---METADATA---
VENDOR: React
PRODUCT: create-react-app
AFFECTED_VERSIONS: react create-react-app: up to 5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A command injection vulnerability in React create-react-app (up to version 5) allows remote attackers to execute arbitrary OS commands.

Executive Summary:
A vulnerability in React create-react-app allows for OS command injection, potentially leading to unauthorized system access and execution of arbitrary code.

Vulnerability Details

CVE-ID: CVE-2026-14802

Affected Software: React create-react-app

Affected Versions: react create-react-app: up to 5

Vulnerability: The software is vulnerable to CWE-78 (OS Command Injection) and CWE-77 (Command Injection). This allows an attacker to inject and execute system-level commands, potentially gaining control over the environment where the software is being utilized.

Business Impact

The vulnerability is rated with a CVSS score of 7.3 (High). Successful exploitation could lead to a complete compromise of the build environment or developer workstation, potentially allowing for supply chain attacks, data exfiltration, or lateral movement within the corporate network.

Remediation Plan

Immediate Action: Apply vendor security updates immediately. Users should check for the latest versions of create-react-app and migrate away from vulnerable versions up to 5.

Proactive Monitoring: Monitor build pipelines and development environments for unexpected process executions or unusual modifications to system configurations.

Compensating Controls: Ensure that build environments are isolated and run with the principle of least privilege to minimize the potential impact of command execution.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of July 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, the nature of command injection flaws necessitates prompt remediation to prevent potential supply chain compromise.

Analyst Recommendation

Given the risk to development and build environments, it is critical to update your dependencies and ensure that create-react-app is not running in an insecure state. Prioritize this update to maintain the integrity of your software development lifecycle.

---METADATA---
VENDOR: SourceCodester
PRODUCT: Onlne Examination & Learning Management System
AFFECTED_VERSIONS: SourceCodester Onlne Examination & Learning Management System 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An improper authorization vulnerability in the SourceCodester Onlne Examination & Learning Management System allows unauthenticated attackers to manipulate enrollment data via ajax_enroll.php.

Executive Summary:
A critical authorization bypass vulnerability in the SourceCodester Onlne Examination & Learning Management System exposes student enrollment data to unauthorized manipulation.

Vulnerability Details

CVE-ID: CVE-2026-14778

Affected Software: SourceCodester Onlne Examination & Learning Management System

Affected Versions: SourceCodester Onlne Examination & Learning Management System 1.0

Vulnerability: The vulnerability exists within the /ajax_enroll.php file, where improper authorization allows an unauthenticated attacker to manipulate student_id, schedule_id, or action arguments. This flaw permits unauthorized modification of enrollment records within the system.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive academic records and the corruption of enrollment data. With a CVSS score of 7.3, this high-severity flaw poses a significant risk to data integrity and administrative control, potentially resulting in operational disruption and loss of trust in the learning management platform.

Remediation Plan

Immediate Action: Contact the vendor immediately for security patches. If no patch is available, restrict access to the /ajax_enroll.php file to authorized internal networks only.

Proactive Monitoring: Review web server access logs for anomalous requests targeting /ajax_enroll.php or unusual patterns in student_id and schedule_id parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block requests containing suspicious input within the specified arguments of the enrollment module.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of July 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, because a public exploit is available, the barrier to entry for attackers is low, and the potential for exploitation is high.

Analyst Recommendation

Given the availability of public exploit code and the ease of access for unauthenticated attackers, organizations utilizing this software must prioritize remediation. Until a formal vendor patch is applied, strict access controls and WAF filtering should be implemented to mitigate the risk of unauthorized data manipulation.

---METADATA---
VENDOR: SourceCodester
PRODUCT: Class and Exam Timetabling System
AFFECTED_VERSIONS: SourceCodester Class and Exam Timetabling System 1.0/1.php
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability in SourceCodester Class and Exam Timetabling System allows unauthenticated attackers to execute malicious database queries via the ID argument in edit_course1.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in the SourceCodester Class and Exam Timetabling System threatens the integrity and confidentiality of the underlying database.

Vulnerability Details

CVE-ID: CVE-2026-14772

Affected Software: SourceCodester Class and Exam Timetabling System

Affected Versions: SourceCodester Class and Exam Timetabling System 1.0/1.php

Vulnerability: The vulnerability originates in the /edit_course1.php file, where the system fails to properly sanitize the ID argument. This allows an unauthenticated attacker to inject malicious SQL commands, enabling unauthorized interaction with the backend database.

Business Impact

The potential for SQL injection represents a high risk, carrying a CVSS score of 7.3. Successful exploitation could lead to unauthorized data exfiltration, modification of course information, or complete compromise of the database, causing significant operational downtime and damage to the integrity of academic scheduling data.

Remediation Plan

Immediate Action: Seek guidance from the vendor regarding a security update. In the absence of a patch, implement strict input validation on all parameters handled by the /edit_course1.php script.

Proactive Monitoring: Monitor database logs for unusual query patterns, such as unexpected syntax errors or attempts to dump database tables.

Compensating Controls: Utilize a Web Application Firewall (WAF) to detect and block common SQL injection patterns targeting the application's URL parameters.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of July 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, the existence of a public exploit significantly increases the risk, making remediation a high priority.

Analyst Recommendation

Organizations must treat this SQL injection vulnerability with high urgency. Given the potential for full database compromise, administrators should apply any available vendor patches immediately and restrict public access to the vulnerable script until a secure version is deployed.

---METADATA---
VENDOR: SourceCodester
PRODUCT: Class and Exam Timetabling System
AFFECTED_VERSIONS: SourceCodester Class and Exam Timetabling System 1.0/1.php
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability in SourceCodester Class and Exam Timetabling System allows unauthenticated attackers to execute malicious database queries via the ID argument in edit_exam1.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in the SourceCodester Class and Exam Timetabling System exposes the application's database to unauthorized query execution.

Vulnerability Details

CVE-ID: CVE-2026-14771

Affected Software: SourceCodester Class and Exam Timetabling System

Affected Versions: SourceCodester Class and Exam Timetabling System 1.0/1.php

Vulnerability: This vulnerability resides in the /edit_exam1.php file, where the ID argument is insufficiently sanitized. An unauthenticated attacker can leverage this weakness to inject arbitrary SQL queries, directly impacting the backend database.

Business Impact

With a CVSS score of 7.3, this vulnerability presents a substantial risk to the confidentiality and integrity of exam timetabling systems. Exploitation can lead to unauthorized access to sensitive exam data, potential data loss, or unauthorized changes to scheduling, leading to significant reputational and operational impact.

Remediation Plan

Immediate Action: Contact the vendor for a patch to address the SQL injection flaw. If no update is available, restrict access to the /edit_exam1.php file via network-level controls.

Proactive Monitoring: Review server logs for anomalous traffic and database logs for signs of SQL injection attempts or unauthorized query execution.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured to inspect and filter malicious SQL syntax from incoming HTTP requests.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of July 6, 2026, there is no public information indicating active exploitation of this vulnerability. Despite this, the availability of a public exploit necessitates prompt action to protect the system from potential compromise.

Analyst Recommendation

SQL injection is a severe risk that requires immediate attention. Administrators are urged to monitor for suspicious activity and apply any vendor-supplied patches as soon as they become available to eliminate this vector of attack.

---METADATA---
VENDOR: SourceCodester
PRODUCT: Class and Exam Timetabling System
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0, allowing unauthenticated remote attackers to execute arbitrary SQL commands via the /edit_room.php file.

Executive Summary:
A critical SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 enables unauthenticated remote attackers to compromise the underlying database.

Vulnerability Details

CVE-ID: CVE-2026-14770

Affected Software: SourceCodester Class and Exam Timetabling System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection through the ID argument in the /edit_room.php file. This vulnerability is remotely exploitable by an unauthenticated attacker, requiring no prior system access or user interaction.

Business Impact

Successful exploitation of this vulnerability poses a severe risk to data integrity and confidentiality. Attackers can manipulate database queries to unauthorizedly access, modify, or delete sensitive information stored within the system. With a CVSS score of 7.3, this flaw represents a significant security gap that could lead to full database compromise and potential service disruption.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the affected script or disable the vulnerable component until a fix is released.

Proactive Monitoring: Review web server access logs for suspicious requests targeting /edit_room.php, specifically looking for SQL syntax patterns (e.g., UNION, SELECT, or comment characters).

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and block incoming requests containing SQL injection payloads directed at the /edit_room.php endpoint.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of July 6, 2026, a public exploit is available for this vulnerability. Given the ease of exploitation and the lack of an official patch, organizations should prioritize isolating the affected system immediately.

Analyst Recommendation

The presence of a public exploit for an unauthenticated SQL injection vulnerability makes this a high-priority risk. Given the absence of a vendor-provided patch, immediate network-level isolation or the implementation of strict WAF rules is necessary to prevent exploitation.

---METADATA---
VENDOR: code-projects
PRODUCT: Real State Services
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability in code-projects Real State Services 1.0 allows remote, unauthenticated attackers to execute arbitrary SQL commands via the Bankname argument in /pay.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Real State Services 1.0 permits remote attackers to manipulate database queries and potentially access sensitive data.

Vulnerability Details

CVE-ID: CVE-2026-14769

Affected Software: code-projects Real State Services

Affected Versions: 1.0

Vulnerability: The /pay.php file fails to properly sanitize the Bankname parameter, allowing an unauthenticated attacker to inject malicious SQL commands. This provides a direct vector for unauthorized database interaction without requiring user authentication.

Business Impact

This vulnerability carries a CVSS score of 7.3, indicating a high risk of unauthorized data access and potential database manipulation. Exploitation could lead to the exposure of customer or financial information, resulting in significant reputational damage and potential regulatory non-compliance for the organization managing the service.

Remediation Plan

Immediate Action: Identify and restrict access to the vulnerable /pay.php file until the vendor provides a security update.

Proactive Monitoring: Monitor application logs for anomalous database activity or attempts to submit malformed input via the Bankname field.

Compensating Controls: Utilize a Web Application Firewall (WAF) to filter and block input containing SQL injection patterns directed at the /pay.php file.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of July 6, 2026, public exploit code exists for this vulnerability. Organizations using this software should treat the risk as elevated and implement immediate protective measures to prevent unauthorized database access.

Analyst Recommendation

The combination of unauthenticated access and public exploit availability necessitates immediate action. Organizations must apply compensating controls such as WAF filtering or access restrictions to mitigate this high-risk vulnerability until a vendor patch is issued.

---METADATA---
VENDOR: code-projects
PRODUCT: Real State Services
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A critical SQL injection vulnerability in code-projects Real State Services 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the 'loc' parameter in /builderHome.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Real State Services 1.0 allows attackers to execute arbitrary SQL commands, risking total database compromise.

Vulnerability Details

CVE-ID: CVE-2026-14768

Affected Software: code-projects Real State Services

Affected Versions: 1.0

Vulnerability: The application contains a flaw in /builderHome.php where the 'loc' parameter is not properly sanitized, facilitating SQL injection. This allows an unauthenticated attacker to inject and execute arbitrary SQL commands, compromising the database layer.

Business Impact

With a CVSS score of 7.3, this vulnerability represents a significant risk to the integrity and confidentiality of the organization's data. Successful exploitation could allow attackers to bypass security controls, extract sensitive information, or disrupt service availability, potentially leading to severe business consequences.

Remediation Plan

Immediate Action: Restrict access to the /builderHome.php script immediately and seek guidance from the vendor regarding a security patch.

Proactive Monitoring: Review web server traffic and database logs for unusual query patterns or attempts to manipulate the 'loc' parameter in web requests.

Compensating Controls: Implement WAF rules specifically designed to detect and block SQL injection strings targeting the 'loc' parameter within the /builderHome.php file.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of July 6, 2026, public exploit information is available. The ease of exploitation via simple parameter manipulation makes this a critical issue that requires immediate defensive action.

Analyst Recommendation

The presence of a public exploit for this unauthenticated SQL injection vulnerability requires urgent attention. Organizations should implement defensive measures, such as WAF filtering, and restrict access to the affected script until the vendor releases a permanent fix.

---METADATA---
VENDOR: Code-Projects
PRODUCT: Hotel and Tourism Reservation
AFFECTED_VERSIONS: Code-Projects Hotel and Tourism Reservation 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the add_event.php file of Code-Projects Hotel and Tourism Reservation 1.0 allows for remote, unauthenticated database manipulation.

Executive Summary:
A critical SQL injection vulnerability in Code-Projects Hotel and Tourism Reservation 1.0 allows unauthenticated remote attackers to manipulate the backend database, potentially leading to full data compromise.

Vulnerability Details

CVE-ID: CVE-2026-14764

Affected Software: Code-Projects Hotel and Tourism Reservation

Affected Versions: Code-Projects Hotel and Tourism Reservation 1.0

Vulnerability: This is a SQL injection flaw (CWE-89) located in the add_event.php file. The application fails to properly sanitize user-supplied input, allowing an unauthenticated attacker to inject malicious SQL commands directly into the database.

Business Impact

With a CVSS score of 7.3, this vulnerability poses a severe risk to the confidentiality and integrity of the application's data. Successful exploitation could allow an attacker to dump sensitive reservation information, modify administrative records, or potentially gain unauthorized access to the underlying server environment, resulting in significant reputational and financial damage.

Remediation Plan

Immediate Action: Given the lack of a specific patch, immediately restrict access to the add_event.php file or the entire application until a secure version is released or the code is manually sanitized.

Proactive Monitoring: Review web server access logs for unusual patterns, such as SQL keywords or URL-encoded characters in request parameters, which may indicate active exploitation attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with strict SQL injection protection rules to block malicious input patterns targeting the application.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of July 7, 2026, there is a public exploit available for this vulnerability. Because the exploit is publicly disclosed, the risk of active exploitation is elevated and immediate action is required.

Analyst Recommendation

This vulnerability is highly dangerous due to the lack of authentication requirements and the availability of public exploit code. If this software is currently in use, it should be considered compromised until verified otherwise; isolate the application from the network until remediation is fully implemented.

---METADATA---
VENDOR: code-projects
PRODUCT: Hotel and Tourism Reservation
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability exists in the Hotel and Tourism Reservation system, allowing unauthenticated remote attackers to manipulate the database via the 'tour' parameter in tour_reserves.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Hotel and Tourism Reservation 1.0 poses a significant risk of unauthorized database access and data manipulation.

Vulnerability Details

CVE-ID: CVE-2026-14763

Affected Software: code-projects Hotel and Tourism Reservation

Affected Versions: 1.0

Vulnerability: This is a SQL injection (CWE-89) vulnerability located in the /admin/tour_reserves.php file. The flaw allows unauthenticated remote attackers to inject malicious SQL commands via the 'tour' parameter, bypassing existing security controls.

Business Impact

Successful exploitation of this vulnerability can lead to unauthorized access to the backend database, potentially resulting in the compromise of sensitive reservation records and personal user information. Given the CVSS score of 7.3, this flaw represents a high-severity risk to business operations, specifically regarding data confidentiality and integrity. The ability for unauthenticated actors to interact directly with the database could also lead to significant reputational damage and regulatory non-compliance.

Remediation Plan

Immediate Action: As no official patch is currently available, restrict network access to the /admin/ directory and implement strict input validation on the 'tour' parameter to neutralize the SQL injection vector.

Proactive Monitoring: Monitor web server logs for anomalous HTTP requests targeting the tour_reserves.php file, specifically looking for SQL syntax patterns or unexpected character sequences in the 'tour' parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets designed to detect and block common SQL injection payloads before they reach the application layer.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of July 6, 2026, while public exploit code is available for this vulnerability, there is no confirmed evidence of widespread exploitation in the wild. However, the availability of proof-of-concept code increases the likelihood of targeted attacks, necessitating immediate defensive measures.

Analyst Recommendation

Due to the high severity of this SQL injection vulnerability and the confirmed availability of public exploit code, organizations using the affected version of the Hotel and Tourism Reservation software must act immediately. Prioritize implementing the suggested compensating controls and strictly limit access to administrative interfaces until a formal vendor patch is released.

---METADATA---
VENDOR: code-projects
PRODUCT: Hotel and Tourism Reservation
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability exists in the rooms.php component of code-projects Hotel and Tourism Reservation 1.0, allowing unauthenticated remote attackers to compromise database integrity.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Hotel and Tourism Reservation 1.0 poses a significant risk of unauthorized database access and data manipulation.

Vulnerability Details

CVE-ID: CVE-2026-14762

Affected Software: code-projects Hotel and Tourism Reservation

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection (CWE-89) flaw located in the rooms.php file. It allows an unauthenticated attacker to inject malicious SQL commands into the application's database, potentially bypassing existing security controls.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive reservation data, loss of confidentiality, and potential modification of system records. Given the CVSS score of 7.3, this is classified as a High-severity issue that could result in significant operational disruption and data breach risks if not addressed promptly.

Remediation Plan

Immediate Action: Since a specific patch is currently unknown, administrators should restrict public access to the affected application and disable the vulnerable rooms.php functionality if not required.

Proactive Monitoring: Monitor server access logs for suspicious SQL syntax patterns, such as UNION SELECT statements or unexpected characters in URL parameters.

Compensating Controls: Implement a Web Application Firewall (WAF) with strict SQL injection filtering rules to inspect and block malicious incoming requests targeting the application.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This SQL injection vulnerability represents a critical risk to the integrity of the application database. Organizations using version 1.0 of this software must prioritize the implementation of WAF protections immediately and monitor vendor channels for the release of an official security patch.

---METADATA---
VENDOR: code-projects
PRODUCT: Hotel and Tourism Reservation
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the add_tour.php script of code-projects Hotel and Tourism Reservation 1.0 permits unauthenticated attackers to perform unauthorized database operations.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Hotel and Tourism Reservation 1.0 creates a high risk of unauthorized database interaction and information disclosure.

Vulnerability Details

CVE-ID: CVE-2026-14756

Affected Software: code-projects Hotel and Tourism Reservation

Affected Versions: 1.0

Vulnerability: This is a SQL injection (CWE-89) vulnerability residing in the add_tour.php file. By failing to properly sanitize user-supplied input, the application allows an unauthenticated attacker to execute malicious SQL statements.

Business Impact

The ability for an unauthenticated user to inject SQL commands poses a severe threat to data integrity and confidentiality. Given the CVSS score of 7.3, this vulnerability could be leveraged to compromise the entire reservation system, leading to significant reputational and financial consequences.

Remediation Plan

Immediate Action: Restrict access to the add_tour.php script to authorized personnel only, and monitor the application for any signs of unauthorized configuration changes.

Proactive Monitoring: Regularly audit database transaction logs for anomalous activity or unexpected modifications to tour-related data tables.

Compensating Controls: Utilize a Web Application Firewall to intercept and sanitize malicious traffic before it reaches the add_tour.php script, effectively neutralizing the injection vector.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high-severity rating, immediate action is required to harden the application against this SQL injection risk. Security teams should implement the aforementioned compensating controls and maintain a state of heightened vigilance until a permanent patch is released by the vendor.

---METADATA---
VENDOR: code-projects
PRODUCT: Hotel and Tourism Reservation
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability exists in the add_event.php file of code-projects Hotel and Tourism Reservation 1.0, enabling unauthenticated remote attackers to execute arbitrary SQL queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Hotel and Tourism Reservation 1.0 exposes the underlying database to unauthorized manipulation and potential data exfiltration.

Vulnerability Details

CVE-ID: CVE-2026-14755

Affected Software: code-projects Hotel and Tourism Reservation

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection (CWE-89) within the add_event.php script. An unauthenticated attacker can supply crafted input to this parameter, resulting in the execution of unauthorized database commands.

Business Impact

Exploitation of this vulnerability allows an attacker to interact directly with the application database, potentially leading to the theft of reservation records or administrative credentials. With a CVSS score of 7.3, the vulnerability presents a high risk to business operations, necessitating immediate defensive measures to prevent unauthorized data access.

Remediation Plan

Immediate Action: As no patch is currently available, restrict network access to the add_event.php endpoint to authorized internal users only.

Proactive Monitoring: Review database logs for unusual query activity or errors originating from the add_event.php script that suggest injection attempts.

Compensating Controls: Deploy WAF rules specifically designed to detect and block SQL injection payloads targeting input parameters used in the event management module.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

The presence of a high-severity SQL injection vulnerability requires immediate attention to protect the application backend. Administrators should apply perimeter security measures immediately to mitigate the risk until an official vendor update is provided.

---METADATA---
VENDOR: code-projects
PRODUCT: Hotel and Tourism Reservation
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the code-projects Hotel and Tourism Reservation system allows unauthenticated attackers to execute arbitrary database queries.

Executive Summary:
A critical SQL injection vulnerability in the code-projects Hotel and Tourism Reservation system enables unauthenticated attackers to compromise sensitive backend database information.

Vulnerability Details

CVE-ID: CVE-2026-14754

Affected Software: code-projects Hotel and Tourism Reservation

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize user-supplied input before using it in database queries (CWE-89, CWE-74), facilitating SQL injection attacks that can be performed by unauthenticated users.

Business Impact

A successful SQL injection attack can lead to total compromise of the database, including the theft of sensitive customer information or credentials. Given the 7.3 CVSS score, this vulnerability represents a high risk to business operations, as it may result in data breaches and non-compliance with data protection regulations.

Remediation Plan

Immediate Action: Audit the source code for vulnerable input fields and apply parameterized queries to neutralize the SQL injection vector.

Proactive Monitoring: Monitor database query logs for suspicious syntax, such as UNION SELECT statements or unauthorized access attempts to sensitive tables.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with SQL injection protection rules to filter malicious input before it reaches the application.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

SQL injection remains a primary vector for data exfiltration; therefore, addressing this flaw is critical. Organizations using version 1.0 should restrict access to the application immediately and prioritize the implementation of input validation and parameterized queries.

---METADATA---
VENDOR: mjperpinosa
PRODUCT: stumasy
AFFECTED_VERSIONS: up to commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A critical authorization bypass vulnerability exists in the mjperpinosa stumasy application, allowing unauthorized actors to potentially circumvent security controls.

Executive Summary:
An authorization bypass vulnerability in the mjperpinosa stumasy application poses a significant security risk by allowing unauthorized access to restricted system functions.

Vulnerability Details

CVE-ID: CVE-2026-14753

Affected Software: mjperpinosa stumasy

Affected Versions: up to commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be

Vulnerability: The application is susceptible to an authorization bypass (CWE-639, CWE-285), which allows unauthenticated attackers to perform actions that should be restricted to authorized users.

Business Impact

The ability for an unauthenticated user to bypass authorization controls threatens the integrity and confidentiality of the application. With a CVSS score of 7.3, this high-severity flaw could lead to unauthorized data modification or administrative control over the system, potentially resulting in significant operational disruption and data exposure.

Remediation Plan

Immediate Action: Verify if a patch or updated commit has been released by the developer and apply it immediately; if no patch exists, restrict network access to the application.

Proactive Monitoring: Review application access logs for unusual patterns, such as unauthorized attempts to access administrative endpoints or functions by non-privileged accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) to detect and block suspicious requests targeting authorization-related parameters or endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score and the nature of authorization bypass vulnerabilities, administrators should prioritize securing the stumasy installation. If a direct patch is unavailable from the vendor, consider isolating the instance from public-facing networks until a secure version is verified.

---METADATA---
VENDOR: mjperpinosa
PRODUCT: stumasy
AFFECTED_VERSIONS: up to commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability in mjperpinosa stumasy allows unauthenticated attackers to execute malicious database queries via improper input handling.

Executive Summary:
A critical SQL injection vulnerability in the mjperpinosa stumasy application poses a high risk by allowing unauthenticated attackers to manipulate backend database operations.

Vulnerability Details

CVE-ID: CVE-2026-14750

Affected Software: mjperpinosa stumasy

Affected Versions: up to commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be

Vulnerability: The application contains a SQL injection flaw (CWE-89, CWE-74) where unauthenticated user input is incorrectly handled, allowing for unauthorized interaction with the database.

Business Impact

This vulnerability could allow an attacker to read, modify, or delete data within the application's database. With a CVSS score of 7.3, the impact is severe, potentially leading to unauthorized data access and the compromise of system integrity, which can cause significant reputational and operational damage.

Remediation Plan

Immediate Action: Check for available updates or commits that address SQL injection flaws in the codebase and apply them immediately.

Proactive Monitoring: Monitor database logs for anomalies and unexpected query structures that deviate from normal application behavior.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect incoming traffic for common SQL injection patterns and block requests that match known malicious signatures.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Immediate remediation is required to prevent potential database compromise. If an official patch is not provided, developers must manually sanitize all database inputs using parameterized queries to effectively mitigate this high-risk vulnerability.

---METADATA---
VENDOR: mjperpinosa
PRODUCT: stumasy
AFFECTED_VERSIONS: mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A code injection vulnerability in the 'eval' function of mjperpinosa stumasy allows unauthenticated remote attackers to execute arbitrary code via the 'mathematical_sentence' argument.

Executive Summary:
An unauthenticated code injection vulnerability in mjperpinosa stumasy enables remote attackers to execute arbitrary code, creating a critical risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-14749

Affected Software: mjperpinosa stumasy

Affected Versions: mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be

Vulnerability: The application utilizes the 'eval' function within 'application/pages/imba_calculator/calculate.php' without proper input validation. This allows unauthenticated remote attackers to pass malicious payloads into the 'mathematical_sentence' argument, resulting in arbitrary code execution.

Business Impact

The ability for an unauthenticated attacker to execute arbitrary code represents the highest level of risk, as it allows for complete system takeover. With a CVSS score of 7.3, this flaw enables attackers to install backdoors, exfiltrate sensitive data, or use the compromised server as a pivot point for further network attacks, leading to severe operational and security consequences.

Remediation Plan

Immediate Action: Given the dangerous use of 'eval', developers should immediately replace the function with a safe mathematical expression parser or implement strict input validation to prevent non-mathematical characters from being processed.

Proactive Monitoring: Monitor system logs for unauthorized processes or unexpected file creation events emanating from the web server user account.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect and block payloads containing common code injection patterns, such as PHP-style execution commands, submitted to the application.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of July 6, 2026, public exploit code is available. The ease of exploitation and the potential for full system control make this a critical vulnerability that requires immediate mitigation.

Analyst Recommendation

Due to the nature of code injection via 'eval', this vulnerability should be remediated with the highest urgency. If an immediate code fix cannot be deployed, the application should be taken offline or strictly firewalled to prevent unauthorized external access until the underlying code-execution flaw is resolved.

---METADATA---
VENDOR: code-projects
PRODUCT: Real State Services
AFFECTED_VERSIONS: code-projects Real State Services 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability in code-projects Real State Services 1.0 allows unauthenticated remote attackers to manipulate database queries via the 'amen' parameter in /addprojectsale.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Real State Services 1.0 poses a significant risk of unauthorized data access and database manipulation.

Vulnerability Details

CVE-ID: CVE-2026-14747

Affected Software: code-projects Real State Services

Affected Versions: code-projects Real State Services 1.0

Vulnerability: This is a SQL injection vulnerability within the /addprojectsale.php file, specifically triggered via the 'amen' parameter. The flaw allows an unauthenticated remote attacker to inject malicious SQL commands, enabling unauthorized interaction with the underlying database.

Business Impact

The vulnerability carries a CVSS score of 7.3, reflecting its high severity and potential for significant impact. Successful exploitation could lead to the exposure of sensitive real estate data, unauthorized modification or deletion of records, and potential privilege escalation, resulting in severe operational disruption and reputational damage.

Remediation Plan

Immediate Action: As no patch is currently available, restrict access to the /addprojectsale.php endpoint and implement strict input validation for the 'amen' parameter.

Proactive Monitoring: Review web server and database logs for anomalous query patterns, specifically those containing SQL syntax characters (e.g., ' OR 1=1 --) originating from external IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets configured to detect and block SQL injection attempts targeting the affected application parameters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the ability for unauthenticated actors to compromise the database, organizations using this software should prioritize isolating the affected component. Until a formal vendor patch is released, strict input sanitization and WAF filtering are essential to mitigate the risk of unauthorized data manipulation.

---METADATA---
VENDOR: code-projects
PRODUCT: Real State Services
AFFECTED_VERSIONS: code-projects Real State Services 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability in code-projects Real State Services 1.0 allows remote unauthenticated attackers to execute arbitrary database commands via the 'amen' parameter in /addprojectrent.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Real State Services 1.0 permits remote command execution against the database, with public exploit code currently available.

Vulnerability Details

CVE-ID: CVE-2026-14746

Affected Software: code-projects Real State Services

Affected Versions: code-projects Real State Services 1.0

Vulnerability: This is a SQL injection vulnerability affecting the /addprojectrent.php file, specifically within the 'amen' parameter. An unauthenticated attacker can manipulate this parameter to execute unauthorized SQL commands, allowing for the extraction or destruction of database contents.

Business Impact

The CVSS score of 7.3 underscores the severity of this flaw, which is further elevated by the existence of public exploit code. The potential for data breaches, loss of data integrity, and unauthorized access to the underlying database structure poses a critical risk to business operations and data confidentiality.

Remediation Plan

Immediate Action: Immediately restrict access to the /addprojectrent.php endpoint and implement strict input validation for the 'amen' parameter to prevent malicious query injection.

Proactive Monitoring: Increase logging levels for database interactions and monitor for unusual query strings that suggest SQL injection attempts, especially those targeting the 'amen' parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter and block requests containing malicious SQL injection payloads targeting the identified vulnerable script.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of July 6, 2026, public exploits are available, which allows even low-skill attackers to target this system. Organizations should assume that scanners are actively searching for this vulnerability.

Analyst Recommendation

The availability of public exploit code, combined with the lack of required authentication, makes this a high-urgency issue. It is recommended to implement the suggested compensating controls immediately until a vendor-supplied patch is available.

---METADATA---
VENDOR: code-projects
PRODUCT: Real State Services
AFFECTED_VERSIONS: code-projects Real State Services 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability exists in code-projects Real State Services 1.0, allowing unauthenticated attackers to compromise database security via the 'ID' parameter in /single-list_rent.php.

Executive Summary:
A critical SQL injection vulnerability in code-projects Real State Services 1.0 is currently susceptible to public exploit code, increasing the risk of immediate compromise.

Vulnerability Details

CVE-ID: CVE-2026-14745

Affected Software: code-projects Real State Services

Affected Versions: code-projects Real State Services 1.0

Vulnerability: This is a SQL injection vulnerability located in the /single-list_rent.php file, which fails to properly sanitize the 'ID' parameter. An unauthenticated attacker can leverage this flaw to execute arbitrary database queries, leading to full database compromise.

Business Impact

With a CVSS score of 7.3 and the confirmed availability of public exploit code, this vulnerability represents an urgent threat. Successful exploitation can result in the complete breach of sensitive information, unauthorized modification or deletion of real estate listings, and unauthorized access to administrative functions.

Remediation Plan

Immediate Action: Given the availability of public exploits, immediately restrict access to the /single-list_rent.php file and implement robust server-side input validation for the 'ID' parameter.

Proactive Monitoring: Monitor database query logs for suspicious activity, particularly queries that deviate from expected patterns or attempt to bypass authentication via the 'ID' parameter.

Compensating Controls: Utilize a Web Application Firewall (WAF) to inspect incoming traffic for SQL injection signatures specifically targeting the 'ID' parameter in the affected URI.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of July 6, 2026, public exploits for this vulnerability are available, significantly lowering the barrier for entry for malicious actors. Immediate mitigation is required.

Analyst Recommendation

The combination of unauthenticated access and available public exploit code makes this a high-priority vulnerability. System administrators must treat this as an active threat and apply protective measures immediately to prevent unauthorized database access.

---METADATA---
VENDOR: code-projects
PRODUCT: Real State Services
AFFECTED_VERSIONS: code-projects Real State Services 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An SQL injection vulnerability in the Real State Services application allows unauthenticated remote attackers to execute unauthorized database queries via the 'loc' parameter.

Executive Summary:
A critical SQL injection vulnerability in code-projects Real State Services 1.0 permits unauthenticated attackers to execute arbitrary database commands, posing a significant risk of data compromise.

Vulnerability Details

CVE-ID: CVE-2026-14744

Affected Software: code-projects Real State Services

Affected Versions: code-projects Real State Services 1.0

Vulnerability: This is an SQL injection vulnerability located within the /normalHomeRent.php file. It allows unauthenticated remote attackers to manipulate the 'loc' parameter to inject and execute arbitrary SQL commands against the backend database.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive information, potential data modification, or complete database compromise. Given the CVSS score of 7.3 (High), the ability for unauthenticated remote attackers to bypass security controls and interact directly with the database poses a severe threat to the confidentiality and integrity of business data.

Remediation Plan

Immediate Action: Since no specific patch version is currently available, contact the vendor for security updates or, if possible, remove the vulnerable component from public access.

Proactive Monitoring: Monitor web server logs for suspicious HTTP requests targeting /normalHomeRent.php containing SQL-related characters or patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection attempts targeting the 'loc' parameter.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of July 6, 2026, there is no public information indicating active exploitation of this vulnerability in the wild. However, due to the public availability of exploit code, the potential for exploitation is high, and immediate defensive measures are required.

Analyst Recommendation

The presence of a public exploit for this unauthenticated SQL injection flaw makes it a high-priority risk. Organizations using code-projects Real State Services 1.0 must prioritize the implementation of WAF filtering and strict access controls until an official security patch is released by the vendor.

---METADATA---
VENDOR: code-projects
PRODUCT: Real State Services
AFFECTED_VERSIONS: code-projects Real State Services 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability in code-projects Real State Services 1.0 allows unauthenticated remote attackers to execute arbitrary database commands via the 'loc' argument in /normalHomeSale.php.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Real State Services 1.0 poses a significant risk of unauthorized database manipulation and potential data compromise.

Vulnerability Details

CVE-ID: CVE-2026-14743

Affected Software: code-projects Real State Services

Affected Versions: code-projects Real State Services 1.0

Vulnerability: This vulnerability is a classic SQL injection flaw (CWE-89) triggered by insufficient input validation in the 'loc' parameter within the /normalHomeSale.php file. Because this endpoint does not require authentication, remote attackers can interact with the application database without prior access credentials.

Business Impact

Successful exploitation of this vulnerability allows an attacker to execute arbitrary SQL commands against the backend database. Given the CVSS score of 7.3, this represents a high-severity risk that could lead to unauthorized data exfiltration, modification, or deletion of sensitive real estate records. Such an incident could result in significant reputational damage, loss of data integrity, and potential non-compliance with data privacy regulations.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict access to the vulnerable /normalHomeSale.php endpoint or take the application offline until the vendor releases a security update.

Proactive Monitoring: Security teams should review web server and database logs for anomalous query patterns, particularly those containing SQL syntax or unexpected input strings directed at the loc parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection payloads targeting the application's input parameters.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of July 6, 2026, public proof-of-concept exploits are available for this vulnerability. Organizations should treat this as an active threat, as the low complexity of the attack vector makes it a prime target for automated scanning and exploitation.

Analyst Recommendation

Due to the availability of public exploits and the unauthenticated nature of the attack vector, this vulnerability should be prioritized for immediate remediation. Organizations using code-projects Real State Services 1.0 must implement strict WAF filtering or isolate the affected service to prevent unauthorized database access until an official vendor patch is released.

---METADATA---
VENDOR: HMBRAND
PRODUCT: DBI
AFFECTED_VERSIONS: DBI versions before 1.650 for Perl
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A heap overflow vulnerability in Perl DBI before 1.650 allows remote attackers to trigger memory corruption via SQL statements with an excessive number of placeholders.

Executive Summary:
A critical heap overflow vulnerability in Perl DBI versions before 1.650 permits remote code execution or system instability through specially crafted SQL queries.

Vulnerability Details

CVE-ID: CVE-2026-14739

Affected Software: HMBRAND DBI

Affected Versions: DBI versions before 1.650 for Perl

Vulnerability: The vulnerability is a heap overflow caused by insufficient memory allocation when preparsing SQL statements containing a large volume of placeholders. This issue persists as a result of an incomplete fix for CVE-2026-10879 and allows an unauthenticated attacker to cause memory corruption.

Business Impact

This flaw carries a CVSS score of 9.8, reflecting its potential for total system compromise, including remote code execution and denial-of-service. Successful exploitation could lead to full database control, unauthorized data access, or complete service disruption, posing a severe threat to business continuity and data security.

Remediation Plan

Immediate Action: Upgrade to DBI version 1.650 or later immediately to implement the hard limit on placeholders and resolve the memory allocation defect.

Proactive Monitoring: Monitor database query performance and application logs for unusual SQL patterns or crashes that may indicate exploitation attempts.

Compensating Controls: Implement input validation at the application level to sanitize SQL queries and limit the number of placeholders allowed in dynamic SQL generation.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of Jul 7, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the critical nature of this heap overflow, all systems utilizing the Perl DBI module must be upgraded to version 1.650 or higher. Immediate patching is necessary to mitigate the risk of remote exploitation and ensure the integrity of your database environment.

---METADATA---
VENDOR: Hanwang
PRODUCT: e-Face General Management Platform
AFFECTED_VERSIONS: Hanwang e-Face General Management Platform 6.3.5.4
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the Hanwang e-Face General Management Platform allows unauthenticated remote attackers to manipulate database queries via the 'order' argument.

Executive Summary:
A critical SQL injection flaw in the Hanwang e-Face General Management Platform 6.3.5.4 exposes the system to unauthorized database manipulation by unauthenticated remote attackers.

Vulnerability Details

CVE-ID: CVE-2026-14737

Affected Software: Hanwang e-Face General Management Platform

Affected Versions: Hanwang e-Face General Management Platform 6.3.5.4

Vulnerability: This SQL injection vulnerability resides in the /sysAuthStr/querySysAuthStr.do endpoint. It permits unauthenticated remote attackers to inject malicious SQL commands by manipulating the 'order' argument within query parameters.

Business Impact

The ability for an attacker to perform SQL injection against a management platform can lead to the exfiltration of administrative credentials, unauthorized access to sensitive records, or total system compromise. With a CVSS score of 7.3, this high-severity vulnerability represents a significant risk to organizational operations and data security.

Remediation Plan

Immediate Action: Contact the vendor immediately to obtain and apply security updates for the e-Face General Management Platform.

Proactive Monitoring: Review system audit logs for anomalous database queries originating from the /sysAuthStr/querySysAuthStr.do endpoint.

Compensating Controls: Use a Web Application Firewall (WAF) to intercept and block traffic containing malicious SQL syntax directed at the application's API endpoints.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of July 6, 2026, there is no evidence of active exploitation of this vulnerability in the wild. However, the combination of remote exploitability and available proof-of-concept code necessitates urgent attention from security teams.

Analyst Recommendation

Given the critical nature of the affected platform, organizations should treat this vulnerability with high urgency. Ensure that the platform is not exposed to the public internet and apply all vendor-provided security patches immediately upon availability to mitigate the risk of unauthorized database access.

---METADATA---
VENDOR: Ruijie
PRODUCT: RG-UAC
AFFECTED_VERSIONS: Ruijie RG-UAC versions up to 1.0-R1.8.2.p5
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An unrestricted file upload vulnerability in Ruijie RG-UAC allows remote attackers to upload arbitrary files by manipulating the 'upload_image' argument in 'user_auth_commit.php'.

Executive Summary:
An unrestricted file upload vulnerability in Ruijie RG-UAC permits unauthenticated remote attackers to execute arbitrary code by uploading malicious files to the system.

Vulnerability Details

CVE-ID: CVE-2026-14736

Affected Software: Ruijie RG-UAC

Affected Versions: Ruijie RG-UAC versions up to 1.0-R1.8.2.p5

Vulnerability: The vulnerability resides in the user_auth_commit.php file, which fails to properly validate file types during the upload process. This allows an unauthenticated remote attacker to bypass security controls and upload malicious files via the upload_image argument.

Business Impact

The CVSS score of 7.3 (High) reflects the critical nature of unrestricted file upload vulnerabilities, which often lead to Remote Code Execution (RCE). Successful exploitation could allow an attacker to gain full control over the affected appliance, resulting in complete system compromise and potential lateral movement within the network.

Remediation Plan

Immediate Action: Apply the latest vendor security updates provided by Ruijie. If updates are unavailable, disable the affected file upload functionality if not strictly required for business operations.

Proactive Monitoring: Monitor the filesystem for unexpected executable files or scripts in directories where images or user-submitted content are stored.

Compensating Controls: Utilize a WAF to restrict file upload types and enforce strict access controls on the user_auth_commit.php endpoint.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of July 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, the presence of public exploit details significantly lowers the barrier for entry for malicious actors.

Analyst Recommendation

This vulnerability represents a severe risk due to the potential for arbitrary code execution. Organizations using Ruijie RG-UAC must prioritize applying the latest firmware or security patches to mitigate the risk of unauthorized system access.

---METADATA---
VENDOR: code-projects
PRODUCT: Smart Parking System
AFFECTED_VERSIONS: code-projects Smart Parking System 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability exists in the code-projects Smart Parking System 1.0, allowing unauthenticated remote attackers to execute arbitrary SQL commands and read files.

Executive Summary:
An unauthenticated SQL injection vulnerability in the code-projects Smart Parking System allows remote attackers to compromise database integrity and potentially access sensitive files.

Vulnerability Details

CVE-ID: CVE-2026-14735

Affected Software: code-projects Smart Parking System

Affected Versions: code-projects Smart Parking System 1.0

Vulnerability: The application is susceptible to SQL injection via the /parkings/parkings.php script. Unauthenticated remote attackers can manipulate parameters such as 'street', 'city', or 'status' to inject malicious SQL commands, leading to unauthorized database interaction.

Business Impact

With a CVSS score of 7.3 (High), this vulnerability poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to the application’s backend database, potentially resulting in the exfiltration of sensitive information or the exposure of arbitrary files on the host system.

Remediation Plan

Immediate Action: Contact the vendor for official security patches. In the absence of a vendor-provided update, restrict network access to the application to trusted IP addresses only.

Proactive Monitoring: Review web server and database access logs for anomalous query patterns, specifically looking for SQL syntax characters (e.g., ', --, UNION) in input parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with updated rulesets to detect and block common SQL injection patterns targeting the identified parameters.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of July 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the availability of public exploit details and the ease of unauthenticated access, the risk remains high.

Analyst Recommendation

Given the High severity rating and the presence of public exploit scripts, administrators should prioritize securing this application immediately. If an official patch is not available, implement strict input validation and WAF filtering to prevent exploitation until a permanent remediation can be applied.

---METADATA---
VENDOR: SourceCodester
PRODUCT: Class and Exam Timetabling System
AFFECTED_VERSIONS: SourceCodester Class and Exam Timetabling System 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 allows unauthenticated remote attackers to execute arbitrary SQL commands via the 'ID' parameter.

Executive Summary:
A critical SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 allows unauthenticated remote attackers to compromise the backend database.

Vulnerability Details

CVE-ID: CVE-2026-14734

Affected Software: SourceCodester Class and Exam Timetabling System

Affected Versions: SourceCodester Class and Exam Timetabling System 1.0

Vulnerability: This SQL injection vulnerability exists in the /edit_product.php file. The application fails to properly sanitize the 'ID' argument, enabling unauthenticated remote attackers to inject and execute arbitrary SQL commands.

Business Impact

Exploitation of this vulnerability allows for unauthorized data access and potential modification of the application database. Given the CVSS score of 7.3, this flaw poses a substantial risk to the confidentiality and integrity of institutional data handled by the timetabling system.

Remediation Plan

Immediate Action: Apply vendor security updates as soon as they become available. If updates are delayed, restrict access to the /edit_product.php file to trusted network segments only.

Proactive Monitoring: Monitor web traffic and database logs for unusual patterns or SQL syntax errors that may indicate an active injection attempt.

Compensating Controls: Implement a Web Application Firewall (WAF) to inspect and sanitize input parameters, specifically looking for malicious SQL injection payloads in the 'ID' field.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of July 6, 2026, there are no confirmed reports of active exploitation in the wild. However, the presence of public exploit code lowers the barrier for entry for malicious actors, increasing the overall risk.

Analyst Recommendation

This vulnerability represents a significant security oversight. Organizations must prioritize restricting access to the affected system and applying the latest security updates provided by SourceCodester to prevent unauthorized database interaction and potential data breach.

---METADATA---
VENDOR: SourceCodester
PRODUCT: Class and Exam Timetabling System
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
SourceCodester Class and Exam Timetabling System 1.0 is vulnerable to SQL injection via the 'ID' parameter, allowing unauthorized database interaction.

Executive Summary:
A critical SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 poses a significant risk of unauthorized database access and potential data manipulation.

Vulnerability Details

CVE-ID: CVE-2026-14733

Affected Software: SourceCodester Class and Exam Timetabling System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) affecting the 'ID' parameter within files such as '/edit_coursea.php'. The vulnerability allows an unauthenticated remote attacker to execute arbitrary SQL commands against the backend database.

Business Impact

Successful exploitation of this vulnerability could lead to unauthorized access to sensitive application data, potential modification of timetabling records, or administrative bypass. Given the CVSS score of 7.3, this flaw is categorized as High severity; while the score reflects the specific impact on confidentiality and integrity, the ability for remote, unauthenticated exploitation significantly elevates the operational risk to the organization.

Remediation Plan

Immediate Action: Since an official patch is currently unavailable, organizations should restrict network access to the affected application and disable the vulnerable components if possible.

Proactive Monitoring: Monitor web server access logs and database audit logs for anomalous query patterns, such as unexpected SQL syntax or unauthorized attempts to access system tables.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection signatures targeting the application's input parameters.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of July 6, 2026, public proof-of-concept exploits are available for this vulnerability, increasing the likelihood of opportunistic attacks. Security teams should prioritize limiting exposure until a vendor-supplied patch is released.

Analyst Recommendation

Due to the presence of public exploit code and the ease of remote exploitation, this vulnerability requires immediate attention. IT administrators must implement compensating controls such as WAF filtering to mitigate the risk and proactively monitor for signs of unauthorized database interaction until a definitive security update is provided by the vendor.

---METADATA---
VENDOR: SourceCodester
PRODUCT: Class and Exam Timetabling System
AFFECTED_VERSIONS: SourceCodester Class and Exam Timetabling System version 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 allows unauthenticated attackers to manipulate SQL queries via the 'ID' parameter in 'edit_exam.php'.

Executive Summary:
An unauthenticated SQL injection vulnerability in the SourceCodester Class and Exam Timetabling System allows remote attackers to manipulate database queries and potentially access sensitive data.

Vulnerability Details

CVE-ID: CVE-2026-14732

Affected Software: SourceCodester Class and Exam Timetabling System

Affected Versions: SourceCodester Class and Exam Timetabling System version 1.0

Vulnerability: The application improperly sanitizes the ID parameter within the /edit_exam.php script. This flaw allows unauthenticated remote attackers to inject malicious SQL commands, enabling unauthorized interaction with the underlying database.

Business Impact

With a CVSS score of 7.3 (High), this vulnerability poses a significant risk to the integrity and confidentiality of academic data stored within the system. Successful exploitation could lead to unauthorized data extraction, modification of exam records, or complete database compromise.

Remediation Plan

Immediate Action: Check for official updates from SourceCodester and apply them immediately. If no patch is available, implement parameterized queries or prepared statements in the source code to neutralize SQL injection vectors.

Proactive Monitoring: Monitor application logs for suspicious database query strings or high volumes of unexpected database error messages which may indicate automated scanning or injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) to inspect incoming traffic and block requests containing SQL injection payloads targeting the ID parameter.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of July 6, 2026, there is no confirmed exploitation in the wild. Despite this, the existence of public exploit code makes the system an attractive target for opportunistic attackers.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention. Organizations should audit their deployment of the Class and Exam Timetabling System and apply all available security updates to prevent potential data breaches resulting from SQL injection.

---METADATA---
VENDOR: tiddly-gittly
PRODUCT: TidGi-Desktop
AFFECTED_VERSIONS: 0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A code injection vulnerability in tiddly-gittly TidGi-Desktop allows for arbitrary command execution via improper input handling.

Executive Summary:
A code injection vulnerability in tiddly-gittly TidGi-Desktop poses a high risk, potentially allowing unauthenticated attackers to execute arbitrary code on the host system.

Vulnerability Details

CVE-ID: CVE-2026-14722

Affected Software: tiddly-gittly TidGi-Desktop

Affected Versions: 0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8

Vulnerability: The application is vulnerable to code injection (CWE-94) and general injection (CWE-74). This indicates that the software fails to properly sanitize inputs, allowing an attacker to inject and execute malicious code remotely without authentication.

Business Impact

With a CVSS score of 7.3, this flaw presents a critical threat to system integrity. Successful exploitation could grant an attacker full control over the desktop environment, leading to total system compromise, exfiltration of sensitive local data, and potential lateral movement within the user's network.

Remediation Plan

Immediate Action: Update TidGi-Desktop to the latest secure version immediately as provided in the official vendor repository.

Proactive Monitoring: Monitor the host system for unusual child processes or unauthorized file modifications initiated by the TidGi-Desktop application.

Compensating Controls: Run the application with the least privilege necessary and avoid opening untrusted TiddlyWiki files or interacting with external web-based sources while using the software.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Code injection vulnerabilities are high-severity risks that require immediate remediation. Users of TidGi-Desktop should ensure they update to the latest patched version to prevent remote attackers from achieving arbitrary code execution on their workstations.

---METADATA---
VENDOR: UTT
PRODUCT: HiPER 1250GW
AFFECTED_VERSIONS: 3.2.7-210907-180535
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The UTT HiPER 1250GW router is vulnerable to a stack-based buffer overflow, which may lead to memory corruption and potential unauthorized command execution.

Executive Summary:
A stack-based buffer overflow in the UTT HiPER 1250GW router exposes the device to memory corruption and potential remote code execution.

Vulnerability Details

CVE-ID: CVE-2026-14721

Affected Software: UTT HiPER 1250GW

Affected Versions: 3.2.7-210907-180535

Vulnerability: The device is susceptible to a stack-based buffer overflow (CWE-121) and general memory corruption (CWE-119). An authenticated attacker can exploit this vulnerability by sending specially crafted requests to the device, potentially overwriting memory and executing arbitrary code.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe risk to network infrastructure. Exploitation could lead to a complete denial of service or full remote control of the gateway, allowing attackers to intercept traffic, modify network configurations, or pivot into the internal network.

Remediation Plan

Immediate Action: Check the UTT support portal for firmware updates addressing this memory corruption flaw and apply them to all affected HiPER 1250GW devices.

Proactive Monitoring: Monitor network traffic for anomalous behavior originating from or directed at the management interface of the gateway.

Compensating Controls: If a patch is unavailable, isolate the management interface of the device from the public internet and restrict access to specific, trusted management workstations.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Network gateways are critical infrastructure; vulnerabilities of this nature can lead to total network compromise. Security teams must ensure that firmware is kept current and that management interfaces are never exposed to the public internet to prevent exploitation of this buffer overflow.

---METADATA---
VENDOR: SourceCodester
PRODUCT: Online Examination & Learning Management System
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A privilege management vulnerability in SourceCodester's Online Examination & Learning Management System 1.0 allows for potential unauthorized access.

Executive Summary:
A critical privilege management flaw in SourceCodester's Online Examination & Learning Management System could allow unauthenticated attackers to gain unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-14719

Affected Software: SourceCodester Online Examination & Learning Management System

Affected Versions: 1.0

Vulnerability: The application suffers from improper privilege management and incorrect privilege assignment (CWE-269/CWE-266). This vulnerability allows attackers to bypass intended access controls and escalate privileges within the system without authentication.

Business Impact

With a CVSS score of 7.3, this vulnerability represents a significant threat to data privacy and system integrity. Unauthorized access to an examination and learning management system can lead to the compromise of sensitive user data, alteration of examination results, and unauthorized administrative control over the platform.

Remediation Plan

Immediate Action: Contact the vendor or monitor the official SourceCodester website for security patches addressing privilege management flaws in version 1.0.

Proactive Monitoring: Inspect application access logs for unusual administrative activity or unauthorized access attempts to restricted modules.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block suspicious access patterns or unauthorized attempts to reach administrative endpoints.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 6, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Due to the ease of exploitation, immediate attention is required. Administrators should restrict external access to the application until a patch is applied and verify all current user privilege assignments to ensure no unauthorized accounts have been created.

---METADATA---
VENDOR: SourceCodester
PRODUCT: Pizzafy E-Commerce System
AFFECTED_VERSIONS: SourceCodester Pizzafy E-Commerce System 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An unauthenticated SQL injection vulnerability in SourceCodester Pizzafy E-Commerce System 1.0 permits remote attackers to execute arbitrary database queries via the 'ID' parameter.

Executive Summary:
A critical SQL injection vulnerability in SourceCodester Pizzafy E-Commerce System 1.0 allows unauthenticated attackers to manipulate backend database queries and access sensitive data.

Vulnerability Details

CVE-ID: CVE-2026-14713

Affected Software: SourceCodester Pizzafy E-Commerce System

Affected Versions: SourceCodester Pizzafy E-Commerce System 1.0

Vulnerability: The vulnerability exists in the '/admin/ajax.php?action=confirm_order' endpoint, where insufficient input sanitization of the 'ID' parameter allows for SQL injection (CWE-89). This flaw allows unauthenticated remote attackers to execute arbitrary SQL commands directly against the database.

Business Impact

With a CVSS score of 7.3, this vulnerability poses a severe risk of data breach and unauthorized modification of e-commerce records. Potential consequences include unauthorized access to customer information, order history, and administrative credentials, which could lead to significant reputational damage and financial loss for the business.

Remediation Plan

Immediate Action: As there is no official patch, verify if the vendor has issued updates or security guidance. If not, consider disabling the vulnerable endpoint or restricting access to the administrative directory to trusted IP addresses only.

Proactive Monitoring: Monitor database query logs for unusual activity, particularly queries originating from the '/admin/ajax.php' script that deviate from standard order confirmation patterns.

Compensating Controls: Implement WAF filtering to inspect incoming HTTP requests for malicious SQL injection payloads targeting the 'ID' parameter in order-related requests.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of July 6, 2026, public exploit code is available. The vulnerability's accessibility to unauthenticated users combined with the availability of an exploit makes this an urgent concern for any organization running this software.

Analyst Recommendation

The presence of public exploit code necessitates immediate action to restrict access to the vulnerable system. Security teams should prioritize limiting exposure of the administrative interface and implementing robust WAF protections until a formal vendor patch is applied.

---METADATA---
VENDOR: code-projects
PRODUCT: Online Examination
AFFECTED_VERSIONS: code-projects Online Examination 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability in the 'head.php' file of code-projects Online Examination 1.0 allows unauthenticated remote attackers to manipulate database queries.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Online Examination 1.0 poses a critical risk of unauthorized database access and data compromise.

Vulnerability Details

CVE-ID: CVE-2026-14705

Affected Software: code-projects Online Examination

Affected Versions: code-projects Online Examination 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the 'head.php' file. Unauthenticated remote attackers can manipulate the 'uname' and 'password' parameters to execute arbitrary SQL commands, potentially exposing user accounts, examination data, and system configurations.

Business Impact

Successful exploitation of this vulnerability could lead to a complete compromise of the application's backend database. Given the CVSS score of 7.3, this represents a high-severity risk that could result in unauthorized data exfiltration, loss of academic integrity, or system-wide disruption. The availability of public exploit code lowers the barrier for attackers to gain unauthorized access to sensitive institutional information.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should restrict network access to the application and implement input validation routines to sanitize the 'uname' and 'password' parameters.

Proactive Monitoring: Review web server access logs for anomalous request patterns, specifically looking for SQL syntax characters (e.g., ', --, UNION) within the 'head.php' request parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting authentication parameters.

Exploitation Status

Public Exploit Available: True

Analyst Notes: As of July 6, 2026, there is public exploit code available for this vulnerability. The risk is elevated as threat actors can leverage existing attack frameworks to target this flaw, making immediate defensive measures mandatory.

Analyst Recommendation

Organizations utilizing this software must treat this as a high-priority issue due to the confirmed public exploit availability. Until a vendor-supplied patch is released, ensure that the application is isolated from public internet access where possible and that WAF rules are strictly enforced to mitigate potential SQL injection attempts.

---METADATA---
VENDOR: code-projects
PRODUCT: Internship Management System
AFFECTED_VERSIONS: code-projects Internship Management System 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A critical SQL injection vulnerability in the employer/login.php file of code-projects Internship Management System 1.0 allows for unauthenticated remote command injection.

Executive Summary:
An unauthenticated SQL injection vulnerability in code-projects Internship Management System 1.0 poses a severe risk of unauthorized data access and potential system compromise.

Vulnerability Details

CVE-ID: CVE-2026-14700

Affected Software: code-projects Internship Management System

Affected Versions: code-projects Internship Management System 1.0

Vulnerability: This is a SQL injection vulnerability located in the employer/login.php component. The application fails to properly sanitize the email and password parameters, allowing an unauthenticated attacker to inject malicious SQL commands directly into the backend database.

Business Impact

The vulnerability carries a CVSS score of 7.3, indicating a high level of technical risk. Successful exploitation could lead to unauthorized access to sensitive internship and employer records, potentially resulting in full database compromise, data exfiltration, or modification of administrative credentials. Such a breach could cause significant reputational damage and legal liability regarding the protection of user data.

Remediation Plan

Immediate Action: Since no official patch is currently available, administrators should immediately restrict network access to the affected system and implement strict input validation on the login interface.

Proactive Monitoring: Review web server access logs for anomalous characters or SQL keywords in login attempts, and monitor database audit logs for unauthorized queries or unexpected modifications.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the login.php endpoint.

Exploitation Status

Public Exploit Available: true

Analyst Notes: As of July 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the existence of public proof-of-concept code, the potential for exploitation is high.

Analyst Recommendation

Given the availability of public exploits and the unauthenticated nature of the attack vector, this vulnerability should be treated with high priority. Organizations using this software must implement compensating controls immediately to mitigate the risk of exploitation while waiting for official vendor guidance or security updates.

Here is the vulnerability analysis report in the specified format.

Executive Summary:
A critical vulnerability has been discovered in the n8n workflow automation platform, identified as CVE-2026-1470. This flaw allows an authenticated user to execute arbitrary code on the server by crafting malicious expressions within a workflow, potentially leading to a complete system compromise, data theft, and disruption of business operations.

Vulnerability Details

CVE-ID: CVE-2026-1470

Affected Software: Unknown Multiple Products

Affected Versions: See vendor advisory for specific affected versions

Vulnerability: This is a Remote Code Execution (RCE) vulnerability within the n8n workflow Expression evaluation system. The root cause is insufficient sandboxing of the execution context where user-supplied expressions are processed. An attacker with valid credentials to the n8n instance can create or modify a workflow, embedding a specially crafted expression. When the workflow is executed, this expression is evaluated on the server with the same permissions as the n8n application process, bypassing intended security restrictions and allowing the attacker to run arbitrary system commands.

Business Impact

This vulnerability is rated as critical severity with a CVSS score of 9.9. Successful exploitation grants an attacker complete control over the n8n server. The potential business impact is severe and includes the theft of sensitive data processed by workflows (e.g., API keys, customer PII, database credentials), unauthorized modification or deletion of critical business automation, and using the compromised server as a pivot point to attack other internal systems. The reputational damage and financial loss resulting from such a compromise could be substantial.

Remediation Plan

Immediate Action:

• Patch Immediately: Prioritize updating all affected instances of Unknown Multiple Products to the latest version released by the vendor, which addresses this vulnerability.
• Monitor and Review: Actively monitor for signs of exploitation, particularly anomalous behavior from the n8n process. Thoroughly review application and system access logs for any suspicious activity, such as unusual workflow modifications or unexpected user logins, preceding the patch.

Proactive Monitoring:

• Log Analysis: Scrutinize n8n application logs for unusually complex or obfuscated expressions within workflow configurations. Monitor server system logs for unexpected child processes being spawned by the n8n application user (e.g., sh, bash, powershell.exe).
• Network Traffic: Monitor for anomalous outbound network connections from the n8n server. A sudden connection to an unknown IP address could indicate a reverse shell or data exfiltration.
• Endpoint Behavior: Utilize an Endpoint Detection and Response (EDR) solution to detect suspicious command execution, file modifications, or other post-exploitation behaviors originating from the n8n process.

Compensating Controls:
If patching cannot be performed immediately, implement the following controls to reduce risk:

• Restrict Access: Enforce the principle of least privilege. Strictly limit and review all user accounts with access to create or modify workflows on the n8n instance.
• Network Segmentation: Isolate the n8n server from critical internal networks. Implement strict egress filtering to block all outbound network traffic except for what is explicitly required for legitimate workflow operations.
• Web Application Firewall (WAF): Deploy a WAF with rules designed to detect and block common code injection and command execution payloads within HTTP requests, although this may not be a complete solution.

Exploitation Status

Public Exploit Available: False

Analyst Notes:
As of the publication date (Jan 27, 2026), there are no known public proof-of-concept exploits or observed in-the-wild attacks targeting this vulnerability. However, due to the critical CVSS score and the straightforward nature of the attack vector for an authenticated user, it is highly probable that a functional exploit will be developed and released by threat actors in the near future.

Analyst Recommendation

Given the critical CVSS score of 9.9, this vulnerability represents an immediate and severe threat to the organization. While CVE-2026-1470 is not currently listed on the CISA KEV catalog, its high impact makes it a prime candidate for future inclusion. We strongly recommend that all system owners apply the vendor-supplied patches to affected systems immediately. If patching is delayed, the compensating controls listed above must be implemented as a temporary measure, and a formal plan for patching must be established with the utmost urgency.

---METADATA---
VENDOR: SourceCodester
PRODUCT: Multi-Vendor Online Grocery Management System
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability exists in SourceCodester Multi-Vendor Online Grocery Management System 1.0, potentially allowing unauthenticated remote attackers to manipulate database queries.

Executive Summary:
A high-severity SQL injection vulnerability in SourceCodester Multi-Vendor Online Grocery Management System 1.0 poses a significant risk of unauthorized database interaction.

Vulnerability Details

CVE-ID: CVE-2026-14695

Affected Software: SourceCodester Multi-Vendor Online Grocery Management System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL Injection (CWE-89) flaw, allowing an unauthenticated attacker to inject malicious SQL commands into the application's database layer.

Business Impact

The exploitation of this vulnerability could lead to unauthorized data access, modification, or deletion within the underlying database. With a CVSS score of 7.3, this represents a significant risk to the confidentiality and integrity of business data. Successful exploitation could result in full database compromise, leading to severe reputational damage and potential regulatory non-compliance.

Remediation Plan

Immediate Action: Contact the vendor or monitor the official SourceCodester support channels for available security patches to address SQL injection flaws.

Proactive Monitoring: Implement database activity monitoring to detect anomalous query patterns or unexpected syntax errors that may indicate injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) configured with rules to detect and block common SQL injection payloads targeting input parameters.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the high CVSS score and the nature of SQL injection, administrators must prioritize identifying if this software is in use within their environment. If deployed, implement strict input validation and access controls immediately until a vendor-supplied patch is available.

---METADATA---
VENDOR: SourceCodester
PRODUCT: Multi-Vendor Online Grocery Management System
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An improper authorization vulnerability in SourceCodester Multi-Vendor Online Grocery Management System 1.0 allows for incorrect privilege assignment, potentially leading to unauthorized access.

Executive Summary:
A high-severity authorization vulnerability in SourceCodester Multi-Vendor Online Grocery Management System 1.0 creates a risk of privilege escalation and unauthorized access.

Vulnerability Details

CVE-ID: CVE-2026-14690

Affected Software: SourceCodester Multi-Vendor Online Grocery Management System

Affected Versions: 1.0

Vulnerability: This issue stems from improper authorization and incorrect privilege assignment (CWE-285/CWE-266), which may permit an unauthenticated user to bypass access controls and perform restricted administrative actions.

Business Impact

Failure to properly enforce authorization controls can allow unauthorized users to gain elevated privileges, leading to unauthorized access to sensitive financial or customer data. With a CVSS score of 7.3, this flaw threatens the confidentiality and integrity of the system. Unauthorized administrative access could result in significant business disruption and loss of trust.

Remediation Plan

Immediate Action: Review all user roles and permission assignments within the application and monitor for signs of unauthorized administrative activity.

Proactive Monitoring: Audit system logs for unexpected privilege changes or access by accounts that should not possess elevated rights.

Compensating Controls: Restrict network access to administrative interfaces using VPNs or IP whitelisting to limit the attack surface for potential unauthorized actors.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Organizations should treat this vulnerability as critical due to the potential for privilege escalation. Ensure that the application is not exposed to the public internet and verify that all current administrative accounts have appropriate and necessary access levels.

---METADATA---
VENDOR: itsourcecode
PRODUCT: Online Hotel Management System
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability exists in itsourcecode Online Hotel Management System 1.0, enabling unauthenticated remote attackers to interfere with database operations.

Executive Summary:
A high-severity SQL injection vulnerability in itsourcecode Online Hotel Management System 1.0 exposes the application to potential data breach and unauthorized database manipulation.

Vulnerability Details

CVE-ID: CVE-2026-14688

Affected Software: itsourcecode Online Hotel Management System

Affected Versions: 1.0

Vulnerability: This is a SQL Injection vulnerability (CWE-89) that allows an unauthenticated user to execute arbitrary SQL commands via the web interface, directly impacting the backend database.

Business Impact

The ability for an attacker to manipulate the database can lead to the exfiltration of sensitive guest information, booking details, or administrative credentials. With a CVSS score of 7.3, this presents a clear risk to business operations and data privacy. Such an incident could result in substantial financial liability and long-term reputational harm to the hotel business.

Remediation Plan

Immediate Action: Monitor vendor communication for patches and ensure that the database user account used by the application has the minimum necessary privileges.

Proactive Monitoring: Monitor database query logs for unusual activity, such as unexpected UNION statements or excessive errors that suggest automated injection attempts.

Compensating Controls: Implement a Web Application Firewall (WAF) to filter malicious input and sanitize incoming requests before they reach the application logic.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the severity of SQL injection vulnerabilities, immediate action is required to secure the application. If a patch is not immediately available, consider restricting access to the application to trusted internal networks only until the vulnerability is fully remediated.

---METADATA---
VENDOR: Legion of the Bouncy Castle Inc.
PRODUCT: BC-JAVA
AFFECTED_VERSIONS: BC-JAVA: 0 up to 1.85, BC-LTS-JAVA: 2.73.0 up to 2.73.12, BC-FJA: 1.0.0 up to 1.0.2.7, 2.0.0 up to 2.0.2, 2.1.0 up to 2.1.3, BC-FJA: 1.0.0 up to 1.0.24
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Bouncy Castle for Java contains a memory allocation vulnerability due to an excessive size value being processed, which can lead to a denial of service.

Executive Summary:
A memory allocation vulnerability in the Bouncy Castle cryptographic library allows unauthenticated remote attackers to trigger a denial of service condition.

Vulnerability Details

CVE-ID: CVE-2026-14682

Affected Software: Legion of the Bouncy Castle Inc. BC-JAVA

Affected Versions: BC-JAVA (0 to 1.85), BC-LTS-JAVA (2.73.0 to 2.73.12), BC-FJA (1.0.0 to 1.0.2.7, 2.0.0 to 2.0.2, 2.1.0 to 2.1.3, 1.0.0 to 1.0.24)

Vulnerability: The library is susceptible to a memory allocation flaw (CWE-789) where an unauthenticated attacker can provide input that causes the application to attempt to allocate excessive amounts of memory.

Business Impact

This vulnerability poses a significant risk to application availability. By exploiting this flaw, an attacker can crash critical services relying on the Bouncy Castle library, leading to service disruption and operational downtime. Given the high CVSS score of 8.7, organizations should prioritize remediation to prevent potential denial of service attacks that could impact business continuity.

Remediation Plan

Immediate Action: Update the Bouncy Castle library to the latest patched versions provided by the vendor.

Proactive Monitoring: Monitor server logs for unexpected spikes in memory usage or application crashes that coincide with network traffic bursts.

Compensating Controls: Ensure that applications utilizing this library are running within resource-constrained containers or environments to limit the impact of memory exhaustion.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 3, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by remote, unauthenticated actors due to the nature of the memory allocation error.

Analyst Recommendation

This high-severity vulnerability requires immediate attention due to the potential for service disruption. Administrators should verify their current library versions and deploy the vendor-provided patches as soon as possible to mitigate the risk of denial of service.

---METADATA---
VENDOR: PostgreSQL
PRODUCT: PostgreSQL
AFFECTED_VERSIONS: PostgreSQL 18 up to (excluding) 18.5, 17 up to (excluding) 17.11, 16 up to (excluding) 16.15, 15 up to (excluding) 15.19, 0 up to (excluding) 14.24
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A type confusion vulnerability in PostgreSQL internal data type arguments allows authenticated users to execute arbitrary code with the privileges of the database service account.

Executive Summary:
A high-severity type confusion vulnerability in PostgreSQL allows authenticated database users to achieve remote code execution on the underlying host.

Vulnerability Details

CVE-ID: CVE-2026-14680

Affected Software: PostgreSQL

Affected Versions: PostgreSQL 18 up to (excluding) 18.5, 17 up to (excluding) 17.11, 16 up to (excluding) 16.15, 15 up to (excluding) 15.19, 0 up to (excluding) 14.24

Vulnerability: This flaw involves a type confusion issue within the handling of internal data type arguments. An authenticated user can trigger this condition by calling specific functions, which leads to arbitrary code execution as the operating system user running the database process.

Business Impact

Successful exploitation results in full system compromise, as the attacker gains the execution privileges of the database service. Given the CVSS score of 8.8, this vulnerability poses a severe risk to data confidentiality, integrity, and availability. Unauthorized code execution could lead to complete data exfiltration, lateral movement within the network, or total destruction of database services.

Remediation Plan

Immediate Action: Update all affected PostgreSQL instances to the latest patched versions (e.g., 18.5, 17.11, 16.15, 15.19, or 14.24) as provided by the vendor.

Proactive Monitoring: Review database audit logs for suspicious function calls or unusual activity initiated by non-privileged accounts.

Compensating Controls: Restrict access to database functions and ensure that only trusted users have the necessary permissions to execute administrative or internal functions.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the potential for privilege escalation to the host operating system.

Analyst Recommendation

Organizations should prioritize patching this vulnerability immediately. Given that the vulnerability allows for code execution via authenticated function calls, applying the vendor-supplied updates is the only definitive method to mitigate the risk of host compromise.

---METADATA---
VENDOR: PostgreSQL
PRODUCT: PostgreSQL
AFFECTED_VERSIONS: 18 up to 18.5, 17 up to 17.11, 16 up to 16.15, 15 up to 15.19, 0 up to 14.24
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An integer wraparound vulnerability in 32-bit PostgreSQL builds of pltcl and plperl enables authenticated attackers to cause undersized memory allocations and trigger out-of-bounds writes.

Executive Summary:
A high-severity integer wraparound flaw in PostgreSQL 32-bit builds allows authenticated attackers to potentially execute arbitrary code or crash the database server.

Vulnerability Details

CVE-ID: CVE-2026-14677

Affected Software: PostgreSQL

Affected Versions: 18 up to 18.5, 17 up to 17.11, 16 up to 16.15, 15 up to 15.19, 0 up to 14.24

Vulnerability: This is an integer overflow or wraparound vulnerability (CWE-190) occurring within the pltcl and plperl language extensions. An attacker with authenticated access can provide crafted function bodies that manipulate memory allocation sizes, leading to out-of-bounds memory access.

Business Impact

The vulnerability carries a CVSS score of 8.8, reflecting the significant risk of total compromise of confidentiality, integrity, and availability. Successful exploitation could allow an attacker to gain elevated control over the database environment, leading to unauthorized data exfiltration, modification, or complete service disruption.

Remediation Plan

Immediate Action: Upgrade to the latest patched PostgreSQL release (e.g., 18.5, 17.11, 16.15, 15.19, or 14.24) as specified in the official vendor security advisory.

Proactive Monitoring: Review database audit logs for unusual function execution patterns or unexpected server crashes that may indicate exploitation attempts.

Compensating Controls: Restrict access to database administrative functions and the ability to create or modify procedural language functions to trusted users only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is technically complex, requiring specific 32-bit build configurations and authenticated access to trigger the overflow.

Analyst Recommendation

Given the potential for total system compromise, organizations running 32-bit PostgreSQL instances must prioritize these updates. Apply the vendor-provided patches immediately to eliminate the risk of out-of-bounds memory corruption.

---METADATA---
VENDOR: PostgreSQL
PRODUCT: PostgreSQL
AFFECTED_VERSIONS: 18 up to 18.5
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A heap-based buffer overflow in the PostgreSQL pg_stat_statements module allows authenticated users to execute arbitrary code by crafting queries containing array constants.

Executive Summary:
A critical heap buffer overflow in the PostgreSQL pg_stat_statements module enables authenticated attackers to execute arbitrary code with database service privileges.

Vulnerability Details

CVE-ID: CVE-2026-14676

Affected Software: PostgreSQL

Affected Versions: 18 up to 18.5

Vulnerability: The vulnerability exists within the pg_stat_statements module and is triggered by processing crafted queries containing array constants. The attack vector requires the user to have the ability to execute queries, which constitutes an authenticated privilege level.

Business Impact

The impact of this vulnerability is severe, as it allows for arbitrary code execution under the context of the database service account. This can lead to total loss of confidentiality, integrity, and availability of the database system. With a CVSS score of 8.8, this flaw necessitates urgent attention to prevent unauthorized access or system-wide compromise.

Remediation Plan

Immediate Action: Update PostgreSQL installations to version 18.5 or the latest available maintenance release to address the overflow vulnerability.

Proactive Monitoring: Review database logs for malformed or unusually structured queries, particularly those involving array constants, which may indicate an attempt to trigger this heap overflow.

Compensating Controls: Implement strict input validation for database queries and ensure that database users are granted only the minimum necessary privileges to perform their required tasks.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is technically significant because it targets a common extension, potentially affecting a large number of deployments if not patched promptly.

Analyst Recommendation

The risk posed by this heap buffer overflow is substantial. Administrators are strongly advised to apply the vendor-provided updates immediately to secure their database environments against potential remote code execution.

---METADATA---
VENDOR: PostgreSQL
PRODUCT: PostgreSQL
AFFECTED_VERSIONS: 18 up to 18.5, 17 up to 17.11, 16 up to 16.15, 15 up to 15.19, 0 up to 14.24
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A type confusion vulnerability in the PostgreSQL refint module allows authenticated object creators to execute arbitrary code as the operating system user running the database.

Executive Summary:
A type confusion vulnerability within the PostgreSQL refint module permits authenticated attackers to execute arbitrary code, threatening the security of the database host.

Vulnerability Details

CVE-ID: CVE-2026-14671

Affected Software: PostgreSQL

Affected Versions: 18 up to 18.5, 17 up to 17.11, 16 up to 16.15, 15 up to 15.19, 0 up to 14.24

Vulnerability: This vulnerability is a type confusion flaw in the refint module, which occurs during object creation. Exploitation requires the attacker to have authenticated access to the database to perform the necessary object manipulations.

Business Impact

Successful exploitation results in arbitrary code execution with the permissions of the database process, potentially granting the attacker full control over the host system. Given the CVSS score of 8.8, this vulnerability poses a critical risk to data integrity and infrastructure stability, making rapid remediation essential.

Remediation Plan

Immediate Action: Apply the vendor-provided security updates, upgrading to version 18.5, 17.11, 16.15, 15.19, or 14.24 as appropriate for your environment.

Proactive Monitoring: Monitor for unexpected database errors related to reference integrity checks or unusual object creation patterns that could indicate exploitation attempts.

Compensating Controls: Limit access to administrative or object creation functions to a strictly defined set of authorized users and monitor database service logs for signs of anomalous behavior.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Type confusion vulnerabilities can be complex to weaponize, but they remain a high-priority concern due to the potential for full system compromise.

Analyst Recommendation

The vulnerability in the refint module is a serious security flaw that requires prompt patching. Organizations must ensure that their PostgreSQL software is updated to the latest secure versions to mitigate the risk of unauthorized code execution.

---METADATA---
VENDOR: PostgreSQL
PRODUCT: PostgreSQL
AFFECTED_VERSIONS: 18 up to 18.5, 17 up to 17.11, 16 up to 16.15, 15 up to 15.19, 0 up to 14.24
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A heap-based buffer overflow in the PostgreSQL plperl module allows authenticated function owners to execute arbitrary code with the privileges of the database operating system user.

Executive Summary:
A heap buffer overflow vulnerability in PostgreSQL allows authenticated attackers to achieve remote code execution, posing a significant threat to database integrity and system security.

Vulnerability Details

CVE-ID: CVE-2026-14670

Affected Software: PostgreSQL

Affected Versions: 18 up to 18.5, 17 up to 17.11, 16 up to 16.15, 15 up to 15.19, 0 up to 14.24

Vulnerability: This vulnerability involves a heap-based buffer overflow triggered during the return of a tied hash in the plperl module. The attacker must have sufficient privileges to create or modify a function body, making this an authenticated exploit vector.

Business Impact

Successful exploitation allows an attacker to execute arbitrary code as the operating system user running the PostgreSQL service. This level of access typically results in full system compromise, unauthorized data exfiltration, and potential lateral movement within the network. Given the CVSS score of 8.8, this vulnerability represents a high-risk scenario that requires immediate remediation to prevent complete database and host takeover.

Remediation Plan

Immediate Action: Upgrade to the latest patched versions provided by the PostgreSQL Global Development Group, specifically versions 18.5, 17.11, 16.15, 15.19, or 14.24 and later.

Proactive Monitoring: Monitor database audit logs for unusual function creation activity or suspicious execution patterns involving the plperl language.

Compensating Controls: Restrict the ability to create or execute functions using the plperl language to trusted database users only, and ensure the database process runs with the principle of least privilege.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. While exploitation is not confirmed, the nature of buffer overflow vulnerabilities often makes them high-value targets for adversaries seeking remote code execution.

Analyst Recommendation

Due to the severity of the potential impact, organizations should prioritize patching their PostgreSQL instances. Administrators must verify their current version and apply the appropriate update from the official PostgreSQL security support portal as soon as possible.

---METADATA---
VENDOR: PostgreSQL
PRODUCT: PostgreSQL
AFFECTED_VERSIONS: 18 up to (excluding) 18.5, 17 up to (excluding) 17.11, 16 up to (excluding) 16.15, 15 up to (excluding) 15.19, 0 up to (excluding) 14.24
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A heap buffer overflow in the PostgreSQL to_char(timestamptz) function allows an authenticated user to execute arbitrary code via a malicious POSIX timezone abbreviation.

Executive Summary:
An authenticated attacker can exploit a heap buffer overflow in the PostgreSQL timezone handling logic to execute arbitrary code on the database server.

Vulnerability Details

CVE-ID: CVE-2026-14669

Affected Software: PostgreSQL

Affected Versions: 18 up to (excluding) 18.5, 17 up to (excluding) 17.11, 16 up to (excluding) 16.15, 15 up to (excluding) 15.19, 0 up to (excluding) 14.24

Vulnerability: This is a heap-based buffer overflow (CWE-122) triggered by the to_char(timestamptz) function. An authenticated attacker who can influence the timezone parameter can provide a long, malicious POSIX string to cause memory corruption and arbitrary code execution.

Business Impact

The CVSS score of 8.8 highlights the critical nature of this flaw, which allows for remote code execution within the context of the database service. This provides an attacker with the ability to perform unauthorized data exfiltration, modification, or complete system takeover, threatening the integrity of the entire database environment.

Remediation Plan

Immediate Action: Patch PostgreSQL to the most recent release versions (e.g., 18.5, 17.11, 16.15, 15.19, or 14.24) to resolve the memory handling error.

Proactive Monitoring: Monitor query logs for the usage of unusually long or malformed timezone strings in conjunction with date and time formatting functions.

Compensating Controls: Restrict database user access to administrative functions that allow the modification or setting of session-level timezone variables.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires authenticated access, which serves as a primary defensive barrier against widespread exploitation.

Analyst Recommendation

PostgreSQL administrators must prioritize updating their database software to the latest versions to mitigate this buffer overflow risk. Immediate patching is the most reliable method for neutralizing the threat posed by this vulnerability.

---METADATA---
VENDOR: PostgreSQL
PRODUCT: PostgreSQL
AFFECTED_VERSIONS: 18 up to (excluding) 18.5, 17 up to (excluding) 17.11, 16 up to (excluding) 16.15, 15 up to (excluding) 15.19, 0 up to (excluding) 14.24
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A heap buffer overflow in PostgreSQL regular expression processing allows an authenticated database user to execute arbitrary code with the privileges of the database operating system user.

Executive Summary:
A critical heap buffer overflow in PostgreSQL allows authenticated attackers to achieve arbitrary code execution on the underlying host.

Vulnerability Details

CVE-ID: CVE-2026-14664

Affected Software: PostgreSQL

Affected Versions: 18 up to (excluding) 18.5, 17 up to (excluding) 17.11, 16 up to (excluding) 16.15, 15 up to (excluding) 15.19, 0 up to (excluding) 14.24

Vulnerability: This is a heap-based buffer overflow (CWE-122) occurring during the processing of regular expressions. An authenticated attacker can submit specially crafted text that bypasses encoding validation to trigger the overflow and execute code.

Business Impact

With a CVSS score of 8.8, this vulnerability poses a severe risk to organizational infrastructure. Because the code executes with the permissions of the database service user, an attacker could escalate their control from the database level to the operating system, potentially leading to full server compromise and lateral movement.

Remediation Plan

Immediate Action: Update all instances of PostgreSQL to the latest patched versions (e.g., 18.5, 17.11, 16.15, 15.19, or 14.24) provided by the official PostgreSQL project.

Proactive Monitoring: Review database audit logs for anomalous query patterns or attempts to use complex regular expressions that deviate from normal operational behavior.

Compensating Controls: Limit the ability of database users to execute arbitrary SQL or administrative functions that utilize complex regular expression operations.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for a valid database account to trigger the overflow prevents unauthenticated external exploitation.

Analyst Recommendation

This vulnerability represents a high-risk security flaw that necessitates immediate patching of all PostgreSQL database servers. Administrators should treat this as a high-priority update to prevent potential system-level exploitation by malicious internal users.

---METADATA---
VENDOR: PostgreSQL
PRODUCT: PostgreSQL
AFFECTED_VERSIONS: 18 up to 18.5, 17 up to 17.11, 16 up to 16.15, 15 up to 15.19, 0 up to 14.24
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
An integer wraparound vulnerability in PostgreSQL tsvector and tsquery functions allows authenticated users to trigger out-of-bounds writes via crafted large inputs.

Executive Summary:
An integer wraparound flaw in PostgreSQL allows authenticated database users to perform out-of-bounds memory writes, potentially leading to arbitrary code execution or service disruption.

Vulnerability Details

CVE-ID: CVE-2026-14662

Affected Software: PostgreSQL PostgreSQL

Affected Versions: 18 up to 18.5, 17 up to 17.11, 16 up to 16.15, 15 up to 15.19, 0 up to 14.24

Vulnerability: This is an integer overflow or wraparound vulnerability (CWE-190) within the tsvector and tsquery data type processing functions. An authenticated user with sufficient database access can send specially crafted large inputs to the server, causing an undersized memory allocation and subsequent out-of-bounds write.

Business Impact

This vulnerability carries a significant risk to database integrity and availability. An attacker could crash the database service, causing downtime, or potentially manipulate memory to execute arbitrary code. The CVSS score of 8.8 highlights the critical nature of memory corruption vulnerabilities within core database infrastructure.

Remediation Plan

Immediate Action: Update your PostgreSQL installation to the latest version, specifically those excluding the affected ranges mentioned in the vendor advisory.

Proactive Monitoring: Review database audit logs for unusual queries or repeated attempts to process exceptionally large or malformed tsvector inputs.

Compensating Controls: Restrict database access to trusted users only and enforce strict input validation at the application layer where possible to prevent malicious data from reaching the database engine.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of August 14, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The technical impact is rated as total, making it a high priority for database administrators.

Analyst Recommendation

PostgreSQL is a critical component of many application stacks. Given the potential for arbitrary code execution, it is imperative that organizations prioritize patching their database instances to the recommended versions to eliminate this memory corruption vector.

---METADATA---
VENDOR: code-projects
PRODUCT: Online Job Portal
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability exists in code-projects Online Job Portal 1.0, allowing unauthenticated attackers to execute arbitrary database queries.

Executive Summary:
The code-projects Online Job Portal is vulnerable to an unauthenticated SQL injection attack, which could lead to unauthorized database access and data exfiltration.

Vulnerability Details

CVE-ID: CVE-2026-14660

Affected Software: code-projects Online Job Portal

Affected Versions: 1.0

Vulnerability: This is a SQL Injection (CWE-89) vulnerability where input is not properly sanitized before being processed in database queries. The attack vector is network-based and requires no authentication from the attacker.

Business Impact

The ability for an unauthenticated attacker to inject malicious SQL commands poses a severe risk to the confidentiality, integrity, and availability of the underlying database. With a CVSS score of 7.3, this flaw could be leveraged to dump sensitive user information or compromise portal functionality, resulting in significant reputational and operational damage.

Remediation Plan

Immediate Action: Contact the vendor for a security update or patch; if unavailable, restrict network access to the application interface.

Proactive Monitoring: Inspect web server and database logs for suspicious SQL syntax patterns or unexpected query strings originating from external IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection protection rules enabled to filter malicious traffic before it reaches the application.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

Given the severity of SQL injection vulnerabilities, immediate action is required to secure the environment. Administrators should verify the installation and contact the vendor for a fix, while implementing strict input validation and WAF rules to mitigate the risk of unauthorized database interaction.

---METADATA---
VENDOR: SourceCodester
PRODUCT: Simple and Nice Shopping Cart Script
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A SQL injection vulnerability exists in SourceCodester Simple and Nice Shopping Cart Script 1.0, enabling unauthenticated attackers to manipulate database queries.

Executive Summary:
SourceCodester Simple and Nice Shopping Cart Script contains an unauthenticated SQL injection vulnerability that risks the exposure and manipulation of sensitive shopping cart data.

Vulnerability Details

CVE-ID: CVE-2026-14654

Affected Software: SourceCodester Simple and Nice Shopping Cart Script

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection (CWE-89) because it fails to adequately sanitize user-supplied data before incorporating it into SQL commands. This flaw is remotely exploitable without requiring any user authentication.

Business Impact

A CVSS score of 7.3 highlights the significant risk posed by this vulnerability. Successful exploitation could lead to unauthorized access to customer records, order history, or financial data, potentially resulting in severe data breaches and non-compliance with data protection regulations.

Remediation Plan

Immediate Action: Seek and apply security patches provided by SourceCodester; if no patch exists, consider disabling the vulnerable script until a secure version is verified.

Proactive Monitoring: Review application access and database logs for anomalous activity, specifically looking for attempts to bypass authentication or extract table data.

Compensating Controls: Implement a Web Application Firewall (WAF) configured to block common SQL injection payloads and monitor traffic for malicious patterns.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of July 5, 2026, there is no public information indicating active exploitation of this vulnerability. However, due to the nature of the flaw, the potential for exploitation is high.

Analyst Recommendation

This vulnerability presents a clear danger to the integrity of the e-commerce platform. Security teams must prioritize patching or isolating the affected software to prevent malicious actors from gaining unauthorized access to the database.