Affected Versions: All firmware versions up to 20260205

Vulnerability: This is a stack-based buffer overflow vulnerability occurring in the /cgi-bin/app_mgr.cgi endpoint. The function UPnP_AV_Server_Path_Del fails to perform adequate bounds checking on the f_dir parameter, allowing a low-privileged authenticated attacker to overwrite the return address and potentially achieve remote code execution.

Business Impact

The vulnerability poses a severe risk to data integrity and system availability. Successful exploitation allows an attacker to crash the storage device, leading to service downtime, or execute arbitrary code to gain unauthorized control over the NAS. With a CVSS score of 8.8, this flaw is considered high-risk, as it directly impacts the confidentiality, integrity, and availability of stored data.

Remediation Plan

Immediate Action: Check the D-Link support portal for firmware updates addressing this flaw; if no patch is available for your specific model, restrict management interface access to trusted networks only.

Proactive Monitoring: Review system and access logs for unusual POST requests targeting /cgi-bin/app_mgr.cgi, specifically monitoring for abnormally long f_dir parameter strings.

Compensating Controls: Implement a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) to filter and block malicious traffic containing oversized f_dir parameters in HTTP requests.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists as detailed in the researcher's technical write-up linked in the CVE record.

Analyst Notes: As of April 2, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable as it stems from a lack of input validation on a direct user-controlled parameter.

Analyst Recommendation

Given the availability of a published proof-of-concept and the potential for remote code execution, this vulnerability represents a significant threat. Administrators should prioritize identifying affected hardware within their environment and apply vendor-supplied firmware updates as soon as they become available. In the interim, isolating these storage devices from the internet is a necessary step to mitigate the risk of unauthorized access.

---METADATA---
VENDOR: OpenMediaVault
PRODUCT: openmediavault-md
AFFECTED_VERSIONS: 8.0.4-1
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://github.com/openmediavault/openmediavault","name":null,"tags":[]},{"url":"https://www.openmediavault.org","name":null,"tags":[]},{"url":"https://gist.github.com/NtGabrielGomes/46817d363821cf8c5ff4882c811a4325","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
An OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows unauthenticated attackers to execute arbitrary commands as root via shell metacharacter injection.

Executive Summary:
A critical OS command injection vulnerability in the OpenMediaVault openmediavault-md plugin enables unauthenticated remote attackers to gain full root-level control over the host system.

Vulnerability Details

CVE-ID: CVE-2026-52102

Affected Software: OpenMediaVault openmediavault-md

Affected Versions: 8.0.4-1

Vulnerability: This vulnerability is an OS command injection flaw located within the openmediavault-md plugin. It allows an unauthenticated attacker to inject shell metacharacters, leading to arbitrary code execution with root privileges.

Business Impact

The potential for unauthenticated remote code execution with root privileges represents the highest level of security risk to the organization. A successful exploit would allow an attacker to compromise the entire storage system, exfiltrate sensitive data, or deploy malicious payloads, resulting in total system compromise. Given the CVSS score of 9.8, this vulnerability must be treated as an immediate, mission-critical priority.

Remediation Plan

Immediate Action: Until an official security patch is released by the vendor, administrators should disable or uninstall the openmediavault-md plugin to remove the vulnerable attack vector.

Proactive Monitoring: Monitor system logs for unusual process executions, specifically looking for shell-related commands or unexpected activity originating from the plugin directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) or intrusion prevention system configured to block requests containing common shell metacharacters, though this should be considered a temporary measure until the plugin is removed or patched.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the technical write-up provided in the vulnerability references.

Analyst Notes: As of August 26, 2026, there is no public information indicating active exploitation in the wild. However, the presence of a public proof-of-concept makes the risk of exploitation highly credible. The design of the vulnerability makes it inherently easy to weaponize, as it allows for direct command injection without requiring authentication.

Analyst Recommendation

Due to the critical nature of this vulnerability and the availability of a public proof-of-concept, immediate action is required. Organizations should identify and disable the affected openmediavault-md plugin across all deployments to prevent unauthorized root access. Monitor official vendor channels for the release of a security update and verify the environment against any signs of prior unauthorized access.

---METADATA---
VENDOR: andreimarcu
PRODUCT: linx-server
AFFECTED_VERSIONS: 1.0 through 2.3.8
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://github.com/andreimarcu/linx-server","name":null,"tags":[]},{"url":"https://github.com/nk7667/-linx-server-vulnerability-report/blob/main/CVE-2026-52101.md","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
A vulnerability in andreimarcu linx-server versions 1.0 through 2.3.8 allows remote unauthenticated attackers to access sensitive information via the uploadRemote function.

Executive Summary:
A critical information disclosure vulnerability in the linx-server application allows unauthenticated remote attackers to access sensitive data, posing a severe risk to system confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-52101

Affected Software: andreimarcu linx-server

Affected Versions: 1.0 through 2.3.8

Vulnerability: This flaw exists within the uploadRemote function found in upload.go, which fails to properly restrict access to sensitive file operations. The vulnerability is exploitable by an unauthenticated remote attacker with no user interaction required.

Business Impact

The exploitation of this vulnerability could lead to the unauthorized exposure of sensitive files or system data stored on the server. Given the CVSS score of 9.1, this is classified as a critical risk that could result in significant data breaches, loss of intellectual property, and potential regulatory non-compliance for organizations hosting the software.

Remediation Plan

Immediate Action: Administrators should immediately restrict network access to the linx-server instance or disable the vulnerable upload functionality until a formal vendor patch is applied.

Proactive Monitoring: Review web server access logs for anomalous requests directed at the upload endpoint, specifically monitoring for unusual patterns or unexpected POST requests to the uploadRemote function.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block unauthorized requests targeting the upload.go file, providing a virtual patch until the underlying code is remediated.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the vulnerability report linked by the CVE record.

Analyst Notes: As of July 15, 2026, there is no confirmed active exploitation in the wild, however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly accessible due to the lack of required authentication.

Analyst Recommendation

Due to the critical severity and the existence of a public proof-of-concept, organizations running linx-server must treat this as a high priority. We recommend isolating affected instances from public-facing networks immediately and applying the upstream fix commit 9a5fc11dffe5d2ac6cb6e7edfa97bccd417285ed if a vendor-provided update is not yet available.

---METADATA---
VENDOR: andreimarcu
PRODUCT: linx-server
AFFECTED_VERSIONS: v.1.0 through v.2.3.8
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://github.com/andreimarcu/linx-server","name":null,"tags":[]},{"url":"https://github.com/nk7667/-linx-server-vulnerability-report/blob/main/CVE-2026-52100.md","name":null,"tags":[]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:18:08.850Z
---END_METADATA---

Description Summary:
A cross site request forgery vulnerability in andreimarcu linx-server versions 1.0 through 2.3.8 enables remote attackers to execute arbitrary code via the uploadPutHandler function.

Executive Summary:
A cross site request forgery vulnerability in andreimarcu linx-server versions 1.0 through 2.3.8 allows remote attackers to execute arbitrary code, creating significant risk for host environments.

Vulnerability Details

CVE-ID: CVE-2026-52100

Affected Software: andreimarcu linx-server

Affected Versions: v.1.0 through v.2.3.8

Vulnerability: This flaw is a cross site request forgery vulnerability involving the uploadPutHandler function, which can be triggered by a remote attacker with no privileges required and no user interaction.

Business Impact

A successful exploit could allow attackers to execute arbitrary code on the underlying host system, leading to full system compromise, unauthorized data modification, or service disruption. With a CVSS score of 7.5, this high severity issue threatens business operations and data integrity by exposing server infrastructure to remote manipulation.

Remediation Plan

Immediate Action: Update linx-server to a version beyond 2.3.8 or apply the upstream fix commit 9a5fc11dffe5d2ac6cb6e7edfa97bccd417285ed if an official release is unavailable.

Proactive Monitoring: Monitor server access logs and HTTP request patterns targeting the uploadPutHandler endpoint for suspicious cross site request activity.

Compensating Controls: Deploy a Web Application Firewall to inspect inbound requests and enforce strict anti forgery tokens on sensitive server endpoints.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub via the referenced vulnerability report.

Analyst Notes: As of Jul 13, 2026, there is no confirmed active exploitation in the wild, however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The network attack vector and lack of required authentication or user interaction make this flaw straightforward to target.

Analyst Recommendation

Linx-server administrators must treat this high severity flaw with urgency due to the availability of public proof-of-concept material and the potential for arbitrary code execution. Apply the available fix commit or update the software immediately to prevent unauthorized system access.

---METADATA---
VENDOR: SourceCodester
PRODUCT: Leave Application System
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
CREDITS: Hemant Raj Bhati (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/354346","name":"VDB-354346 | SourceCodester Leave Application System file inclusion","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/354346/cti","name":"VDB-354346 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/780419","name":"Submit #780419 | SourceCodester Leave Application System in PHP and SQLite3 1.0 Local File Inclusion","tags":["third-party-advisory"]},{"url":"https://medium.com/@hemantrajbhati5555/local-file-inclusion-lfi-in-leave-application-system-php-sqlite3-4e095bb7ee40","name":null,"tags":["broken-link","exploit"]},{"url":"https://www.sourcecodester.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.167Z
---END_METADATA---

Description Summary:
SourceCodester Leave Application System 1.0 is susceptible to a file inclusion vulnerability via argument manipulation, allowing remote attackers to potentially access sensitive system files.

Executive Summary:
A file inclusion vulnerability in SourceCodester Leave Application System 1.0 poses a significant risk of unauthorized file access and remote exploitation.

Vulnerability Details

CVE-ID: CVE-2026-5210

Affected Software: SourceCodester Leave Application System

Affected Versions: 1.0

Vulnerability: The application is affected by a file inclusion flaw (CWE-73) that can be triggered by manipulating the page argument. The CVSS vector indicates that this vulnerability is exploitable by an unauthenticated attacker over the network without requiring user interaction.

Business Impact

Successful exploitation of this flaw allows an attacker to read arbitrary files from the server, which may lead to the exposure of configuration details, sensitive credentials, or internal source code. Given the CVSS score of 7.3, this is a high-severity issue that could facilitate further system compromise or data exfiltration, directly impacting the confidentiality and integrity of the hosting environment.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the application via network-level controls or take the system offline if it is exposed to the public internet.

Proactive Monitoring: Review web server access logs for anomalous requests containing directory traversal patterns or unusual file path inclusions targeting the page parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to inspect and block requests that attempt to pass file paths or traversal sequences through the page argument.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided in the referenced security report.

Analyst Notes: As of April 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows unauthenticated remote attackers to manipulate file paths, providing a clear path to information disclosure.

Analyst Recommendation

Due to the availability of a public proof-of-concept and the ease of remote exploitation, this vulnerability should be treated with high priority. Organizations using SourceCodester Leave Application System 1.0 must implement strict input validation and access controls immediately to mitigate the risk of unauthorized file access until an official vendor patch is released.

---METADATA---
VENDOR: CoolerControl
PRODUCT: coolercontrold
AFFECTED_VERSIONS: 3.1.0 up to (excluding) 4.0.0
CONFIDENCE: high
MISSING: none
CREDITS: https://gitlab.com/lassi-3 (finder)
SOURCES_JSON: [{"url":"https://gitlab.com/coolercontrol/coolercontrol/-/blob/3.1.0/coolercontrold/src/alerts.rs?ref_type=tags#L576","name":null,"tags":[]},{"url":"https://gitlab.com/coolercontrol/coolercontrol/-/releases/4.0.0","name":null,"tags":[]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.947Z
---END_METADATA---

Description Summary:
A command injection vulnerability in CoolerControl coolercontrold allows authenticated attackers to execute arbitrary code as root via crafted alert names.

Executive Summary:
A critical command injection vulnerability in coolercontrold allows authenticated users to achieve root-level code execution, posing a severe risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-5208

Affected Software: CoolerControl coolercontrold

Affected Versions: 3.1.0 up to (excluding) 4.0.0

Vulnerability: This is an OS Command Injection (CWE-78) vulnerability occurring within the alert processing functionality. Authenticated attackers with high privileges can inject malicious bash commands into alert names, which are then executed by the system with root-level permissions.

Business Impact

The ability for an attacker to execute arbitrary commands as root grants them total control over the host system. Successful exploitation could lead to full system compromise, unauthorized data access, and persistent backdoors. Given the CVSS score of 8.2, this vulnerability is classified as high severity, reflecting the significant impact on confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Upgrade to version 4.0.0 or later to apply the necessary input sanitization fixes provided by the vendor.

Proactive Monitoring: Review system access logs for suspicious alert configurations and monitor for unexpected process execution triggered by the coolercontrold service.

Compensating Controls: Restrict administrative access to the coolercontrold configuration interface to only trusted users, and implement host-based intrusion detection systems to monitor for unauthorized command execution.

Exploitation Status

Public Exploit Available: No (exploit_available: false).

Analyst Notes: As of April 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's inherent exploitability is high for authenticated attackers, as the lack of input neutralization directly leads to command execution with elevated privileges.

Analyst Recommendation

Given the potential for complete system takeover, organizations utilizing coolercontrold must prioritize the update to version 4.0.0. The requirement for high privileges does not reduce the urgency of this patch, as an attacker who has already gained administrative access to the management interface can escalate their control to the underlying operating system.

---METADATA---
VENDOR: Tenda
PRODUCT: CH22
AFFECTED_VERSIONS: 1.0.0.1
CONFIDENCE: high
MISSING: patch
CREDITS: LtzHust2 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/354332","name":"VDB-354332 | Tenda CH22 Parameter webtypelibrary formWebTypeLibrary stack-based overflow","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/354332/cti","name":"VDB-354332 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/780209","name":"Submit #780209 | Tenda CH22 V1.0.0.1 Stack-based Buffer Overflow","tags":["third-party-advisory"]},{"url":"https://github.com/Litengzheng/vuldb_new/blob/main/CH22/vul_49/README.md","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:41.323Z
---END_METADATA---

Description Summary:
A stack-based buffer overflow in the Tenda CH22 web interface allows remote attackers to trigger memory corruption and potentially achieve remote code execution.

Executive Summary:
A critical stack-based buffer overflow vulnerability in the Tenda CH22 router, discovered in version 1.0.0.1, poses a significant risk of remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-5204

Affected Software: Tenda CH22

Affected Versions: 1.0.0.1

Vulnerability: The vulnerability exists within the formWebTypeLibrary function of the /goform/webtypelibrary endpoint, where the webSiteId parameter is processed by an unsafe strcat call without length verification. This flaw allows a remote, authenticated attacker to trigger a stack-based buffer overflow, leading to potential denial of service or remote code execution.

Business Impact

Successful exploitation of this vulnerability could grant an attacker full control over the affected network device. Given the CVSS score of 8.8, this represents a high-severity threat that could lead to unauthorized network access, interception of sensitive traffic, and total compromise of the internal gateway.

Remediation Plan

Immediate Action: Since a specific patch version is not currently listed, administrators should restrict access to the device management interface to trusted internal segments only. Contact Tenda support or monitor the official vendor portal for firmware updates addressing this memory corruption flaw.

Proactive Monitoring: Review system logs for unusual HTTP POST requests directed at /goform/webtypelibrary and monitor for unexpected device reboots or service crashes.

Compensating Controls: Implement an access control list (ACL) on the router to block external access to the web-based management interface, ensuring only authorized administrative workstations can reach the management service.

Exploitation Status

Public Exploit Available: Yes — a published proof-of-concept exists, as documented in the research write-up by Li Tengzheng.

Analyst Notes: As of April 2, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The availability of a functional exploit script makes this a high-priority item for network hardening.

Analyst Recommendation

Given the exposure of the administrative interface and the presence of a public proof-of-concept, the risk of exploitation is elevated. Organizations currently using Tenda CH22 devices in version 1.0.0.1 must prioritize isolating these devices from the public internet and applying forthcoming firmware updates as soon as they are made available by the vendor.

---METADATA---
VENDOR: Red Hat
PRODUCT: gdk-pixbuf
AFFECTED_VERSIONS: RHEL 7 ELS, RHEL 8, RHEL 10
CONFIDENCE: high
MISSING: none
CREDITS: Red Hat would like to thank Kağan Çapar for reporting this issue. (finder)
SOURCES_JSON: [{"url":"https://access.redhat.com/errata/RHSA-2026:10707","name":"RHSA-2026:10707","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:10708","name":"RHSA-2026:10708","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:10741","name":"RHSA-2026:10741","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:11325","name":"RHSA-2026:11325","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:11326","name":"RHSA-2026:11326","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:11327","name":"RHSA-2026:11327","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:11328","name":"RHSA-2026:11328","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:11806","name":"RHSA-2026:11806","tags":["vendor-advisory","x_refsource_REDHAT"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.147Z
---END_METADATA---

Description Summary:
A heap-based buffer overflow exists in the gdk-pixbuf JPEG image loader, allowing a remote attacker to cause a denial of service via specially crafted JPEG images.

Executive Summary:
A remote, unauthenticated heap-based buffer overflow vulnerability in the gdk-pixbuf library can lead to critical application crashes and denial of service conditions.

Vulnerability Details

CVE-ID: CVE-2026-5201

Affected Software: Red Hat gdk-pixbuf

Affected Versions: Red Hat Enterprise Linux 7 (ELS), 8, and 10

Vulnerability: This is a heap-based buffer overflow (CWE-122) occurring within the JPEG image loader due to improper validation of color component counts. The vulnerability is exploitable by an unauthenticated attacker, as the flaw can be triggered without user interaction through automated processes like thumbnail generation.

Business Impact

Successful exploitation of this vulnerability results in application crashes and denial of service, which can disrupt critical business operations reliant on image processing services. With a CVSS score of 7.5, the vulnerability is classified as High severity, reflecting the ease of remote exploitation and the potential for significant service degradation in environments where image handling is automated.

Remediation Plan

Immediate Action: Update the gdk-pixbuf library to the fixed versions specified in the relevant Red Hat Security Advisories (RHSA-2026:10707 and related errata).

Proactive Monitoring: Monitor system and application logs for unusual crashes or abnormal resource consumption associated with image processing services.

Compensating Controls: Implement input validation at the edge to filter or sanitize incoming JPEG files before they reach the processing layer, though this is secondary to patching.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub.

Analyst Notes: As of April 2, 2026, there is no confirmed active exploitation of this vulnerability in the wild. However, given the existence of a public proof-of-concept, the risk of exploitation should be considered credible. The flaw is inherently dangerous due to its potential for automated, unauthenticated triggering.

Analyst Recommendation

The severity of this vulnerability, combined with the availability of a public proof-of-concept, necessitates immediate action. Administrators must prioritize applying the provided Red Hat security updates to all affected RHEL environments to prevent potential denial of service attacks against image processing pipelines.

---METADATA---
VENDOR: Acyba
PRODUCT: AcyMailing
AFFECTED_VERSIONS: 0 through 10.8.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A missing authorization vulnerability in the AcyMailing WordPress plugin allows authenticated users to perform unauthorized actions.

Executive Summary:
A critical missing authorization flaw in the AcyMailing WordPress plugin could allow authenticated users to perform unauthorized actions, potentially leading to full site compromise.

Vulnerability Details

CVE-ID: CVE-2026-5200

Affected Software: Acyba AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress

Affected Versions: 0 through 10.8.2

Vulnerability: The plugin suffers from a missing authorization vulnerability (CWE-862) that permits authenticated users with low privileges to perform functions reserved for higher-privileged accounts. The CVSS vector indicates that while the attacker must be authenticated, they can perform actions with significant impact on confidentiality, integrity, and availability.

Business Impact

The vulnerability allows for unauthorized administrative actions within the marketing automation platform, which could lead to the exposure of sensitive subscriber data or the manipulation of newsletter content. With a CVSS score of 8.8, this represents a significant risk to site integrity and organizational reputation, as it could be leveraged to distribute malicious content to the entire subscriber base.

Remediation Plan

Immediate Action: Update the AcyMailing plugin to version 10.9.0 or later immediately.

Proactive Monitoring: Review administrative access logs for suspicious account activity or unauthorized changes to marketing campaigns and subscriber lists.

Compensating Controls: Utilize a Web Application Firewall (WAF) to detect and block requests that attempt to access restricted plugin functions without proper authorization.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 20, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for privilege escalation within the WordPress environment.

Analyst Recommendation

The risk posed by this vulnerability is high, particularly for organizations managing large subscriber lists. Administrators must prioritize updating the AcyMailing plugin to version 10.9.0 to close the authorization gap and prevent potential data exposure or unauthorized marketing activities.

---METADATA---
VENDOR: code-projects
PRODUCT: Student Membership System
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
CREDITS: nomath (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/354296","name":"VDB-354296 | code-projects Student Membership System Admin Login index.php sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/354296/cti","name":"VDB-354296 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/780403","name":"Submit #780403 | code-projects Student Membership System 1.0 SQL Injection","tags":["third-party-advisory"]},{"url":"https://github.com/maidangdang1/CVE/issues/4","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://code-projects.org/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.167Z
---END_METADATA---

Description Summary:
The Student Membership System 1.0 is vulnerable to unauthenticated SQL injection via the admin login page, allowing attackers to bypass authentication and gain full administrative access.

Executive Summary:
A critical SQL injection vulnerability in the code-projects Student Membership System allows unauthenticated attackers to bypass authentication and gain full administrative control over the application.

Vulnerability Details

CVE-ID: CVE-2026-5198

Affected Software: code-projects Student Membership System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw located in the admin/index.php file, where user-supplied input for the username and password fields is directly concatenated into database queries without sanitization. An unauthenticated attacker can supply crafted input to bypass the authentication mechanism entirely.

Business Impact

Successful exploitation grants an attacker full administrative access to the Student Membership System. This allows for unauthorized data modification, deletion of records, and the creation of new administrator accounts, posing a severe risk to data integrity and system security. With a CVSS score of 7.3, this high-severity vulnerability represents a significant threat to any organization relying on this software for identity or membership management.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should immediately restrict access to the /admin/index.php endpoint at the network or web server level.

Proactive Monitoring: Review web server access logs for anomalous POST requests to the login page containing SQL syntax, such as single quotes, OR operators, or tautological logic like '1'='1'.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the login endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept is available via the researcher's GitHub issue report.

Analyst Notes: As of April 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the insecure use of direct string concatenation in SQL queries, which is a trivial vector for attackers to bypass authentication.

Analyst Recommendation

Given the ease of exploitation and the critical nature of gaining administrative access, this vulnerability must be treated with high urgency. Organizations are advised to implement strict access controls or disable the administrative interface until a formal patch is released by the developer. Implementing input validation or transitioning to prepared statements is the only viable long-term solution to eliminate this injection risk.

---METADATA---
VENDOR: Trueview
PRODUCT: T18061 WiFi 3MP Robot Pan-Tilt Security Camera
AFFECTED_VERSIONS: Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A privilege escalation vulnerability in Trueview T18061 WiFi 3MP security cameras allows physically proximate attackers to compromise the device via an exposed RSA private key.

Executive Summary:
The Trueview T18061 WiFi 3MP security camera is vulnerable to privilege escalation due to an exposed RSA private key, allowing unauthorized device impersonation.

Vulnerability Details

CVE-ID: CVE-2026-51977

Affected Software: Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera

Affected Versions: Trueview T18061 WiFi 3MP Robot Pan-Tilt Security Camera Version 1.0

Vulnerability: The device suffers from improper protection of its RSA private key component. This allows a physically proximate, unauthenticated attacker to escalate privileges and perform device impersonation, undermining the security model of the camera.

Business Impact

With a CVSS score of 9.1, this vulnerability is critical. An attacker capable of impersonating security hardware can gain unauthorized access to video feeds or use the device as a foothold to attack the broader network. This presents a severe risk to both physical security and network integrity, potentially leading to widespread unauthorized access.

Remediation Plan

Immediate Action: Consult the vendor for security firmware updates to address the private key exposure. If no update is available, consider isolating these devices from critical network segments.

Proactive Monitoring: Monitor network traffic for anomalous authentication attempts or unusual communication patterns originating from the security camera devices.

Compensating Controls: Implement physical access controls to prevent unauthorized individuals from reaching the device, and place cameras on a dedicated, firewalled VLAN to restrict potential network-based exploitation.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept is available via the referenced GitHub repository.

Analyst Notes: As of August 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly exploitable due to the nature of hard-coded or exposed cryptographic material.

Analyst Recommendation

Due to the critical severity and the existence of a public proof-of-concept, immediate isolation of affected hardware is recommended. Administrators should prioritize replacing or updating any devices identified as running the vulnerable firmware to prevent unauthorized access.

---METADATA---
VENDOR: lllyasviel
PRODUCT: Fooocus
AFFECTED_VERSIONS: 2.1.854 through 2.5.5
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-03T14:02:29.246Z
SOURCES_JSON: [{"url":"https://github.com/lllyasviel/Fooocus/issues/4115","name":null,"tags":[]},{"url":"https://github.com/lllyasviel/Fooocus/blob/main/modules/meta_parser.py#L89","name":null,"tags":[]},{"url":"https://mrbruh.com/fooocus/","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
An eval() injection vulnerability in the get_list function of lllyasviel Fooocus allows remote authenticated attackers to execute arbitrary code via crafted EXIF metadata in uploaded images.

Executive Summary:
The Fooocus image generation software is vulnerable to remote code execution due to improper input validation, posing a significant risk to server integrity.

Vulnerability Details

CVE-ID: CVE-2026-51974

Affected Software: lllyasviel Fooocus

Affected Versions: 2.1.854 through 2.5.5

Vulnerability: The application fails to properly sanitize input within the get_list function located in modules/meta_parser.py. This allows an authenticated attacker to inject malicious Python code into the styles payload of an image file's EXIF metadata, which is then processed by an unsafe eval() call.

Business Impact

Successful exploitation of this vulnerability allows an attacker to achieve remote code execution on the host system. Given the CVSS score of 8.8, this represents a high-severity risk that could lead to full system compromise, unauthorized data access, and potential lateral movement within the network. Organizations relying on this software for production workflows face significant operational and security exposure until the flaw is remediated.

Remediation Plan

Immediate Action: Review the official project repository for the commit 8da1d3ff68942e2d976675939fe72c95746e366e and apply the fix to the modules/meta_parser.py file immediately.

Proactive Monitoring: Monitor server logs for unusual process execution patterns or unexpected file system modifications originating from the application service account.

Compensating Controls: Implement strict input validation or sanitization routines for all uploaded image files and restrict the application's execution permissions to the minimum necessary to function.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of September 2, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it leverages a common, unsafe programming pattern that directly facilitates arbitrary code execution.

Analyst Recommendation

This vulnerability presents a clear and present danger to infrastructure security. Administrators must treat this as a high-priority item and verify their current version of Fooocus. If the version falls within the vulnerable range, apply the referenced code fix immediately or restrict access to the application until a formal vendor patch is verified and deployed.

---METADATA---
VENDOR: code-projects
PRODUCT: Student Membership System
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch, technical_details
CREDITS: nomath (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/354293","name":"VDB-354293 | code-projects Student Membership System User Registration sql injection","tags":["vdb-entry"]},{"url":"https://vuldb.com/vuln/354293/cti","name":"VDB-354293 | CTI Indicators (IOB, IOC, TTP)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/780398","name":"Submit #780398 | code-projects Student Membership System 1.0 SQL Injection","tags":["third-party-advisory"]},{"url":"https://github.com/maidangdang1/CVE/issues/1","name":null,"tags":["issue-tracking"]},{"url":"https://code-projects.org/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.167Z
---END_METADATA---

Description Summary:
A SQL injection vulnerability exists in the User Registration Handler of the code-projects Student Membership System 1.0, allowing remote unauthenticated attackers to manipulate database queries.

Executive Summary:
A remote SQL injection vulnerability in the code-projects Student Membership System 1.0 poses a significant risk of unauthorized database interaction.

Vulnerability Details

CVE-ID: CVE-2026-5195

Affected Software: code-projects Student Membership System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection (CWE-89) located within the User Registration Handler component. The flaw permits an unauthenticated remote attacker to execute malicious SQL commands by manipulating input parameters.

Business Impact

The ability for an unauthenticated attacker to inject arbitrary SQL commands represents a severe risk to data integrity and confidentiality. Successful exploitation could lead to unauthorized access to sensitive user data, potential modification of registration records, or disruption of database services. With a CVSS score of 7.3, this high-severity vulnerability requires immediate attention to prevent unauthorized access to the underlying application database.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the registration module or disable the affected Student Membership System component until a vendor-supplied update is released.

Proactive Monitoring: Security teams should monitor database logs for abnormal query patterns, specifically looking for SQL syntax errors or unexpected data retrieval attempts originating from the registration handler.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns in HTTP requests directed at the application registration endpoints.

Exploitation Status

Public Exploit Available: No (exploit_available: false).

Analyst Notes: As of April 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently dangerous because it allows remote, unauthenticated access to the database layer.

Analyst Recommendation

Given the potential for unauthorized data access and the existence of a proof-of-concept, this vulnerability should be prioritized for mitigation. Organizations currently running version 1.0 of the Student Membership System must implement the suggested WAF controls or restrict network access to the application immediately. Close coordination with the vendor is advised to ensure that security updates are applied as soon as they become available.

---METADATA---
VENDOR: Oneblog
PRODUCT: Oneblog
AFFECTED_VERSIONS: Oneblog V2.3.9
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Oneblog V2.3.9 is vulnerable to an information disclosure flaw in its API components, allowing unauthenticated remote attackers to access sensitive data.

Executive Summary:
A high-severity information disclosure vulnerability in Oneblog V2.3.9 enables unauthenticated remote attackers to extract sensitive data from the application.

Vulnerability Details

CVE-ID: CVE-2026-51937

Affected Software: Oneblog

Affected Versions: Oneblog V2.3.9

Vulnerability: The application contains an information disclosure vulnerability within the RestApiController.java, JsApiTicketComponent.java, and GetAccessTokenComponent.java components. This flaw allows unauthenticated remote attackers to bypass access controls and retrieve sensitive system information.

Business Impact

The exploitation of this vulnerability could lead to the exposure of sensitive internal data, potentially facilitating further attacks against the application or the underlying infrastructure. With a CVSS score of 7.5, this high-severity flaw represents a significant risk to data confidentiality, necessitating immediate attention to prevent unauthorized data exfiltration.

Remediation Plan

Immediate Action: Review the issue tracker at https://github.com/zhangyd-c/OneBlog/issues/43 for developer guidance and apply any available security patches or configuration changes.

Proactive Monitoring: Review web server and application API logs for anomalous, high-frequency requests targeting the vulnerable Java components.

Compensating Controls: Implement Web Application Firewall (WAF) rules to block unauthorized access attempts to the identified API endpoints.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of Jul 6, 2026, public Proof-of-Concepts are available for this vulnerability. Given the ease of exploitation, the risk of active exploitation is elevated.

Analyst Recommendation

Organizations utilizing Oneblog V2.3.9 should treat this as a high-priority incident. Apply vendor-recommended mitigations immediately and restrict network access to the affected API endpoints until a formal patch is deployed.

---METADATA---
VENDOR: docuForm GmbH
PRODUCT: FSM Client
AFFECTED_VERSIONS: v.11.11c
CONFIDENCE: high
MISSING: patch, exploit_status
---END_METADATA---

Description Summary:
A vulnerability in the docuForm GmbH FSM Client v.11.11c login.php component allows remote attackers to perform user enumeration.

Executive Summary:
A user enumeration vulnerability in docuForm GmbH FSM Client v.11.11c allows unauthorized attackers to identify valid accounts, facilitating further targeted attacks.

Vulnerability Details

CVE-ID: CVE-2026-51926

Affected Software: docuForm GmbH FSM Client

Affected Versions: v.11.11c

Vulnerability: The application's authentication mechanism, specifically within the login.php component, is susceptible to user enumeration. By analyzing variations in server responses, an unauthenticated attacker can confirm the existence of specific usernames within the system.

Business Impact

While this vulnerability has a CVSS score of 7.5, its primary impact is as a precursor to more severe attacks. By successfully enumerating valid usernames, attackers can significantly increase the efficiency of brute-force or credential-stuffing attacks, potentially leading to full account takeover and unauthorized access to sensitive information.

Remediation Plan

Immediate Action: Reach out to the vendor, docuForm GmbH, for the latest security patches addressing authentication logic flaws.

Proactive Monitoring: Monitor authentication logs for high volumes of failed login attempts or repeated requests that target enumeration, which may indicate an ongoing reconnaissance effort.

Compensating Controls: Implement account lockout policies, rate limiting, and multi-factor authentication (MFA) to mitigate the risk of automated credential attacks facilitated by this enumeration flaw.

Exploitation Status

Public Exploit Available: No confirmed public exploit is currently available.

Analyst Notes: As of July 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability.

Analyst Recommendation

Although this vulnerability does not grant direct access, it provides attackers with the intelligence necessary to mount more damaging campaigns. Organizations should prioritize the application of any vendor-supplied patches and enhance their authentication security posture immediately.

---METADATA---
VENDOR: docuForm GmbH
PRODUCT: Client
AFFECTED_VERSIONS: v.11.11c
CONFIDENCE: medium
MISSING: patch
SOURCES_JSON: [{"url":"https://docuform.de","name":null,"tags":[]},{"url":"https://gist.github.com/ZeroBreach-GmbH","name":null,"tags":[]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:20:00.507Z
---END_METADATA---

Description Summary:
A Local File Inclusion vulnerability in docuForm GmbH Client v.11.11c allows remote authenticated attackers to read arbitrary files and execute code.

Executive Summary:
A Local File Inclusion vulnerability in docuForm GmbH Client version 11.11c permits remote attackers with low privileges to read sensitive server files and potentially execute arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-51925

Affected Software: docuForm GmbH Client

Affected Versions: v.11.11c

Vulnerability: A Local File Inclusion flaw exists within the dfm-menu_report.php component, requiring low-privileged user authentication and network access to exploit.

Business Impact

Successful exploitation of this vulnerability can lead to severe data compromise, including unauthorized access to sensitive configuration files, source code, and core system files. With a CVSS score of 8.1, the high severity rating reflects the potential for total confidentiality and integrity loss on the affected server, increasing organizational risk.

Remediation Plan

Immediate Action: Contact docuForm GmbH to obtain and apply the official security update or patch for version 11.11c.

Proactive Monitoring: Monitor server access logs for anomalous HTTP requests targeting the dfm-menu_report.php component or unusual file access patterns.

Compensating Controls: Implement Web Application Firewall rules to inspect and block traversal sequences within parameters passed to the vulnerable component.

Exploitation Status

Public Exploit Available: No (no confirmed public exploit or weaponized module currently available in the telemetry).

Analyst Notes: As of Jul 8, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The network attack vector combined with low privilege requirements makes input validation controls critical for this endpoint.

Analyst Recommendation

Security teams must prioritize addressing this high-severity flaw by engaging the vendor for mitigation guidance. Until a formal patch is deployed, administrators should restrict access to the affected endpoint and enforce strict monitoring on the server environment.

---METADATA---
VENDOR: docuForm GmbH
PRODUCT: Client
AFFECTED_VERSIONS: 11.11c
CONFIDENCE: medium
MISSING: patch
SOURCES_JSON: [{"url":"https://docuform.de","name":null,"tags":[]},{"url":"https://gist.github.com/ZeroBreach-GmbH","name":null,"tags":[]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:20:07.815Z
---END_METADATA---

Description Summary:
A remote code execution vulnerability in docuForm GmbH Client v.11.11c via report.php and file upload functions.

Executive Summary:
A high-severity remote code execution vulnerability in docuForm GmbH Client allows authenticated attackers to compromise confidentiality and integrity.

Vulnerability Details

CVE-ID: CVE-2026-51924

Affected Software: docuForm GmbH Client

Affected Versions: 11.11c

Vulnerability: This vulnerability involves improper handling within the file upload and report.php components, allowing a remote attacker with low privileges to achieve arbitrary code execution.

Business Impact

A successful exploit permits an attacker to execute arbitrary code with the privileges of the application, leading to severe data compromise and loss of system integrity. With a CVSS score of 8.1, the high severity rating underscores the critical nature of potential unauthorized access and administrative manipulation within the network.

Remediation Plan

Immediate Action: Contact docuForm GmbH to obtain the latest security updates or patches for version 11.11c, and restrict network access to the report.php component.

Proactive Monitoring: Monitor web server access logs for anomalous file upload attempts and unusual HTTP requests targeting report.php.

Compensating Controls: Implement a Web Application Firewall rule to inspect file uploads and block suspicious traffic directed at the vulnerable component.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 8, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires low privileges, meaning an attacker must first compromise a valid user account to leverage the file upload mechanism.

Analyst Recommendation

Security teams must prioritize reaching out to the vendor for a resolution while enforcing strict access controls around the affected application. Immediate containment steps, such as monitoring and filtering traffic, are essential to mitigate the risk of unauthorized code execution.

---METADATA---
VENDOR: docuForm GmbH
PRODUCT: Client
AFFECTED_VERSIONS: v.11.11c
CONFIDENCE: high
MISSING: patch, exploit_status
---END_METADATA---

Description Summary:
An Insecure Direct Object Reference (IDOR) in docuForm GmbH Client v.11.11c allows remote attackers with low privileges to execute arbitrary code and access other users' data.

Executive Summary:
An Insecure Direct Object Reference (IDOR) vulnerability in docuForm GmbH Client v.11.11c permits low-privileged attackers to execute arbitrary code and compromise sensitive user data.

Vulnerability Details

CVE-ID: CVE-2026-51923

Affected Software: docuForm GmbH Client

Affected Versions: v.11.11c

Vulnerability: The software contains an Insecure Direct Object Reference (IDOR) vulnerability within its user settings component. This flaw allows an authenticated attacker with low privileges to manipulate object references to execute arbitrary code and gain unauthorized access to data belonging to other users.

Business Impact

The CVSS score of 8.1 reflects the high risk associated with this vulnerability, as it allows for both remote code execution and unauthorized data access. A successful compromise could lead to a full breach of user confidentiality, system-wide unauthorized actions, and significant reputational damage to the organization.

Remediation Plan

Immediate Action: Contact docuForm GmbH to obtain the latest security updates or patches for the Client software.

Proactive Monitoring: Review application access logs for unusual patterns, such as account identifiers that do not correspond to the current user session or unexpected code execution attempts.

Compensating Controls: Implement strict identity and access management controls and ensure that the application is running with the principle of least privilege to limit the impact of a potential compromise.

Exploitation Status

Public Exploit Available: No confirmed public exploit is currently available.

Analyst Notes: As of July 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability.

Analyst Recommendation

The severity of this flaw requires immediate attention from security teams. Organizations should prioritize updating the affected software as soon as a patch is released to prevent the potential for arbitrary code execution and unauthorized data retrieval.

---METADATA---
VENDOR: WPMUDEV
PRODUCT: Forminator Forms – Contact Form, Payment Form & Custom Form Builder
AFFECTED_VERSIONS: 0 through 1.52.1
CONFIDENCE: high
MISSING: patch, exploit_status
CREDITS: daroo (finder)
SOURCES_JSON: [{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/788422c4-e070-48aa-a85d-a5d5a25a6a1d?source=cve","name":null,"tags":[]},{"url":"https://plugins.trac.wordpress.org/changeset/3500671/forminator","name":null,"tags":[]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:44:31.814Z
---END_METADATA---

Description Summary:
The Forminator Forms plugin for WordPress is vulnerable to unauthenticated path traversal via the upload-1 file_path parameter, allowing file reading.

Executive Summary:
An unauthenticated path traversal vulnerability in the Forminator Forms plugin for WordPress allows attackers to read arbitrary files on the server.

Vulnerability Details

CVE-ID: CVE-2026-5192

Affected Software: WPMUDEV Forminator Forms – Contact Form, Payment Form & Custom Form Builder

Affected Versions: 0 through 1.52.1

Vulnerability: This is a path traversal flaw categorized under CWE-22, triggered via the upload-1 file_path parameter in forms with specific file upload configurations, allowing unauthenticated remote attackers to read sensitive server files.

Business Impact

A successful exploit exposes sensitive server files, potentially leading to the leakage of configuration data, credentials, or other confidential information. Given the CVSS score of 7.5, this high severity vulnerability poses a significant risk to data confidentiality and organizational security.

Remediation Plan

Immediate Action: Update the Forminator Forms plugin to a version newer than 1.52.1 as soon as a patch is released by the vendor.

Proactive Monitoring: Monitor server access logs for anomalous file requests and review file upload configurations on public forms.

Compensating Controls: Implement a Web Application Firewall rule to block path traversal attempts containing directory traversal sequences in form parameters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of May 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability.

Analyst Recommendation

This high severity vulnerability requires close attention due to the unauthenticated attack vector and potential for sensitive data exposure. Administrators should review their WordPress plugin configurations and apply the necessary updates immediately upon availability to mitigate the risk of unauthorized file access.

---METADATA---
VENDOR: Amazon (AWS)
PRODUCT: aws-c-event-stream
AFFECTED_VERSIONS: Versions prior to 0.6.0
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://aws.amazon.com/security/security-bulletins/2026-011-aws/","name":null,"tags":["vendor-advisory"]},{"url":"https://github.com/awslabs/aws-c-event-stream/security/advisories/GHSA-xvjw-fjq5-68hf","name":null,"tags":["third-party-advisory"]},{"url":"https://github.com/awslabs/aws-c-event-stream/releases/tag/v0.6.0","name":null,"tags":["patch"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.147Z
---END_METADATA---

Description Summary:
An out-of-bounds write vulnerability exists in the streaming decoder of aws-c-event-stream, potentially allowing memory corruption and arbitrary code execution via crafted messages.

Executive Summary:
A critical out-of-bounds write vulnerability in the AWS aws-c-event-stream library may allow remote attackers to achieve code execution through malicious event-stream messages.

Vulnerability Details

CVE-ID: CVE-2026-5190

Affected Software: Amazon (AWS) aws-c-event-stream

Affected Versions: Versions prior to 0.6.0

Vulnerability: This is an out-of-bounds write (CWE-787) flaw within the streaming decoder component. The vulnerability can be triggered by an unauthenticated third party operating a server, which sends crafted event-stream messages to a client application, leading to memory corruption and potential arbitrary code execution.

Business Impact

The ability to achieve arbitrary code execution on client applications poses a severe risk to organizational data integrity and system security. Given the CVSS score of 7.5, this high-severity vulnerability could lead to total compromise of the affected client, resulting in unauthorized access to sensitive data or the disruption of critical business processes.

Remediation Plan

Immediate Action: Update the aws-c-event-stream library to version 0.6.0 or later immediately to incorporate the necessary memory safety fixes.

Proactive Monitoring: Review application logs for unexpected crashes or errors during the processing of network-based event streams, which may indicate attempted exploitation.

Compensating Controls: Implement network-level egress filtering and strict input validation on all received event-stream messages to mitigate the risk of processing malicious payloads while the update is being deployed.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of April 2, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires specific conditions to trigger, but its potential for remote code execution makes it a high priority for remediation.

Analyst Recommendation

Organizations utilizing the aws-c-event-stream library must treat this vulnerability with urgency. Given the potential for arbitrary code execution, administrators should prioritize patching to version 0.6.0 across all affected environments to eliminate the underlying memory corruption risk.

---METADATA---
VENDOR: XenForo
PRODUCT: XenForo
AFFECTED_VERSIONS: 2.3.8
CONFIDENCE: medium
MISSING: patch
SOURCES_JSON: [{"url":"https://xenforo.com","name":null,"tags":[]},{"url":"https://github.com/dennywise/CVE-2026-51833-Public-Disclosure/blob/main/CVE-2026-51833.md","name":null,"tags":[]}]
PROFILE: daily@50ba49e8b7aa
MODEL: gemini-3.5-flash-lite
GENERATED: 2026-08-29T11:17:24.625Z
---END_METADATA---

Description Summary:
XenForo 2.3.8 contains a server-side request forgery vulnerability that allows attackers to enumerate internal network services or expose server IP addresses.

Executive Summary:
XenForo 2.3.8 is vulnerable to server-side request forgery, allowing attackers to enumerate internal services and expose the host server IP address.

Vulnerability Details

CVE-ID: CVE-2026-51833

Affected Software: XenForo XenForo

Affected Versions: 2.3.8

Vulnerability: This is a server-side request forgery vulnerability involving the RSS feed creation and saving functionality, requiring administrative privileges or specific feed management access.

Business Impact

A successful exploit allows unauthorized internal network reconnaissance, potentially exposing backend infrastructure details and the true IP address of the hosting server. This intelligence gathering can facilitate subsequent targeted attacks against internal network perimeters. The high severity designation is justified by a CVSS score of 7.5, reflecting significant potential for information disclosure.

Remediation Plan

Immediate Action: Restrict administrative access to trusted personnel and disable the RSS feed creation feature until a vendor patch is released.

Proactive Monitoring: Monitor server access logs for unusual outbound requests originating from the web application server toward internal network segments.

Compensating Controls: Implement strict egress filtering on the web server firewall to prevent unauthorized outbound connections to internal IP ranges and private subnets.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept repository exists on GitHub.

Analyst Notes: As of Jul 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a public GitHub proof-of-concept indicates that functional attack scripts are accessible to malicious actors.

Analyst Recommendation

Security teams must treat this vulnerability with high urgency despite the requirement for administrative capabilities or feed management access. Administrators should apply compensating network controls immediately and monitor vendor advisories closely for the release of an official security patch.

---METADATA---
VENDOR: Shenzhou Shihan
PRODUCT: Video Conference System
AFFECTED_VERSIONS: Shenzhou Shihan Video Conference System v.1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the /user/getUserLogin endpoint of Shenzhou Shihan Video Conference System v.1.0 allows unauthenticated remote attackers to execute arbitrary code.

Executive Summary:
A critical SQL injection vulnerability in the Shenzhou Shihan Video Conference System allows unauthenticated remote attackers to achieve arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-51821

Affected Software: Shenzhou Shihan Video Conference System

Affected Versions: v.1.0

Vulnerability: This is a SQL injection vulnerability within the /user/getUserLogin endpoint. An unauthenticated attacker can supply malicious input to this endpoint to manipulate database queries, which can ultimately lead to arbitrary code execution on the underlying host.

Business Impact

The CVSS score of 9.8 classifies this as a critical vulnerability. Successful exploitation grants an attacker full control over the affected system, potentially leading to total data compromise, unauthorized access to sensitive video conference metadata, and complete system takeover. Immediate remediation is required to prevent total compromise of the infrastructure.

Remediation Plan

Immediate Action: Check the vendor advisory at https://github.com/advisories/GHSA-pr6g-rx9p-2cw6 for the latest patches and apply them immediately.

Proactive Monitoring: Monitor web server logs for suspicious SQL injection patterns, such as unusual characters or SQL keywords in requests directed at the /user/getUserLogin endpoint.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the affected endpoint.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 16, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly dangerous as it requires no authentication to execute code.

Analyst Recommendation

This is a critical flaw that requires immediate attention. Until a patch is confirmed and applied, administrators must restrict public network access to the /user/getUserLogin endpoint and implement strict WAF filtering to prevent potential exploitation.

---METADATA---
VENDOR: SourceCodester
PRODUCT: Teacher Record System
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
CREDITS: dyh18 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/354250","name":"VDB-354250 | SourceCodester Teacher Record System Parameter sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/354250/cti","name":"VDB-354250 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/780379","name":"Submit #780379 | SourceCodester Teacher Record System 1.0 SQL Injection","tags":["third-party-advisory"]},{"url":"https://github.com/dyh1213-wq/cve/issues/6","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.sourcecodester.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.171Z
---END_METADATA---

Description Summary:
A SQL injection vulnerability in SourceCodester Teacher Record System 1.0 allows unauthenticated remote attackers to execute arbitrary database queries via the searchteacher parameter.

Executive Summary:
An unauthenticated SQL injection vulnerability in the SourceCodester Teacher Record System allows remote attackers to compromise database integrity and access sensitive information.

Vulnerability Details

CVE-ID: CVE-2026-5182

Affected Software: SourceCodester Teacher Record System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize user input within the searchteacher parameter of the /trms/search-teacher.php file. This allows an unauthenticated attacker to inject malicious SQL commands, enabling unauthorized database interaction.

Business Impact

Successful exploitation permits attackers to bypass authentication, extract sensitive data, modify database records, or potentially gain full control over the application backend. With a CVSS score of 7.3, this flaw poses a significant risk to data confidentiality and integrity, potentially leading to severe reputational damage and regulatory non-compliance.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the /trms/search-teacher.php endpoint or disable the affected functionality entirely.

Proactive Monitoring: Review web server access logs for anomalous POST requests to the /trms/search-teacher.php file containing SQL-specific syntax or patterns indicative of injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the searchteacher parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists as documented in the GitHub research repository linked in the CVE references.

Analyst Notes: As of April 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability requires immediate attention. Organizations currently utilizing this software must implement strict network-level access controls or WAF filtering to prevent unauthorized database access while awaiting a permanent security update from the vendor.

---METADATA---
VENDOR: OpenHTJ2K
PRODUCT: OpenHTJ2K
AFFECTED_VERSIONS: OpenHTJ2K v.0.18.4 and before.
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in OpenHTJ2K allows remote attackers to execute arbitrary code via multiple decoder functions.

Executive Summary:
The OpenHTJ2K library contains a critical buffer overflow vulnerability that could allow an unauthenticated attacker to execute arbitrary code on the host system.

Vulnerability Details

CVE-ID: CVE-2026-51808

Affected Software: OpenHTJ2K

Affected Versions: OpenHTJ2K v.0.18.4 and before.

Vulnerability: The vulnerability exists within the openhtj2k_decoder_impl::invoke, invoke_line_based, invoke_line_based_stream, and invoke_line_based_predecoded functions. It is a buffer overflow condition that can be triggered by providing malicious input to the decoder, potentially leading to arbitrary code execution.

Business Impact

With a CVSS score of 9.8, this vulnerability is classified as critical. Successful exploitation allows for full system compromise, including the execution of arbitrary code, which can lead to data theft, system downtime, and complete loss of control over the affected application.

Remediation Plan

Immediate Action: Update the OpenHTJ2K library to version v0.18.5 or later.

Proactive Monitoring: Monitor application performance and logs for crashes or unexpected execution patterns that may indicate attempts to exploit memory corruption vulnerabilities.

Compensating Controls: Use application sandboxing or memory protection features to limit the impact of code execution if an immediate update is not feasible.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Jul 15, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The nature of buffer overflow vulnerabilities makes this a high-priority target for attackers.

Analyst Recommendation

Given the critical CVSS score and the existence of a proof-of-concept, users of the OpenHTJ2K library must treat this as a high-priority remediation task. Updating to version v0.18.5 is the only effective way to mitigate this risk.

---METADATA---
VENDOR: OpenHTJ2K
PRODUCT: OpenHTJ2K
AFFECTED_VERSIONS: v.0.18.4 and before
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A buffer overflow vulnerability in OpenHTJ2K up to version 0.18.4 allows unauthenticated attackers to execute arbitrary code via a malicious JPEG 2000 file.

Executive Summary:
A critical buffer overflow vulnerability in OpenHTJ2K allows unauthenticated attackers to achieve remote code execution, posing a severe risk to system integrity and availability.

Vulnerability Details

CVE-ID: CVE-2026-51807

Affected Software: OpenHTJ2K

Affected Versions: OpenHTJ2K v.0.18.4 and before

Vulnerability: This is a buffer overflow vulnerability located in the j2k_precinct_subband::parse_packet_header() function within the source code. The flaw is exploitable by an unauthenticated attacker who provides a specially crafted JPEG 2000 file for processing.

Business Impact

The vulnerability carries a CVSS score of 9.8, indicating a critical severity level. Successful exploitation allows for arbitrary code execution, which can lead to full system compromise, the theft of sensitive data, or complete service disruption. Because the attack vector is network-based and requires no authentication, the potential for widespread impact across image processing pipelines is significant.

Remediation Plan

Immediate Action: Upgrade OpenHTJ2K to version v0.18.5 or later immediately to incorporate the necessary security fixes.

Proactive Monitoring: Monitor system logs for unexpected application crashes or anomalous memory usage during image processing tasks, as these may indicate attempted exploitation.

Compensating Controls: Implement strict input validation or sandboxing for any services that process untrusted JPEG 2000 image files to restrict the impact of potential memory corruption.

Exploitation Status

Public Exploit Available: No (there is no confirmed public exploit in the available data).

Analyst Notes: As of July 13, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its location in a core parsing function, which typically handles external data with high privileges.

Analyst Recommendation

Given the critical nature of this vulnerability and the potential for remote code execution, organizations should prioritize patching their OpenHTJ2K deployments. Updating to version v0.18.5 is the only effective way to remediate this buffer overflow flaw. Failure to apply this update leaves systems vulnerable to exploitation by any actor capable of delivering a malicious image file to the target service.

---METADATA---
VENDOR: SourceCodester
PRODUCT: Simple Doctors Appointment System
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
CREDITS: dyh18 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/354248","name":"VDB-354248 | SourceCodester Simple Doctors Appointment System ajax.php sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/354248/cti","name":"VDB-354248 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/780354","name":"Submit #780354 | SourceCodester Simple Doctor's Appointment System in PHP/MySQL 1.0 SQL Injection","tags":["third-party-advisory"]},{"url":"http://github.com/dyh1213-wq/cve/issues/4","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.sourcecodester.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.171Z
---END_METADATA---

Description Summary:
A SQL injection vulnerability exists in SourceCodester Simple Doctors Appointment System 1.0 via the email parameter in the admin login endpoint.

Executive Summary:
An unauthenticated SQL injection vulnerability in SourceCodester Simple Doctors Appointment System 1.0 poses a significant risk of unauthorized database access and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2026-5180

Affected Software: SourceCodester Simple Doctors Appointment System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the /admin/ajax.php file, triggered by manipulating the email argument during the authentication process. The flaw allows an unauthenticated, remote attacker to execute arbitrary SQL commands against the backend database.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive healthcare data, including doctor and patient information stored within the application database. Given the CVSS score of 7.3, this represents a high-severity risk that could result in significant data breaches, loss of customer trust, and potential regulatory non-compliance.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the /admin/ directory to trusted IP addresses only.

Proactive Monitoring: Review web server access logs for suspicious activity targeting the /admin/ajax.php endpoint, specifically looking for SQL syntax patterns in the email parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads in HTTP requests.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the technical write-up at the referenced GitHub repository.

Analyst Notes: As of April 1, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible to attackers as it requires no authentication to trigger the flaw.

Analyst Recommendation

Due to the availability of a public proof-of-concept and the ease of exploitation, this vulnerability should be prioritized for mitigation. Organizations currently running this software must implement strict access controls immediately to prevent potential unauthorized access to their database while awaiting a formal vendor security update.

---METADATA---
VENDOR: SourceCodester
PRODUCT: Simple Doctors Appointment System
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
CREDITS: dyh18 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/354247","name":"VDB-354247 | SourceCodester Simple Doctors Appointment System login.php sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/354247/cti","name":"VDB-354247 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/780353","name":"Submit #780353 | SourceCodester Simple Doctor's Appointment System 1.0 SQL Injection","tags":["third-party-advisory"]},{"url":"https://github.com/dyh1213-wq/cve/issues/3","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.sourcecodester.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:40.171Z
---END_METADATA---

Description Summary:
A SQL injection vulnerability exists in the SourceCodester Simple Doctors Appointment System 1.0, specifically within the username parameter of the login functionality.

Executive Summary:
An unauthenticated SQL injection vulnerability in SourceCodester Simple Doctors Appointment System 1.0 allows remote attackers to execute arbitrary database queries, potentially leading to full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-5179

Affected Software: SourceCodester Simple Doctors Appointment System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) located in the /admin/login.php file. The application fails to properly sanitize the username parameter before incorporating it into database queries, allowing an unauthenticated attacker to manipulate SQL commands.

Business Impact

Successful exploitation of this vulnerability allows unauthorized access to the underlying database, which may result in the exfiltration of sensitive patient or administrative information. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to complete data exposure, unauthorized administrative access, and significant operational disruption.

Remediation Plan

Immediate Action: As no official vendor patch is currently available, administrators should restrict network access to the administrative login page and implement strict input validation on the affected parameter.

Proactive Monitoring: Monitor web server logs for suspicious POST requests to /admin/ajax.php or /admin/login.php that contain SQL keywords or unusual character patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) to detect and block common SQL injection payloads targeted at the username parameter.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced security research.

Analyst Notes: As of April 1, 2026, there is no public information indicating active exploitation in the wild. However, the availability of a published proof-of-concept makes this vulnerability highly accessible to threat actors, requiring immediate attention.

Analyst Recommendation

Due to the critical nature of SQL injection and the lack of a vendor-provided patch, users of the Simple Doctors Appointment System should consider the software insecure for production environments. If the system must remain online, ensure it is isolated from public networks and protected by robust WAF rules until a secure version is released.

---METADATA---
VENDOR: Fastadmin
PRODUCT: Fastadmin
AFFECTED_VERSIONS: v.1.6.1.20250430
CONFIDENCE: high
MISSING: patch
SOURCES_JSON: [{"url":"https://gitee.com/Tor443/security-advisory/blob/master/README.md","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
A SQL injection vulnerability in Fastadmin v.1.6.1.20250430 allows unauthenticated attackers to execute arbitrary code via the Backend.php component.

Executive Summary:
A critical SQL injection vulnerability in Fastadmin allows remote, unauthenticated attackers to achieve full system compromise through arbitrary code execution.

Vulnerability Details

CVE-ID: CVE-2026-51775

Affected Software: Fastadmin Fastadmin

Affected Versions: v.1.6.1.20250430

Vulnerability: This is a SQL injection vulnerability located in the application/common/controller/Backend.php file. The vulnerability is exploitable by unauthenticated remote attackers, as indicated by the CVSS vector PR:N.

Business Impact

The ability to execute arbitrary code via SQL injection represents the highest level of security risk, potentially leading to a total loss of data confidentiality, integrity, and availability. Given the CVSS score of 9.8, this vulnerability allows an attacker to bypass all authentication controls and take full control of the underlying server. Such a breach could result in catastrophic data exfiltration, permanent operational downtime, and significant reputational damage to the organization.

Remediation Plan

Immediate Action: Since a specific patch version is currently unknown, administrators should immediately restrict access to the affected backend controller component using network-level controls or by disabling the vulnerable functionality until an official update is released by the vendor.

Proactive Monitoring: Security teams should review application access logs for suspicious SQL syntax, unusual POST requests directed at Backend.php, or unexpected system process executions originating from the web server user.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to inspect and block malicious payloads targeting the Backend.php endpoint.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 26, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The nature of this flaw makes it highly attractive to threat actors due to the lack of required authentication.

Analyst Recommendation

Due to the critical severity and the presence of a proof-of-concept, this vulnerability must be treated as a high-priority remediation task. Organizations utilizing Fastadmin v.1.6.1.20250430 should monitor the vendor's security channels for an emergency patch and apply it immediately upon availability. In the interim, implement strict network segmentation to isolate the affected application from public exposure.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: T6
AFFECTED_VERSIONS: 4.1.5cu.748_B20211015
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-03T14:04:18.044Z
SOURCES_JSON: [{"url":"https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html","name":null,"tags":[]},{"url":"https://www.totolink.net/","name":null,"tags":[]},{"url":"https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]},{"url":"https://github.com/ShengWu00/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
An improper access control flaw in TOTOLINK T6 allows unauthenticated attackers to modify privileged Quality of Service (QoS) policies via crafted MQTT messages.

Executive Summary:
An unauthenticated access control vulnerability in the TOTOLINK T6 router enables remote attackers to manipulate critical network traffic policies, posing a high risk to network integrity.

Vulnerability Details

CVE-ID: CVE-2026-51768

Affected Software: TOTOLINK T6

Affected Versions: 4.1.5cu.748_B20211015

Vulnerability: This vulnerability resides within the setElinkQosConfig function, which fails to perform necessary authentication checks. An attacker can transmit a crafted MQTT message to the cs_broker component to modify privileged QoS configurations without requiring valid credentials.

Business Impact

Successful exploitation allows unauthorized modification of QoS policies, which can lead to traffic manipulation, service degradation, or potential denial of service for critical network segments. With a CVSS score of 7.5, this vulnerability represents a significant risk to operational continuity, as attackers could prioritize or throttle traffic to disrupt legitimate business functions.

Remediation Plan

Immediate Action: Review the official TOTOLINK advisory and website for available firmware updates addressing this flaw and apply them to all affected T6 devices immediately.

Proactive Monitoring: Monitor the cs_broker component logs and network traffic for anomalous MQTT message patterns or unauthorized configuration change requests.

Compensating Controls: Restrict network access to the MQTT management interface by implementing firewall rules that limit communication to authorized internal management workstations only.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of September 1, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation requires specific knowledge of the MQTT message structure, the lack of authentication makes this an attractive target for automated scanning and exploitation tools.

Analyst Recommendation

The high severity of this vulnerability necessitates immediate attention to prevent unauthorized network control. Administrators should isolate affected TOTOLINK T6 devices from public-facing networks until a verified vendor patch is applied and confirmed to remediate the access control deficiency.

---METADATA---
VENDOR: TOTOLINK
PRODUCT: T6
AFFECTED_VERSIONS: 4.1.5cu.748_B20211015
CONFIDENCE: high
MISSING: patch
PROFILE: daily@7c4e524780a4
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-09-03T14:01:02.413Z
SOURCES_JSON: [{"url":"https://www.totolink.net/home/menu/detail/menu_listtpl/download/id/190/ids/36.html","name":null,"tags":[]},{"url":"https://www.totolink.net/","name":null,"tags":[]},{"url":"https://github.com/DarkBoulder/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]},{"url":"https://github.com/ShengWu00/CVE-Vendor-Coordination/blob/main/TOTOLINK/README.md","name":null,"tags":[]}]
---END_METADATA---

Description Summary:
An incorrect access control vulnerability in the TOTOLINK T6 router allows unauthenticated remote attackers to overwrite cloud-result tracking files via crafted MQTT messages.

Executive Summary:
A critical vulnerability in the TOTOLINK T6 router allows unauthenticated attackers to perform unauthorized file overwrites, potentially leading to a complete compromise of the device.

Vulnerability Details

CVE-ID: CVE-2026-51764

Affected Software: TOTOLINK T6

Affected Versions: 4.1.5cu.748_B20211015

Vulnerability: The flaw exists within the recvSlaveCloudCheckStatus function, which fails to properly validate access control for incoming traffic. An unauthenticated attacker can exploit this by sending a specifically crafted MQTT message to the cs_broker component, resulting in the ability to overwrite sensitive cloud-result tracking files.

Business Impact

The exploitation of this vulnerability carries a CVSS score of 9.8, reflecting its critical nature and ease of access for remote attackers. Successful exploitation could lead to total loss of device integrity, unauthorized configuration changes, or the potential for further lateral movement within the local network, posing significant risks to operational security and data privacy.

Remediation Plan

Immediate Action: Consult the official TOTOLINK support portal at the provided reference link to determine if a firmware update is available for your specific hardware revision. If no patch is currently available, disconnect the device from public-facing internet access immediately.

Proactive Monitoring: Monitor network traffic for unusual MQTT protocol activity or unexpected communication directed toward the cs_broker component. Review system logs for signs of unauthorized file modification or unexpected service restarts.

Compensating Controls: Implement strict network segmentation to isolate the affected TOTOLINK T6 device from sensitive internal segments. Ensure that the device is not accessible from the wide area network and restrict management access to trusted local IP addresses only.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of September 1, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The flaw is considered highly dangerous due to the lack of required authentication and the potential for total impact on the device.

Analyst Recommendation

This vulnerability presents a severe risk due to the lack of authentication required to execute the attack. Organizations currently utilizing the TOTOLINK T6 router should prioritize isolating these devices from external networks until a vendor-supplied firmware update is verified and applied. Continuous monitoring of network boundaries is essential to prevent unauthorized access to the affected components.