---METADATA---
VENDOR: StratonWebDesigners
PRODUCT: HireFlow
AFFECTED_VERSIONS: See vendor advisory
CONFIDENCE: low
MISSING: versions, patch, technical_details
---END_METADATA---

Description Summary:
HireFlow v1 is subject to a cross-site request vulnerability that may lead to unauthorized data access or modification.

Executive Summary:
A vulnerability in the HireFlow interview management system could allow an attacker to perform unauthorized actions via a cross-site request, compromising system integrity.

Vulnerability Details

CVE-ID: CVE-2026-38566

Affected Software: StratonWebDesigners HireFlow

Affected Versions: See vendor advisory

Vulnerability: This is an unauthenticated vulnerability requiring user interaction (UI:R), typically manifesting as a cross-site request issue where an attacker tricks an authenticated user into performing unintended actions.

Business Impact

The potential for unauthorized data modification or access poses a serious threat to the confidentiality and integrity of applicant information. The CVSS score of 8.1 highlights the critical nature of this vulnerability, necessitating immediate attention to prevent potential service abuse.

Remediation Plan

Immediate Action: Seek guidance from the vendor for security updates; meanwhile, ensure that administrative sessions are managed securely and users are educated on identifying suspicious links.

Proactive Monitoring: Monitor for anomalous account activity or unauthorized configuration changes that may occur as a result of cross-site request exploitation.

Compensating Controls: Deploy a WAF with anti-CSRF protections to mitigate the risk of malicious requests being executed on behalf of legitimate users.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 13, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The requirement for user interaction provides a slight barrier to mass exploitation.

Analyst Recommendation

Due to the existence of a proof-of-concept and the high severity of this flaw, it is imperative to monitor for official vendor patches. Organizations should treat this with high urgency, implementing layered defenses to protect users from potential malicious interactions.

---METADATA---
VENDOR: Webkul
PRODUCT: Krayin CRM
AFFECTED_VERSIONS: v2.2.x
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Webkul Krayin CRM v2.2.x contains an arbitrary file upload vulnerability in the /admin/tinymce/upload endpoint, allowing authenticated attackers to execute arbitrary PHP code.

Executive Summary:
An arbitrary file upload vulnerability in Webkul Krayin CRM v2.2.x allows authenticated attackers to achieve remote code execution, presenting a critical risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-38526

Affected Software: Webkul Krayin CRM

Affected Versions: v2.2.x

Vulnerability: This is an arbitrary file upload vulnerability located in the /admin/tinymce/upload endpoint. It requires the attacker to have authenticated access to the administrative interface to upload and execute malicious PHP files.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the underlying server. This results in a complete compromise of the application, potentially leading to unauthorized data access, modification of business records, and full system takeover. The CVSS score of 9.9 reflects the high potential for impact on confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Update Krayin CRM to the latest available version provided by Webkul to patch the file upload validation logic.

Proactive Monitoring: Monitor server access logs for unusual requests to the /admin/tinymce/upload directory and inspect for unexpected file creations in web-accessible directories.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to restrict file uploads and block requests containing suspicious file extensions or non-authorized content types in the upload endpoint.

Exploitation Status

Public Exploit Available: Yes — a public exploit exists in ExploitDB and multiple proof-of-concept repositories on GitHub.

Analyst Notes: As of April 14, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of weaponized exploit code significantly lowers the barrier for entry for potential attackers.

Analyst Recommendation

Given the availability of weaponized exploits and the critical nature of remote code execution, organizations using Krayin CRM v2.2.x must prioritize upgrading to the latest version immediately. Failure to patch will leave the infrastructure vulnerable to total system compromise by any authenticated user.

---METADATA---
VENDOR: osTicket
PRODUCT: osTicket
AFFECTED_VERSIONS: 1.18.3
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
osTicket 1.18.3 uses insecure MD5 hashing with predictable inputs to generate API keys, allowing attackers to brute-force authentication credentials.

Executive Summary:
An insecure API key generation mechanism in osTicket 1.18.3 allows unauthenticated attackers to compromise sensitive system access through brute-force attacks.

Vulnerability Details

CVE-ID: CVE-2026-38447

Affected Software: osTicket osTicket

Affected Versions: 1.18.3

Vulnerability: The application utilizes MD5 hashing with low-entropy inputs, such as timestamps and IP addresses, to generate API keys. This flaw permits an unauthenticated attacker to predict or brute-force valid keys, granting unauthorized access to the API.

Business Impact

The vulnerability carries a CVSS score of 9.8, indicating a critical risk to system integrity and confidentiality. Successful exploitation allows an attacker to bypass authentication, potentially resulting in full administrative access to the help desk system, exposure of sensitive customer data, and total system compromise.

Remediation Plan

Immediate Action: Review the provided vendor references and commit history to identify the fix, and ensure the deployment is updated to a patched version once released by the vendor.

Proactive Monitoring: Monitor API access logs for high volumes of authentication failures or suspicious patterns originating from single or distributed IP addresses.

Compensating Controls: Restrict API access to known, trusted IP addresses via network-level firewalls or reverse proxy configurations to limit the attack surface.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 3, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The reliance on MD5 for cryptographic security is inherently weak and susceptible to modern computational brute-force methods.

Analyst Recommendation

Given the critical CVSS severity, organizations should treat this as a high-priority risk. Administrators must verify their current version of osTicket and implement strict access controls on the API endpoint until a definitive patch is confirmed and applied to the production environment.

---METADATA---
VENDOR: Breeze
PRODUCT: Breeze Cache
AFFECTED_VERSIONS: Up to and including 2.4.4
---END_METADATA---

Description Summary:
The Breeze Cache plugin for WordPress is vulnerable to unauthenticated arbitrary file uploads via the Gravatar fetching function.

Executive Summary:
A critical file upload vulnerability in the Breeze Cache plugin allows unauthenticated attackers to achieve remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-3844

Affected Software: Breeze Cache

Affected Versions: Up to and including 2.4.4

Vulnerability: The fetch_gravatar_from_remote function lacks file type validation, allowing unauthenticated attackers to upload malicious files to the server.

Business Impact

Successful exploitation allows for the execution of arbitrary code on the server, potentially leading to full site compromise, data theft, and defacement. Given the CVSS score of 9.8, this is a critical threat to the integrity and availability of the WordPress site.

Remediation Plan

Immediate Action: Update the Breeze Cache plugin to the latest version.

Proactive Monitoring: Inspect the uploads directory for suspicious files, particularly executable scripts (e.g., .php files) that should not be present.

Compensating Controls: Disable the "Host Files Locally - Gravatars" feature if an immediate update is not possible, as this mitigates the attack vector.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Apr 23, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Apply the update immediately. If the "Host Files Locally - Gravatars" feature is currently enabled, it should be disabled until the plugin is patched to prevent immediate exploitation.

---METADATA---
VENDOR: Nefteprodukttekhnika LLC
PRODUCT: BUK TS-G Gas Station Automation System
AFFECTED_VERSIONS: 2.9.1 up to (excluding) 2.10.2
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Nefteprodukttekhnika BUK TS-G Gas Station Automation System contains a SQL injection vulnerability in the configuration module, allowing remote unauthenticated attackers to execute arbitrary commands.

Executive Summary:
A critical SQL injection vulnerability in the Nefteprodukttekhnika BUK TS-G Gas Station Automation System allows remote, unauthenticated attackers to achieve potential remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-3843

Affected Software: Nefteprodukttekhnika LLC BUK TS-G Gas Station Automation System

Affected Versions: 2.9.1 up to (excluding) 2.10.2

Vulnerability: The application is susceptible to SQL injection (CWE-89) within the sql parameter of the /php/request.php endpoint. This flaw allows an unauthenticated remote attacker to inject arbitrary SQL commands, resulting in full database compromise and potential execution of operating system-level code.

Business Impact

Successful exploitation of this vulnerability could lead to a complete compromise of the gas station automation infrastructure. Given the CVSS score of 9.8, this poses a severe risk of unauthorized data access, manipulation of critical operational parameters, and significant system downtime, potentially impacting revenue and physical safety.

Remediation Plan

Immediate Action: Update the BUK TS-G Gas Station Automation System to version 2.10.2 or later immediately.

Proactive Monitoring: Monitor network traffic for anomalous HTTP POST requests directed at /php/request.php containing suspicious SQL keywords.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or sanitize input containing SQL syntax in the sql parameter of the affected endpoint.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of March 10, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly accessible as it requires no authentication and utilizes standard HTTP POST requests.

Analyst Recommendation

The extreme severity of this vulnerability necessitates immediate patching. Organizations operating BUK TS-G systems must prioritize upgrading to version 2.10.2 to eliminate the risk of unauthenticated remote code execution.

---METADATA---
VENDOR: fohrloop
PRODUCT: dash-uploader
AFFECTED_VERSIONS: 0.1.0 through 0.7.0a2
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A directory traversal vulnerability in the dash-uploader component allows remote attackers to execute arbitrary code via crafted HTTP requests.

Executive Summary:
A critical directory traversal vulnerability in fohrloop dash-uploader permits unauthenticated remote code execution, posing a severe risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-38360

Affected Software: fohrloop dash-uploader

Affected Versions: 0.1.0 through 0.7.0a2

Vulnerability: This directory traversal flaw exists within the httprequesthandler.py component, specifically affecting the get_temp_root and _post methods. An unauthenticated remote attacker can leverage this to escape restricted directories and execute arbitrary code on the underlying host.

Business Impact

The vulnerability carries a CVSS score of 9.8, indicating a critical severity level. Successful exploitation grants an attacker full control over the affected system, potentially leading to unauthorized data exfiltration, total system compromise, and significant operational downtime.

Remediation Plan

Immediate Action: Identify and inventory all instances of dash-uploader within your environment and transition to a patched version once available.

Proactive Monitoring: Inspect web server access logs for unusual directory traversal patterns, such as sequences like "../" or null byte injections targeting the httprequesthandler endpoints.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block incoming HTTP requests containing directory traversal sequences directed at the dash-uploader API.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 8, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical CVSS score of 9.8 and the potential for unauthenticated remote code execution, this vulnerability represents an immediate threat to the environment. Administrators should prioritize identifying vulnerable installations and applying vendor-supplied patches immediately upon release to prevent exploitation.

---METADATA---
VENDOR: Hikvision
PRODUCT: Switch Products
AFFECTED_VERSIONS: Hikvision DS-3E1310P-SI (below V1.2.4_210623), DS-3E1318P-SI (below V1.2.0_210823), DS-3E1326P-SI (below V1.2.0_210823)
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Certain discontinued Hikvision switch models are susceptible to an authenticated remote command execution vulnerability caused by improper input validation.

Executive Summary:
An authenticated remote command execution vulnerability in specific discontinued Hikvision switches could allow a privileged attacker to gain full system control.

Vulnerability Details

CVE-ID: CVE-2026-3828

Affected Software: Hikvision Switch Products

Affected Versions: Hikvision DS-3E1310P-SI (< V1.2.4_210623), DS-3E1318P-SI (< V1.2.0_210823), DS-3E1326P-SI (< V1.2.0_210823)

Vulnerability: The vulnerability involves insufficient input validation, which allows an attacker with high privileges (authenticated) to execute arbitrary commands on the affected hardware.

Business Impact

A successful exploit grants the attacker command execution capabilities at the system level, potentially leading to a total compromise of the network device. With a CVSS score of 7.2, the impact is severe, though mitigated by the requirement for administrative authentication.

Remediation Plan

Immediate Action: Update the firmware of the affected switch models to the versions specified in the vendor advisory.

Proactive Monitoring: Review administrative session logs for unauthorized or unexpected command execution activity and monitor for configuration changes.

Compensating Controls: Restrict administrative access to these devices to trusted management networks only and implement strong multi-factor authentication (MFA) where supported.

Exploitation Status

Public Exploit Available: No — there is no confirmed public weaponized exploit or PoC in the available data.

Analyst Notes: As of May 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for high-privilege authentication significantly reduces the attack surface.

Analyst Recommendation

Although the products are discontinued, the severity of remote command execution necessitates immediate patching. Administrators should confirm if these devices are still in use and ensure firmware is updated to the latest available version provided by the manufacturer.

---METADATA---
VENDOR: WellChoose
PRODUCT: IFTOP
AFFECTED_VERSIONS: See vendor advisory for specific affected versions
---END_METADATA---

Description Summary:
A Local File Inclusion (LFI) vulnerability in WellChoose IFTOP allows unauthenticated remote attackers to execute arbitrary code on the server.

Executive Summary:
WellChoose IFTOP contains a critical vulnerability that allows unauthenticated remote attackers to include local files and execute arbitrary code, leading to a complete server compromise.

Vulnerability Details

CVE-ID: CVE-2026-3826

Affected Software: WellChoose IFTOP

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This vulnerability is a Local File Inclusion (LFI) flaw. An unauthenticated remote attacker can manipulate input to include files from the local server. By including specific system files or uploaded malicious content, the attacker can transition from file inclusion to arbitrary code execution (RCE) on the host server.

Business Impact

The CVSS score of 9.8 underscores the extreme risk associated with this flaw. A successful exploit allows an attacker to gain full control of the server, leading to the theft of sensitive data, service outages, and the use of the server as a pivot point for further attacks within the network.

Remediation Plan

Immediate Action: Update WellChoose IFTOP to the latest version immediately to patch the LFI vulnerability.

Proactive Monitoring: Monitor web server logs for directory traversal patterns (e.g., ../..) and unusual file access requests.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically designed to detect and block Local File Inclusion and directory traversal attacks.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Mar 11, 2026, there is no public information indicating active exploitation. LFI vulnerabilities that lead to RCE are highly sought after by attackers due to the ease of automation.

Analyst Recommendation

Immediate patching is required to protect servers running WellChoose IFTOP. Because the vulnerability is unauthenticated and remote, the window for exploitation is wide. Organizations should prioritize this update and review their web application security posture.

---METADATA---
VENDOR: Atop Technologies
PRODUCT: EHG2408 series switch
AFFECTED_VERSIONS: See vendor advisory for affected versions
---END_METADATA---

Description Summary:
The Atop Technologies EHG2408 series switch contains a stack-based buffer overflow allowing unauthenticated remote attackers to execute arbitrary code.

Executive Summary:
Unauthenticated remote attackers can gain full control over Atop Technologies EHG2408 series switches by exploiting a critical stack-based buffer overflow vulnerability.

Vulnerability Details

CVE-ID: CVE-2026-3823

Affected Software: Atop Technologies EHG2408 series switch

Affected Versions: See vendor advisory for affected versions

Vulnerability: The vulnerability is a stack-based buffer overflow that allows an unauthenticated remote attacker to manipulate the program's execution flow. This occurs due to insufficient bounds checking on input data processed by the switch's firmware.

Business Impact

This vulnerability poses a severe risk to network infrastructure, as it allows for unauthorized code execution without requiring any login credentials. The CVSS score of 8.8 reflects a High severity, as an attacker could potentially pivot through the compromised switch to other sensitive areas of the corporate or industrial network, leading to massive data breaches or network-wide outages.

Remediation Plan

Immediate Action: Apply the latest firmware updates provided by Atop Technologies immediately to address the memory corruption issue.

Proactive Monitoring: Monitor system logs for unexpected reboots or unauthorized configuration changes that could indicate an exploitation attempt.

Compensating Controls: Utilize a Web Application Firewall (WAF) or an Intrusion Prevention System (IPS) to filter malicious traffic and restrict management interface access to trusted IP ranges.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, the ability for unauthenticated attackers to execute code remotely makes this a highly attractive target for threat actors.

Analyst Recommendation

Given the unauthenticated nature of this flaw, the risk to network availability and security is substantial. Administrators must treat this as a high-priority item and deploy the necessary firmware patches immediately to prevent unauthorized access to critical network hardware.

---METADATA---
VENDOR: SMCI
PRODUCT: X14DBG-DAP, X14DBI
AFFECTED_VERSIONS: 01.00.16.00, 1.03.02.06
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
SMCI SMASH services on specific hardware models contain an OS command injection vulnerability that allows authenticated attackers to execute arbitrary code.

Executive Summary:
Authenticated attackers can execute arbitrary code on SMCI X14DBG-DAP and X14DBI hardware via an OS command injection vulnerability.

Vulnerability Details

CVE-ID: CVE-2026-3821

Affected Software: SMCI X14DBG-DAP, X14DBI

Affected Versions: 01.00.16.00, 1.03.02.06

Vulnerability: The SMASH service improperly neutralizes special elements in OS commands, enabling authenticated users to perform command injection and achieve arbitrary code execution.

Business Impact

An attacker with authenticated access can leverage this vulnerability to take full control of the affected BMC or IPMI hardware. This level of access allows for persistent system compromise, potentially impacting the entire server infrastructure managed by the affected boards, warranting the high CVSS score of 8.8.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates available through the official Supermicro support portal.

Proactive Monitoring: Monitor BMC/IPMI logs for anomalous command execution or administrative activity that deviates from established baselines.

Compensating Controls: Ensure that management interfaces are restricted to isolated management networks and are not exposed to the public internet.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 22, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Command injection flaws in management interfaces are highly sensitive and can lead to complete device takeover.

Analyst Recommendation

Administrators must verify the firmware versions on the affected hardware and apply the required security patches immediately. Failure to secure management interfaces can lead to severe operational and security compromises across the server fleet.

---METADATA---
VENDOR: Youseries
PRODUCT: ureport
AFFECTED_VERSIONS: ureport v2.2.9
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the ureport component allows unauthenticated attackers to execute arbitrary SQL queries and access sensitive database information.

Executive Summary:
A critical SQL injection vulnerability in ureport v2.2.9 allows unauthenticated attackers to gain unauthorized access to database content.

Vulnerability Details

CVE-ID: CVE-2026-38158

Affected Software: Youseries ureport

Affected Versions: ureport v2.2.9

Vulnerability: The vulnerability resides in the /ureport/datasource/previewData component, which fails to properly sanitize user input. This allows an unauthenticated attacker to inject malicious SQL statements and interact directly with the backend database.

Business Impact

This vulnerability is classified as critical with a CVSS score of 9.8. The ability for an unauthenticated attacker to extract sensitive information, modify data, or potentially disrupt service poses an existential risk to the confidentiality and integrity of the underlying database.

Remediation Plan

Immediate Action: Restrict network access to the ureport datasource preview component until a security update is released by the vendor.

Proactive Monitoring: Inspect database audit logs for unauthorized queries or unusual access patterns originating from the ureport application service account.

Compensating Controls: Deploy a Web Application Firewall with rules specifically configured to detect and block SQL injection patterns targeting the /ureport/datasource/previewData endpoint.

Exploitation Status

Public Exploit Available: Yes (a public proof-of-concept exists as per security research).

Analyst Notes: As of July 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The low attack complexity makes this an attractive target for automated scanning.

Analyst Recommendation

The presence of a public proof-of-concept combined with the critical nature of the SQL injection flaw demands immediate attention. Organizations currently running ureport v2.2.9 should isolate the application from public networks and monitor for signs of unauthorized database access until a vendor-supplied patch is deployed.

---METADATA---
VENDOR: Artifex
PRODUCT: jbig2dec
AFFECTED_VERSIONS: Versions prior to commit cc37d0931aa71582f7128736a068c92cd8712d9b
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An integer overflow in the jbig2_arith_iaid_ctx_new() function of Artifex jbig2dec allows unauthenticated attackers to trigger a Denial of Service (DoS) via crafted input.

Executive Summary:
An integer overflow vulnerability in Artifex jbig2dec poses a high risk of service disruption due to potential Denial of Service attacks.

Vulnerability Details

CVE-ID: CVE-2026-38076

Affected Software: Artifex jbig2dec

Affected Versions: Versions prior to commit cc37d0931aa71582f7128736a068c92cd8712d9b

Vulnerability: The vulnerability is an integer overflow in the jbig2_arith_iaid_ctx_new() function. This flaw allows an unauthenticated, remote attacker to cause a crash or Denial of Service by supplying a specially crafted input file.

Business Impact

Successful exploitation of this vulnerability results in a Denial of Service, which can disrupt critical business operations reliant on the jbig2dec library for image processing. Given the CVSS score of 7.5, this high-severity flaw requires prompt attention to ensure system availability and stability, particularly in environments where image parsing is automated or public-facing.

Remediation Plan

Immediate Action: Update the jbig2dec software to include the fix provided in commit cc37d0931aa71582f7128736a068c92cd8712d9b or ensure the library is updated to the latest stable release incorporating this patch.

Proactive Monitoring: Monitor system logs for repeated service crashes or process terminations associated with the jbig2dec library, which may indicate attempted exploitation.

Compensating Controls: Implement file size and type validation at the application ingestion layer to block malformed or suspicious JBIG2 files before they are processed by the vulnerable library.

Exploitation Status

Public Exploit Available: No (There is no confirmed public exploit available in the provided data).

Analyst Notes: As of July 8, 2026, there is no public information indicating active exploitation or a published proof-of-concept for this vulnerability. The flaw is technically trivial to trigger (automatable) given the lack of authentication required, making patching a priority to prevent potential service instability.

Analyst Recommendation

While there is currently no evidence of active exploitation, the accessibility of this vulnerability—combined with the ease of triggering a crash—warrants immediate remediation. Organizations using jbig2dec should prioritize updating to the patched commit to prevent service disruption caused by malicious or malformed image inputs.

---METADATA---
VENDOR: ST Engineering iDirect
PRODUCT: Evolution iQ‑Series terminals
AFFECTED_VERSIONS: 0 through 4.5.2.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
ST Engineering iDirect Evolution iQ-Series terminals expose critical API endpoints without authentication, allowing unauthorized access to identity and system information.

Executive Summary:
Unauthenticated access to critical API endpoints in ST Engineering iDirect Evolution iQ-Series terminals poses a high risk of unauthorized information disclosure.

Vulnerability Details

CVE-ID: CVE-2026-38059

Affected Software: ST Engineering iDirect Evolution iQ-Series terminals

Affected Versions: 0 through 4.5.2.1

Vulnerability: The device fails to perform authentication checks on the /api/identity and /api/ REST API endpoints. This vulnerability allows an unauthenticated, remote attacker to interact with these endpoints, potentially exposing sensitive system identity data.

Business Impact

The lack of authentication on critical API endpoints presents a significant security risk, as it allows unauthorized parties to query system information without valid credentials. Given the CVSS score of 7.5, this high-severity flaw could lead to reconnaissance that facilitates further attacks against the industrial control environment, potentially resulting in operational disruption or loss of control over terminal units.

Remediation Plan

Immediate Action: Update all affected iDirect terminals to software version 4.5.2.2 or newer, which is available via the iDirect Support Portal.

Proactive Monitoring: Monitor network traffic to and from the affected API endpoints for unusual request patterns and regularly audit system access logs for unauthorized attempts.

Compensating Controls: Implement network segmentation and restrict access to the device management interfaces to trusted IP addresses using an Access Control List (ACL) or firewall rules.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of July 12, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its ease of exploitation (automatable) via standard network requests.

Analyst Recommendation

This vulnerability represents a critical exposure of management interfaces in an industrial environment. Administrators must prioritize the application of the 4.5.2.2 patch immediately to secure these endpoints and prevent unauthorized access to device identity information.

---METADATA---
VENDOR: ST Engineering iDirect
PRODUCT: Evolution iQ-Series terminals
AFFECTED_VERSIONS: 0 through 4.5.2.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
ST Engineering iDirect Evolution iQ-Series terminals fail to validate CSRF tokens on state-changing API endpoints, permitting Cross-Site Request Forgery attacks.

Executive Summary:
ST Engineering iDirect Evolution iQ-Series terminals are vulnerable to Cross-Site Request Forgery (CSRF), which could allow an attacker to perform unauthorized state-changing actions.

Vulnerability Details

CVE-ID: CVE-2026-38057

Affected Software: ST Engineering iDirect Evolution iQ-Series terminals

Affected Versions: 0 through 4.5.2.1

Vulnerability: The device fails to validate CSRF tokens on sensitive API endpoints, meaning an authenticated user could be tricked into executing unintended, unauthorized commands on the system.

Business Impact

An attacker could leverage this vulnerability to change system states, potentially disrupting communication or modifying terminal configurations without authorization. While the CVSS score is 8.1, the requirement for user interaction limits the immediate risk compared to unauthenticated remote code execution, yet the business impact remains critical for operational stability.

Remediation Plan

Immediate Action: Update the terminal firmware to version 4.5.2.2 or newer via the iDirect Support Portal.

Proactive Monitoring: Review device audit logs for unusual configuration changes or API calls that did not originate from authorized administrative sessions.

Compensating Controls: Ensure administrative interfaces are not exposed to the public internet and enforce strict session management policies for users accessing the management portal.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 11, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Operators of affected iDirect terminals should treat this as a high-priority update. Upgrading to version 4.5.2.2 is the only effective way to ensure that API endpoints are properly protected against unauthorized state-changing requests.

---METADATA---
VENDOR: CodeAstro
PRODUCT: Simple Attendance Management System
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability in CodeAstro Simple Attendance Management System v1.0 allows remote, unauthenticated attackers to bypass authentication via the username parameter in index.php.

Executive Summary:
A critical SQL injection vulnerability in CodeAstro Simple Attendance Management System allows unauthenticated attackers to bypass authentication and potentially gain full control of the application.

Vulnerability Details

CVE-ID: CVE-2026-37749

Affected Software: CodeAstro Simple Attendance Management System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize user input in the username parameter within index.php, permitting SQL injection. This flaw allows an unauthenticated attacker to manipulate database queries to bypass authentication mechanisms.

Business Impact

A successful exploit allows an unauthenticated attacker to bypass administrative login screens, potentially gaining full access to sensitive attendance records and system settings. Given the CVSS score of 9.8, this vulnerability allows for complete compromise of the application, leading to significant data exposure and loss of system integrity.

Remediation Plan

Immediate Action: As there is no official patch mentioned, users should immediately restrict access to the application via network-level controls or disable the service until a secure version is released.

Proactive Monitoring: Monitor database query logs for suspicious SQL syntax, such as UNION SELECT statements or attempts to manipulate query logic via the username field.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules specifically configured to detect and block SQL injection patterns targeting common login parameters.

Exploitation Status

Public Exploit Available: Yes — a public repository exists on GitHub (menevarad007/CVE-2026-37749).

Analyst Notes: As of April 17, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment, a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible to remote attackers and requires minimal technical skill to exploit.

Analyst Recommendation

The lack of a vendor-provided patch combined with the availability of a public proof-of-concept makes this a high-risk scenario. Organizations currently running this software should consider it compromised if exposed to the internet and take immediate steps to isolate or decommission the instance until a permanent fix is verified.

---METADATA---
VENDOR: Grokability
PRODUCT: Snipe-IT
AFFECTED_VERSIONS: 8.4.0 and earlier
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An insecure permissions vulnerability in Snipe-IT allows remote attackers to execute arbitrary code through the UploadedFilesController component.

Executive Summary:
A critical remote code execution vulnerability in Snipe-IT allows unauthenticated attackers to gain control of the application server via malicious file uploads.

Vulnerability Details

CVE-ID: CVE-2026-37709

Affected Software: Grokability Snipe-IT

Affected Versions: 8.4.0 and earlier

Vulnerability: The application fails to properly secure file permissions within the app/Http/Controllers/Api/UploadedFilesController.php component. This allows a remote attacker to upload and execute arbitrary code on the underlying server.

Business Impact

With a CVSS score of 9.8, this flaw represents the highest level of risk, enabling full remote code execution. Attackers can gain complete control over the Snipe-IT instance, potentially leading to total data exfiltration, lateral movement within the network, and complete system takeover.

Remediation Plan

Immediate Action: Update Snipe-IT to the version containing the fix for commit 676a9958 (released after 2026-03-10).

Proactive Monitoring: Inspect the app/Http/Controllers/Api/ directory and upload folders for suspicious files or unexpected executable scripts.

Compensating Controls: Use a Web Application Firewall (WAF) to block suspicious HTTP requests targeting the UploadedFilesController.php endpoint.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of May 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Remote Code Execution vulnerabilities are critical and require immediate remediation. Organizations must ensure their Snipe-IT deployment is updated beyond the specified commit to eliminate the risk of total system compromise.

---METADATA---
VENDOR: SourceCodester
PRODUCT: Client Database Management System
AFFECTED_VERSIONS: Version 1
---END_METADATA---

Description Summary:
A vulnerability in SourceCodester Client Database Management System version 1 could allow for unauthorized database access or manipulation.

Executive Summary:
The SourceCodester Client Database Management System version 1 contains a high-severity vulnerability that could lead to the compromise of sensitive client information.

Vulnerability Details

CVE-ID: CVE-2026-3764

Affected Software: SourceCodester Client Database Management System

Affected Versions: Version 1

Vulnerability: A security weakness has been identified in version 1 of this management system. Given the nature of database management applications, this flaw likely involves SQL injection or improper access control, allowing an attacker to interact directly with the underlying data store.

Business Impact

The CVSS score of 7.3 reflects a High severity risk. A successful exploit could result in the unauthorized disclosure of client records, data corruption, or the complete loss of the database, leading to significant legal liabilities and a loss of customer trust.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates or migrate to a more secure database management platform if updates are unavailable.

Proactive Monitoring: Enable database activity monitoring to detect and alert on suspicious SQL queries or bulk data exports.

Compensating Controls: Place the database management system behind a Web Application Firewall (WAF) with active SQL injection protection rules enabled.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of March 9, 2026, there is no public information indicating active exploitation of this vulnerability. However, software from SourceCodester is frequently targeted by researchers and attackers for common web vulnerabilities.

Analyst Recommendation

Immediate remediation is required to protect sensitive client data. We strongly recommend that organizations using this software update to a patched version or implement strict network segmentation to limit exposure to the database management interface.