---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An unauthenticated remote OS command injection vulnerability exists in the Totolink A8000RU CGI handler via the sambaEnabled parameter in the setStorageCfg function.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows unauthenticated remote attackers to execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-7137

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: This vulnerability occurs in the setStorageCfg function within /cgi-bin/cstecgi.cgi due to insufficient sanitization of the sambaEnabled parameter, enabling remote OS command injection.

Business Impact

The flaw grants an attacker full control over the router, which can lead to data breaches or network-wide compromise. The 9.8 CVSS score emphasizes the severity of this risk.

Remediation Plan

Immediate Action: Update to the latest firmware version and disable Samba/storage sharing features if they are not necessary.

Proactive Monitoring: Review system logs for unexpected system-level command execution.

Compensating Controls: Use a firewall to restrict access to the device's management interface.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, a public exploit is available for this vulnerability.

Analyst Recommendation

Urgent firmware updates are necessary to secure the device. If an update is not immediately available, disable all unnecessary features and restrict external access to the device.

---METADATA---
VENDOR: Red Hat
PRODUCT: Ansible Automation Platform
AFFECTED_VERSIONS: 2.5, 2.6, 2.7
CONFIDENCE: high
MISSING: none
SOURCES_JSON: [{"url":"https://access.redhat.com/errata/RHSA-2026:59135","name":"RHSA-2026:59135","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59136","name":"RHSA-2026:59136","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59153","name":"RHSA-2026:59153","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/errata/RHSA-2026:59155","name":"RHSA-2026:59155","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-71366","name":null,"tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2511902","name":"RHBZ#2511902","tags":["issue-tracking","x_refsource_REDHAT"]}]
---END_METADATA---

Description Summary:
A Server-Side Request Forgery (SSRF) vulnerability in Red Hat Ansible Automation Platform allows authenticated organization administrators to trigger unauthorized requests to internal services.

Executive Summary:
An SSRF vulnerability in the Red Hat Ansible Automation Platform notification backends could allow an authenticated attacker to perform internal network reconnaissance or exfiltrate sensitive credentials.

Vulnerability Details

CVE-ID: CVE-2026-71366

Affected Software: Red Hat Ansible Automation Platform

Affected Versions: 2.5, 2.6, 2.7

Vulnerability: This SSRF vulnerability (CWE-918) exists because notification backends fail to validate target addresses against restricted IP ranges. An authenticated organization administrator can exploit this to force the AWX control node to interact with internal services or exfiltrate Basic Authentication credentials via HTTP redirects.

Business Impact

Successful exploitation allows an attacker to bypass network segmentation, potentially accessing internal services that are not exposed to the public internet. Furthermore, the ability to exfiltrate credentials significantly increases the risk of lateral movement. Given the CVSS score of 7.7, this vulnerability presents a high risk to the confidentiality of internal infrastructure and managed credentials.

Remediation Plan

Immediate Action: Update to the patched versions as specified in the relevant Red Hat Security Advisories (RHSA-2026:59135, 59136, 59153, and 59155) immediately.

Proactive Monitoring: Review AWX notification templates for suspicious URLs and monitor outbound network traffic from the AWX control node for connections to internal, loopback, or reserved IP segments.

Compensating Controls: Implement strict egress filtering on the AWX control node to prevent it from initiating connections to unauthorized internal network segments.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 25, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the administrative privileges required to configure notification backends, which are often overlooked during routine security audits.

Analyst Recommendation

This vulnerability represents a significant risk to the integrity of the Ansible Automation Platform. Organizations must prioritize the application of the vendor-provided security patches to close the SSRF vector and prevent unauthorized access to internal resources or credential theft.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An unauthenticated remote OS command injection vulnerability exists in the Totolink A8000RU CGI handler via the wanIdx parameter in the setDmzCfg function.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows unauthenticated remote attackers to execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-7136

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: The vulnerability resides in the setDmzCfg function in the /cgi-bin/cstecgi.cgi file. Improper input validation on the wanIdx parameter allows for remote OS command injection.

Business Impact

The vulnerability provides an attacker with complete control over the device, facilitating unauthorized access to the network. The 9.8 CVSS score confirms the high severity and potential for large-scale impact.

Remediation Plan

Immediate Action: Update to the latest firmware version and disable DMZ features if not strictly required.

Proactive Monitoring: Monitor logs for unauthorized configuration changes or anomalous process execution.

Compensating Controls: Block WAN-side access to the management interface using firewall rules.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, a public exploit is available.

Analyst Recommendation

Immediate remediation is required. Organizations should ensure all Totolink devices are running the latest firmware to protect against this critical threat.

---METADATA---
VENDOR: Nuxt
PRODUCT: Nuxt
AFFECTED_VERSIONS: >= 4.0.0, < 4.5.1, >= 3.4.0, < 3.21.10
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Nuxt is susceptible to code and output injection due to improper neutralization of special elements, potentially allowing unauthorized code execution.

Executive Summary:
The Nuxt framework is affected by an injection vulnerability that could allow attackers to execute arbitrary code within the application environment.

Vulnerability Details

CVE-ID: CVE-2026-71320

Affected Software: Nuxt Nuxt

Affected Versions: >= 4.0.0, < 4.5.1, >= 3.4.0, < 3.21.10

Vulnerability: This vulnerability involves improper neutralization of special elements used in downstream components, categorized as both code and output injection. The vulnerability does not require authentication to reach the affected components.

Business Impact

Injection vulnerabilities in web frameworks often lead to Cross-Site Scripting (XSS) or remote code execution, depending on the implementation. With a CVSS score of 8.1, this represents a high-risk scenario where an attacker could compromise the integrity of the application and the confidentiality of user data.

Remediation Plan

Immediate Action: Upgrade to Nuxt version 3.21.10 or 4.5.1 to incorporate the necessary security patches.

Proactive Monitoring: Monitor application logs for unexpected input patterns or unusual server-side errors that may indicate injection attempts.

Compensating Controls: Implement strict Content Security Policies (CSP) and input validation routines to mitigate the impact of potential injection attacks.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous as it affects the core framework, making all downstream applications potentially susceptible.

Analyst Recommendation

Organizations utilizing the Nuxt framework should verify their current version and apply the recommended updates as soon as possible. Failure to patch may expose applications to severe injection-based attacks.

---METADATA---
VENDOR: nuxt
PRODUCT: nuxt
AFFECTED_VERSIONS: >= 4.4.7, < 4.5.1, >= 3.21.7, < 3.21.10
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Nuxt contains vulnerabilities related to improper handling of case sensitivity and incorrect authorization, which may lead to unauthorized access or information disclosure.

Executive Summary:
A high-severity authorization and case-sensitivity flaw in the Nuxt framework creates a risk of unauthorized data access and integrity compromise.

Vulnerability Details

CVE-ID: CVE-2026-71315

Affected Software: nuxt nuxt

Affected Versions: >= 4.4.7, < 4.5.1, >= 3.21.7, < 3.21.10

Vulnerability: This issue combines CWE-178 (Improper Handling of Case Sensitivity) and CWE-863 (Incorrect Authorization). These flaws allow an unauthenticated attacker to bypass authorization checks through case-manipulated requests.

Business Impact

With a CVSS score of 8.2, this vulnerability poses a high risk to applications built on the Nuxt framework. Successful exploitation could result in the disclosure of sensitive information or unauthorized modification of data, potentially leading to a breach of privacy or loss of application control.

Remediation Plan

Immediate Action: Update the Nuxt framework to version 3.21.10 or 4.5.1 as appropriate for your deployment.

Proactive Monitoring: Monitor server access logs for requests using inconsistent casing that may indicate attempts to bypass route-based security controls.

Compensating Controls: Ensure that server-side routing logic is configured to normalize incoming request paths before authorization checks are performed.

Exploitation Status

Public Exploit Available: No confirmed public exploit is available in the provided data.

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The combination of authorization and case-handling flaws suggests a complex, yet highly impactful, attack vector.

Analyst Recommendation

Given the critical role of the Nuxt framework in web applications, immediate patching is required. Organizations should update to the provided fixed versions to ensure that authorization policies are correctly enforced regardless of request case formatting.

---METADATA---
VENDOR: code-projects
PRODUCT: Online Lot Reservation System
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
CREDITS: z0ng (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359730","name":"VDB-359730 | code-projects Online Lot Reservation System loginuser.php sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359730/cti","name":"VDB-359730 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/800978","name":"Submit #800978 | code-projects Online Lot Reservation System 1.0 SQL Injection","tags":["third-party-advisory"]},{"url":"https://github.com/zzk6th/cve/issues/1","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://code-projects.org/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.703Z
---END_METADATA---

Description Summary:
The Online Lot Reservation System version 1.0 is vulnerable to SQL injection in the loginuser.php file, allowing unauthenticated attackers to bypass authentication and access the system.

Executive Summary:
A critical SQL injection vulnerability in the code-projects Online Lot Reservation System allows unauthenticated attackers to bypass authentication and gain unauthorized access to the application.

Vulnerability Details

CVE-ID: CVE-2026-7131

Affected Software: code-projects Online Lot Reservation System

Affected Versions: 1.0

Vulnerability: The application is susceptible to SQL injection via the email and password parameters in the loginuser.php file. This flaw permits an unauthenticated attacker to manipulate database queries to bypass login mechanisms entirely.

Business Impact

The ability for an unauthenticated user to bypass authentication protocols poses a severe risk to data integrity and confidentiality. Successful exploitation allows unauthorized access to administrative or user accounts, potentially leading to full system compromise and the exposure of sensitive reservation data. With a CVSS score of 7.3, this high-severity vulnerability warrants immediate attention to prevent unauthorized data access and potential service disruption.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict network access to the loginuser.php endpoint or disable the affected module entirely until a secure update is released by the vendor.

Proactive Monitoring: Security teams should monitor web server access logs for anomalous POST requests to loginuser.php, specifically identifying patterns involving SQL syntax characters like single quotes and comment indicators.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection payloads targeting the login parameters.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the security researcher's technical write-up provided in the referenced GitHub repository.

Analyst Notes: As of April 29, 2026, there is no confirmed active exploitation in the wild; however, a functional proof-of-concept is publicly available, which significantly lowers the barrier for entry for malicious actors. The vulnerability stems from the direct concatenation of user input into database queries.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a significant risk to any organization running the Online Lot Reservation System. Organizations must prioritize the implementation of compensating controls, such as WAF filtering, and actively seek a secure replacement or vendor-supplied patch to mitigate the risk of unauthorized account takeover.

---METADATA---
VENDOR: rclone
PRODUCT: rclone
AFFECTED_VERSIONS: >= 1.40.0, < 1.75.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
A path traversal vulnerability in rclone versions 1.40.0 through 1.74.9 allows authenticated users to read or write files outside of the intended directory via malicious path manipulation.

Executive Summary:
An authenticated path traversal vulnerability in rclone allows unauthorized file system access, requiring an immediate update to version 1.75.0 to secure file operations.

Vulnerability Details

CVE-ID: CVE-2026-71309

Affected Software: rclone rclone

Affected Versions: >= 1.40.0, < 1.75.0

Vulnerability: This vulnerability involves improper limitation of pathnames to a restricted directory (CWE-22), enabling an authenticated attacker to traverse the file system and access or modify files beyond the scope of the configured storage provider.

Business Impact

The CVSS score of 8.6 indicates a critical risk to data confidentiality and integrity. Successful exploitation could lead to the exposure of sensitive configuration files, credentials, or other critical data stored on the system, potentially resulting in full system compromise.

Remediation Plan

Immediate Action: Upgrade rclone to version 1.75.0 or later to resolve the path traversal flaw.

Proactive Monitoring: Audit rclone execution logs for unusual file access patterns or attempts to access system directories outside of the designated sync paths.

Compensating Controls: Enforce strict file system permissions for the user account running rclone to limit the impact if a traversal attempt occurs.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is inherently exploitable if input sanitization is bypassed during path resolution.

Analyst Recommendation

Given the availability of a proof-of-concept and the high severity of path traversal vulnerabilities, users must upgrade to version 1.75.0 without delay. Failure to patch leaves the underlying file system exposed to unauthorized manipulation by any authenticated user with access to the tool.

---METADATA---
VENDOR: Apache Software Foundation
PRODUCT: Apache Camel
AFFECTED_VERSIONS: 4.0.0 up to (excluding) 4.14.9, 4.15.0 up to (excluding) 4.18.4, 4.19.0 up to (excluding) 4.22.0
CONFIDENCE: high
MISSING: none
CREDITS: Barak Srour from Apiiro (finder); Andrea Cosentino (remediation developer)
SOURCES_JSON: [{"url":"https://camel.apache.org/security/CVE-2026-71300.html","name":null,"tags":["vendor-advisory"]}]
---END_METADATA---

Description Summary:
An improper input validation flaw in the Apache Camel Atmosphere Websocket component allows unauthenticated remote attackers to manipulate message routing via injected HTTP headers.

Executive Summary:
A critical input validation vulnerability in Apache Camel allows unauthenticated remote attackers to hijack message dispatching, potentially leading to unauthorized data exposure or complete communication interception.

Vulnerability Details

CVE-ID: CVE-2026-71300

Affected Software: Apache Software Foundation Apache Camel

Affected Versions: 4.0.0 up to (excluding) 4.14.9, 4.15.0 up to (excluding) 4.18.4, 4.19.0 up to (excluding) 4.22.0

Vulnerability: The vulnerability exists because the Atmosphere Websocket producer fails to properly filter header values that fall outside the standard Camel namespace. An unauthenticated attacker can inject specific headers to override intended message recipients and redirect traffic to unauthorized WebSocket peers.

Business Impact

This vulnerability carries a CVSS score of 9.8, reflecting its critical severity and the ease of remote exploitation. Successful exploitation could lead to the unauthorized interception of sensitive data, disruption of critical messaging flows, and a complete breakdown of communication integrity within affected enterprise integrations.

Remediation Plan

Immediate Action: Upgrade to Apache Camel version 4.14.9, 4.18.4, 4.22.0, or higher, depending on your current release branch.

Proactive Monitoring: Review application logs for unusual HTTP header activity, particularly requests containing unexpected websocket prefix headers, which may indicate attempted exploitation.

Compensating Controls: Implement strict input validation or header filtering at the Web Application Firewall (WAF) or API Gateway layer to block requests containing unauthorized websocket-related headers before they reach the Camel application.

Exploitation Status

Public Exploit Available: Yes — a public proof-of-concept exists via the GitHub repository referenced in the enrichment data.

Analyst Notes: As of Aug 24, 2026, there is no confirmed active exploitation in the wild; however, a public proof-of-concept repository exists on GitHub, and the vulnerability is inherently easy to exploit due to the lack of required authentication. The flaw arises from the inheritance of HttpHeaderFilterStrategy, which fails to secure dotted names outside the Camel namespace.

Analyst Recommendation

Given the high impact and the availability of public proof-of-concept code, this vulnerability poses an immediate threat to the integrity of data handled by Apache Camel. Organizations should prioritize updating their Camel deployments to the latest patched versions to eliminate this attack vector. If patching is not immediately feasible, ensure that network perimeter defenses are configured to inspect and sanitize incoming HTTP headers.

---METADATA---
VENDOR: SourceCodester
PRODUCT: Pharmacy Sales and Inventory System
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
CREDITS: christychen11 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359729","name":"VDB-359729 | SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359729/cti","name":"VDB-359729 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/800975","name":"Submit #800975 | sourcecodester Pharmacy Sales and Inventory System V1.0 SQL injection","tags":["third-party-advisory"]},{"url":"https://github.com/lonelyuan/vunls/issues/11","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.sourcecodester.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.703Z
---END_METADATA---

Description Summary:
A SQL injection vulnerability in SourceCodester Pharmacy Sales and Inventory System 1.0 allows unauthenticated remote attackers to manipulate database queries via the id parameter in ajax.php.

Executive Summary:
A critical SQL injection vulnerability in the Pharmacy Sales and Inventory System allows unauthenticated attackers to gain unauthorized database access and potentially compromise system integrity.

Vulnerability Details

CVE-ID: CVE-2026-7130

Affected Software: SourceCodester Pharmacy Sales and Inventory System

Affected Versions: 1.0

Vulnerability: This is an SQL injection vulnerability (CWE-89) located in the /ajax.php endpoint. An unauthenticated attacker can supply malicious input via the id parameter, which is processed by the backend without proper sanitization or parameterization, allowing for unauthorized SQL command execution.

Business Impact

Successful exploitation allows an attacker to bypass authentication mechanisms, exfiltrate sensitive pharmacy records, modify or delete critical data, and potentially gain comprehensive control over the underlying database. Given the nature of the application, this poses a significant risk to data privacy and regulatory compliance. The CVSS score of 7.3 reflects the high impact on data confidentiality and integrity, combined with the ease of remote, unauthenticated exploitation.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /ajax.php endpoint at the web server level to trusted internal networks only.

Proactive Monitoring: Review web server and database logs for anomalous requests to /ajax.php, specifically searching for SQL syntax characters such as single quotes, semicolons, or common SQL injection keywords in the id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the id parameter.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, attributed to the security researcher's technical write-up on GitHub.

Analyst Notes: As of April 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible as it requires no prior authentication to execute.

Analyst Recommendation

The absence of a vendor-supplied patch necessitates immediate defensive action to protect the database environment. Administrators must prioritize limiting exposure by restricting network access to the application and implementing WAF rules to filter malicious traffic. Continued monitoring of system logs is essential until a formal update is released and applied.

---METADATA---
VENDOR: Bolt
PRODUCT: core
AFFECTED_VERSIONS: 0 through 6.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Bolt CMS is vulnerable to a security flaw where content field values are rendered through the Twig environment without a SandboxExtension, potentially allowing unauthorized code execution.

Executive Summary:
Bolt CMS is affected by an improper rendering flaw that could allow an authenticated attacker to compromise system confidentiality, integrity, and availability.

Vulnerability Details

CVE-ID: CVE-2026-71291

Affected Software: Bolt core

Affected Versions: 0 through 6.1

Vulnerability: The application fails to register a SandboxExtension within the Twig environment, which is classified under CWE-1336. An authenticated attacker can exploit this to perform unauthorized actions within the system.

Business Impact

The vulnerability carries a high CVSS score of 8.8, reflecting the potential for full compromise of the application environment. Successful exploitation could allow an attacker to read or modify sensitive content and potentially disrupt system availability, posing a critical risk to the platform.

Remediation Plan

Immediate Action: Review the Bolt CMS official repository for security patches and upgrade to a version beyond 6.1.

Proactive Monitoring: Monitor server logs for unusual Twig template execution patterns or unexpected changes to content fields.

Compensating Controls: Restrict administrative access to trusted personnel only to minimize the risk of exploitation by authenticated users.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently dangerous due to the lack of sandboxing in template rendering.

Analyst Recommendation

Due to the severity of this vulnerability, administrators should prioritize updating the Bolt CMS core to a secure version. Organizations should treat this as a high-priority task to prevent potential exploitation of the template rendering mechanism.

---METADATA---
VENDOR: Apache Software Foundation
PRODUCT: Apache HttpComponents Client
AFFECTED_VERSIONS: 5.4-alpha through 5.6.3
CONFIDENCE: high
MISSING: none
CREDITS: n0mi1k (finder)
SOURCES_JSON: [{"url":"https://lists.apache.org/thread/bhf7g2zwpom2ohvwjjjlonc93br2s8vq","name":null,"tags":["vendor-advisory"]}]
---END_METADATA---

Description Summary:
Apache HttpComponents Client fails to properly perform TLS hostname verification when using the async HttpClient, allowing attackers to impersonate servers via valid certificates for different domains.

Executive Summary:
A critical TLS hostname verification flaw in Apache HttpComponents Client allows unauthenticated attackers to perform man-in-the-middle attacks and impersonate legitimate servers.

Vulnerability Details

CVE-ID: CVE-2026-71290

Affected Software: Apache Software Foundation Apache HttpComponents Client

Affected Versions: 5.4-alpha through 5.6.3

Vulnerability: This vulnerability involves improper certificate validation (CWE-295) occurring within the async version of the HttpClient library. An unauthenticated attacker capable of intercepting network traffic can bypass hostname verification and successfully impersonate a server by presenting a certificate valid for a different domain.

Business Impact

Successful exploitation allows an attacker to intercept, view, and modify sensitive data in transit between the client and the server. Given the CVSS score of 9.1, this vulnerability poses a severe risk to confidentiality and integrity, potentially leading to unauthorized access to credentials or private information, which could result in significant reputational or financial damage.

Remediation Plan

Immediate Action: Update the Apache HttpComponents Client library to version 5.6.4 or later, as this release contains the necessary fix for the hostname verification policy.

Proactive Monitoring: Review application network logs for unusual TLS handshake patterns or unexpected certificate errors that may indicate active man-in-the-middle attempts.

Compensating Controls: Ensure that all communication channels utilize strict TLS configurations and consider implementing certificate pinning where feasible to mitigate the impact of failed hostname verification.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 11, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous because it undermines the fundamental security of encrypted connections, making it a high priority for remediation in any environment utilizing the affected async client.

Analyst Recommendation

Due to the critical nature of this vulnerability and the potential for total compromise of traffic integrity, organizations should prioritize the update to version 5.6.4 immediately. Verify that your development teams are not relying on the classic version of the library if they believe they are affected, as only the async version is vulnerable. Consistent patch management is essential to protecting data in transit from interception by malicious actors.

---METADATA---
VENDOR: NASA-AMMOS
PRODUCT: anms
AFFECTED_VERSIONS: All versions
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
The NASA-AMMOS ANMS reference implementation exposes its REST API directly to the network without authentication, allowing remote attackers to send unauthorized commands to DTNMA agents.

Executive Summary:
A critical authentication bypass in NASA-AMMOS ANMS exposes the REST API to the network, enabling unauthenticated attackers to execute arbitrary commands and disrupt network management operations.

Vulnerability Details

CVE-ID: CVE-2026-71289

Affected Software: NASA-AMMOS anms and JHUAPL-DTNMA dtnma-tools

Affected Versions: All versions

Vulnerability: The system incorrectly publishes the REST API on the host network without requiring authentication, and the underlying CivetWeb server is configured with a null authentication callback for command-dispatch endpoints.

Business Impact

An attacker can enumerate managed network agents and submit arbitrary command sets, which could lead to unauthorized control over simulated or real ground nodes. This represents a significant risk to the integrity of the network management testbed and associated ground operations.

Remediation Plan

Immediate Action: Update the software to the latest version and ensure the REST API is not exposed to public network interfaces.

Proactive Monitoring: Audit network configurations for any services bound to public interfaces that should be restricted to local or trusted segments.

Compensating Controls: Deploy a firewall or reverse proxy with mandatory authentication to gate access to the REST API endpoints.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The exposure of sensitive command interfaces without credentials makes the system highly susceptible to unauthorized manipulation.

Analyst Recommendation

While this software is described as a reference implementation, it is vital to secure any instances deployed in operational or testing environments. Administrators must restrict network access and verify that authentication mechanisms are correctly enabled.

---METADATA---
VENDOR: Koha
PRODUCT: Koha
AFFECTED_VERSIONS: 0 through 26.05.01-1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Koha's guided report builder contains a SQL injection vulnerability that allows authenticated users to execute arbitrary database commands.

Executive Summary:
A high-severity SQL injection vulnerability in the Koha guided report builder allows authenticated attackers to compromise the underlying database.

Vulnerability Details

CVE-ID: CVE-2026-71288

Affected Software: Koha Koha

Affected Versions: 0 through 26.05.01-1

Vulnerability: This vulnerability is a SQL injection (CWE-89) within the guided report builder component, which allows a user with low-level privileges to manipulate database queries.

Business Impact

Successful exploitation allows an attacker to bypass security controls, leading to unauthorized data exfiltration, modification, or complete database destruction. Given the CVSS score of 8.8, this vulnerability poses a significant risk to the confidentiality, integrity, and availability of sensitive library management data.

Remediation Plan

Immediate Action: Upgrade to a version of Koha beyond 26.05.01-1 to resolve the underlying SQL injection flaw.

Proactive Monitoring: Review application access logs for unusual patterns in the guided reports module and monitor database query logs for suspicious syntax or unexpected execution times.

Compensating Controls: Implement strict input validation or use a Web Application Firewall (WAF) to detect and block common SQL injection payloads targeting report parameters.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires an authenticated session, limiting its exploitability to internal or registered users.

Analyst Recommendation

The severity of this vulnerability necessitates immediate attention to prevent database-level compromise. Administrators should prioritize updating the Koha installation to the latest patched release to neutralize this injection risk.

---METADATA---
VENDOR: Cacti
PRODUCT: cacti
AFFECTED_VERSIONS: 0 through 1.3.0-dev
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The sanitize_sql_column function in Cacti is vulnerable to SQL injection, potentially allowing an authenticated attacker to manipulate database queries.

Executive Summary:
A SQL injection vulnerability in the Cacti platform allows an authenticated attacker to execute arbitrary database queries, potentially leading to unauthorized data access or modification.

Vulnerability Details

CVE-ID: CVE-2026-71287

Affected Software: Cacti cacti

Affected Versions: 0 through 1.3.0-dev

Vulnerability: The flaw exists in the sanitize_sql_column function (CWE-89), which fails to properly neutralize SQL commands, allowing an authenticated attacker to perform SQL injection attacks.

Business Impact

Successful exploitation permits an attacker to read, modify, or delete sensitive information stored within the Cacti database. Given the CVSS score of 8.8, this vulnerability poses a high risk to data integrity and confidentiality, which could lead to severe operational disruption or loss of administrative control.

Remediation Plan

Immediate Action: Monitor the Cacti project for an official security update and apply it immediately upon release.

Proactive Monitoring: Review database query logs for suspicious patterns or unauthorized SQL syntax, specifically originating from authenticated user sessions.

Compensating Controls: Use a Web Application Firewall to filter malicious SQL injection patterns and ensure database service accounts operate with the minimum necessary permissions.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently critical as it bypasses intended database query sanitization.

Analyst Recommendation

Administrators should treat this SQL injection vulnerability as a high priority. Until a patch is available, it is recommended to audit existing user accounts and limit access to the Cacti interface to trusted personnel only to reduce the attack surface.

---METADATA---
VENDOR: Hugging Face
PRODUCT: peft
AFFECTED_VERSIONS: 0 through 0.19.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The LoRA-GA and CorDA initialization modules in Hugging Face peft are vulnerable to deserialization of untrusted data, which may lead to arbitrary code execution.

Executive Summary:
A high-severity deserialization vulnerability in the Hugging Face peft library could allow an attacker to execute arbitrary code on systems processing malicious model initialization modules.

Vulnerability Details

CVE-ID: CVE-2026-71281

Affected Software: Hugging Face peft

Affected Versions: 0 through 0.19.1

Vulnerability: The vulnerability involves improper deserialization of untrusted data (CWE-502) within the LoRA-GA and CorDA initialization modules, which can be triggered by an unauthenticated attacker via user-assisted interaction.

Business Impact

Exploitation of this vulnerability allows for remote code execution, which could result in complete loss of control over the affected environment. With a CVSS score of 8.8, the potential for unauthorized access to sensitive machine learning models and underlying infrastructure is substantial.

Remediation Plan

Immediate Action: Check the Hugging Face peft repository for the latest security release and update the library to the patched version as soon as it becomes available.

Proactive Monitoring: Monitor applications using the peft library for abnormal execution behavior or unexpected file system modifications during the model loading phase.

Compensating Controls: Implement strict input validation for any model or configuration files loaded by the application and run processes with the least privilege necessary.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherently significant because it involves the deserialization of untrusted input, a common vector for code execution.

Analyst Recommendation

Users of the Hugging Face peft library should monitor the official project repository for a security patch. Given the high severity of deserialization flaws, it is critical to restrict the processing of untrusted model files until a fix is applied.

---METADATA---
VENDOR: go-shiori
PRODUCT: shiori
AFFECTED_VERSIONS: 0 and later
CONFIDENCE: medium
MISSING: patch
---END_METADATA---

Description Summary:
A Server-Side Request Forgery vulnerability in the DownloadBookmark function of go-shiori allows authenticated attackers to perform unauthorized requests.

Executive Summary:
A high-severity Server-Side Request Forgery vulnerability in the go-shiori bookmarking tool allows authenticated attackers to perform unauthorized network requests.

Vulnerability Details

CVE-ID: CVE-2026-71280

Affected Software: go-shiori shiori

Affected Versions: All versions from 0 and later

Vulnerability: The DownloadBookmark function fails to properly sanitize user-supplied input, leading to a Server-Side Request Forgery (SSRF) vulnerability. An attacker with low-level privileges can leverage this to force the application to interact with internal resources.

Business Impact

An SSRF vulnerability allows an attacker to bypass network access controls, potentially accessing internal services or metadata endpoints that are not exposed to the public internet. Given the CVSS score of 8.5, this vulnerability represents a high risk to organizational infrastructure, as it can be used for internal reconnaissance or to pivot into protected network segments.

Remediation Plan

Immediate Action: Review the official go-shiori repository for available security patches and apply them immediately once released.

Proactive Monitoring: Monitor outgoing network requests from the host running shiori for connections directed toward internal IP addresses or sensitive local services.

Compensating Controls: Deploy the application within a restricted network environment that enforces strict egress filtering to prevent unauthorized internal communication.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw's exploitability is limited by the requirement for low-level authentication, which serves as an initial barrier to entry.

Analyst Recommendation

While an immediate patch may be pending, the high impact of SSRF necessitates proactive network-level defenses. Administrators should isolate the service from sensitive internal resources and monitor for suspicious outbound traffic until a formal update is deployed.

---METADATA---
VENDOR: SourceCodester
PRODUCT: Pharmacy Sales and Inventory System
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
CREDITS: christychen11 (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359727","name":"VDB-359727 | SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359727/cti","name":"VDB-359727 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/800973","name":"Submit #800973 | sourcecodester Pharmacy Sales and Inventory System V1.0 SQL injection","tags":["third-party-advisory"]},{"url":"https://github.com/lonelyuan/vunls/issues/13","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.sourcecodester.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.703Z
---END_METADATA---

Description Summary:
The SourceCodester Pharmacy Sales and Inventory System 1.0 contains an unauthenticated SQL injection vulnerability in the /ajax.php endpoint via the id parameter.

Executive Summary:
An unauthenticated SQL injection vulnerability in the SourceCodester Pharmacy Sales and Inventory System allows remote attackers to compromise database integrity and confidentiality.

Vulnerability Details

CVE-ID: CVE-2026-7128

Affected Software: SourceCodester Pharmacy Sales and Inventory System

Affected Versions: 1.0

Vulnerability: This is a SQL injection vulnerability (CWE-89) located in the /ajax.php file. An unauthenticated attacker can manipulate the id parameter to execute arbitrary SQL queries against the backend database.

Business Impact

Successful exploitation permits unauthorized access to the application database, which may lead to the exfiltration of sensitive pharmacy and inventory data. Given the CVSS score of 7.3, this vulnerability poses a significant risk to data confidentiality and integrity, potentially resulting in regulatory non-compliance and reputational damage.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /ajax.php endpoint via network controls or web server configurations until a vendor-supplied update is released.

Proactive Monitoring: Review web server access logs for anomalous POST requests to /ajax.php containing SQL syntax or unusual characters in the id parameter.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the id parameter.

Exploitation Status

Public Exploit Available: Yes, a proof-of-concept exists as documented in the provided GitHub repository issue.

Analyst Notes: As of April 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is trivial to exploit due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the lack of authentication required for exploitation, this vulnerability presents a clear and present danger to affected systems. Organizations must prioritize restricting access to the vulnerable endpoint immediately and should monitor for any signs of unauthorized database interaction until the vendor provides a formal security update.

---METADATA---
VENDOR: iot-ecology
PRODUCT: rust-iot-platform
AFFECTED_VERSIONS: 0 and later
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The rust-iot-platform software lacks authentication on a calc rule creation endpoint, allowing unauthenticated attackers to execute arbitrary JavaScript code via unsanitized input.

Executive Summary:
An unauthenticated remote code execution vulnerability in rust-iot-platform allows attackers to execute malicious JavaScript within the server process.

Vulnerability Details

CVE-ID: CVE-2026-71278

Affected Software: iot-ecology rust-iot-platform

Affected Versions: 0 and later

Vulnerability: This vulnerability is a Code Injection (CWE-94) flaw where the application fails to perform an authentication check on the POST /calc-rule/create endpoint. An unauthenticated attacker can inject arbitrary JavaScript into a calc rule that the system subsequently executes without sandboxing.

Business Impact

The ability for an unauthenticated attacker to execute arbitrary code on the server carries a critical risk of full system compromise. With a CVSS score of 9.8, this flaw could lead to complete data exfiltration, unauthorized modification of IoT configurations, or total service disruption, severely impacting business operations and data integrity.

Remediation Plan

Immediate Action: Upgrade to the latest available version of rust-iot-platform immediately as provided by the vendor. If a patch is not yet available, restrict network access to the API endpoints to trusted IP addresses only.

Proactive Monitoring: Review web server access logs for anomalous POST requests to the /calc-rule/create endpoint. Monitor server processes for unexpected child tasks or unusual resource consumption patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized requests to the calc-rule management API.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The lack of sandboxing during the evaluation of user-provided scripts makes this target highly susceptible to exploitation once discovered.

Analyst Recommendation

This is a critical vulnerability that requires immediate attention due to the lack of authentication required for exploitation. Administrators must prioritize the application of vendor-supplied updates to neutralize the risk of unauthorized remote code execution.

---METADATA---
VENDOR: openshwprojects
PRODUCT: OpenBK7231T_App
AFFECTED_VERSIONS: 0 and later
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A cross-site scripting vulnerability exists in the CHANNEL_SetLabel() function of OpenBK7231T_App, which may allow for unauthorized script execution.

Executive Summary:
A high-severity cross-site scripting vulnerability in OpenBK7231T_App could allow an adjacent attacker to execute arbitrary scripts in the context of the user session.

Vulnerability Details

CVE-ID: CVE-2026-71274

Affected Software: openshwprojects OpenBK7231T_App

Affected Versions: 0 and later

Vulnerability: This is a cross-site scripting (CWE-79) vulnerability located in the CHANNEL_SetLabel() function. The vulnerability is exploitable by an unauthenticated attacker positioned on the adjacent network.

Business Impact

The exploitation of this vulnerability could lead to the compromise of sensitive user information and unauthorized actions performed on behalf of legitimate users. With a CVSS score of 8.5, this high-severity flaw represents a significant risk to the integrity and confidentiality of the application environment.

Remediation Plan

Immediate Action: Monitor the official repository for the release of a security patch and apply it immediately upon availability.

Proactive Monitoring: Review web application logs for unusual request patterns, specifically focusing on parameters interacting with channel labels.

Compensating Controls: Implement a Web Application Firewall to filter malicious scripts and restrict access to the management interface from untrusted networks.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw requires the attacker to be on the adjacent network, which limits the potential attack surface.

Analyst Recommendation

Given the high CVSS score, organizations should prioritize the mitigation of this vulnerability. As no patch is currently identified, administrators must rely on network segmentation and strict access controls to prevent unauthorized access to the application interface until an official vendor update is provided.

---METADATA---
VENDOR: usememos
PRODUCT: memos
AFFECTED_VERSIONS: 0 through 0.29.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A race condition vulnerability exists in the Memos webhook dispatch function within the safeDialContext implementation.

Executive Summary:
Memos is susceptible to a race condition in its webhook dispatch function, which could be leveraged by an authenticated user to achieve unintended network interactions.

Vulnerability Details

CVE-ID: CVE-2026-71272

Affected Software: usememos memos

Affected Versions: 0 through 0.29.1

Vulnerability: This vulnerability is categorized as a Time-of-Check to Time-of-Use (TOCTOU) race condition (CWE-367) located in the safeDialContext function. An authenticated attacker can manipulate the dispatch process to potentially bypass intended security checks during the connection phase.

Business Impact

The CVSS score of 8.5 highlights the severity of this flaw. By exploiting this race condition, an attacker may be able to reach internal resources that should be restricted, potentially leading to unauthorized information disclosure or interaction with internal API endpoints.

Remediation Plan

Immediate Action: Monitor the official Memos repository and apply the security update as soon as the vendor releases a patched version addressing the race condition.

Proactive Monitoring: Review application logs for unexpected or rapid webhook dispatch attempts that could indicate an exploitation effort.

Compensating Controls: Employ network-level micro-segmentation to ensure the Memos application has limited visibility into the local network environment.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. Race conditions are inherently difficult to exploit reliably, but they remain a high-risk vector in network-facing components.

Analyst Recommendation

Due to the nature of race conditions, patching is the only definitive way to eliminate the vulnerability. Administrators should ensure that the Memos application is isolated within the network until a permanent fix is applied and verified.

---METADATA---
VENDOR: usememos
PRODUCT: memos
AFFECTED_VERSIONS: 0 through 0.29.1
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A server-side request forgery vulnerability exists in the Memos webhook URL validation logic, specifically within the isReservedIP function.

Executive Summary:
The Memos application contains a server-side request forgery vulnerability in its webhook validation logic that could allow an authenticated user to bypass security controls.

Vulnerability Details

CVE-ID: CVE-2026-71271

Affected Software: usememos memos

Affected Versions: 0 through 0.29.1

Vulnerability: The flaw, classified as CWE-918, exists in the isReservedIP function within the webhook validation module. An authenticated attacker can exploit this to bypass IP restrictions and force the application to interact with unintended network targets.

Business Impact

With a CVSS score of 8.5, this vulnerability represents a significant risk. If exploited, an attacker could potentially interact with internal infrastructure, leading to unauthorized data access or the bypassing of perimeter security controls for internal-only services.

Remediation Plan

Immediate Action: Users should monitor the official Memos repository for a patched release and update immediately upon availability.

Proactive Monitoring: Audit webhook configuration logs for entries pointing to internal IP addresses or unusual network destinations.

Compensating Controls: Implement strict network-level egress filtering for the server hosting Memos to ensure it cannot communicate with internal-only network segments.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherent to the logic handling webhook validations, which requires authenticated access to trigger.

Analyst Recommendation

The reliance on webhook validation makes this a critical security concern for deployments that allow external integrations. Organizations should restrict administrative access and apply the forthcoming patch as soon as the vendor provides a remediation update.

---METADATA---
VENDOR: Stirling-Tools
PRODUCT: Stirling-PDF
AFFECTED_VERSIONS: All versions
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A server-side request forgery vulnerability exists in the Stirling-PDF ConvertWebsiteToPDF endpoint, allowing unauthenticated attackers to potentially access internal resources.

Executive Summary:
An unauthenticated server-side request forgery vulnerability in Stirling-PDF allows attackers to make unauthorized requests to internal network resources.

Vulnerability Details

CVE-ID: CVE-2026-71270

Affected Software: Stirling-Tools Stirling-PDF

Affected Versions: All versions

Vulnerability: This is a Server-Side Request Forgery (CWE-918) vulnerability in the POST /api/v1/convert/url/pdf endpoint. The vulnerability is exploitable by unauthenticated attackers, as indicated by the CVSS vector.

Business Impact

With a CVSS score of 8.6, this vulnerability represents a significant threat to internal network security. An attacker could leverage this flaw to probe internal infrastructure, access sensitive metadata services, or interact with non-public internal web applications, bypassing perimeter defenses.

Remediation Plan

Immediate Action: Check the Stirling-PDF repository for security updates and apply the latest version to mitigate the SSRF flaw.

Proactive Monitoring: Monitor network traffic for unexpected outbound requests originating from the server hosting Stirling-PDF, particularly requests directed toward internal IP ranges.

Compensating Controls: Restrict the application server's ability to initiate outbound network connections to internal resources using firewall rules or network segmentation.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to its unauthenticated nature and potential to bypass network perimeters.

Analyst Recommendation

This vulnerability is highly critical due to its potential for internal network reconnaissance. Users should restrict access to the Stirling-PDF instance until a patch is applied and verify that the application cannot reach sensitive internal endpoints.

---METADATA---
VENDOR: SourceCodester
PRODUCT: Pharmacy Sales and Inventory System
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
CREDITS: renyu (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359726","name":"VDB-359726 | SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359726/cti","name":"VDB-359726 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/800972","name":"Submit #800972 | sourcecodester Pharmacy Sales and Inventory System V1.0 SQL injection","tags":["third-party-advisory"]},{"url":"https://github.com/y1shiny1shin/vuldb-project/issues/1","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.sourcecodester.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.703Z
---END_METADATA---

Description Summary:
SourceCodester Pharmacy Sales and Inventory System 1.0 contains an unauthenticated SQL injection vulnerability in the ajax.php file via the delete_receiving action.

Executive Summary:
An unauthenticated SQL injection vulnerability in the SourceCodester Pharmacy Sales and Inventory System allows remote attackers to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2026-7127

Affected Software: SourceCodester Pharmacy Sales and Inventory System

Affected Versions: 1.0

Vulnerability: The application fails to properly sanitize user input in the /ajax.php endpoint when the action parameter is set to delete_receiving. This SQL injection flaw allows an unauthenticated remote attacker to execute arbitrary database commands.

Business Impact

The ability for an unauthenticated user to inject SQL commands poses a significant risk to data integrity and confidentiality. With a CVSS score of 7.3, this high-severity vulnerability could lead to unauthorized data exfiltration, modification of inventory records, or complete compromise of the backend database. Such an event would result in operational disruption and potential regulatory non-compliance regarding patient data.

Remediation Plan

Immediate Action: As no official patch is currently available, restrict access to the affected web application to trusted networks only and disable the vulnerable /ajax.php endpoint if it is not required for core operations.

Proactive Monitoring: Monitor server access logs for anomalous requests to the /ajax.php file, specifically looking for unusual patterns or characters commonly used in SQL injection payloads.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the identified endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical reference provided by the security researcher at https://github.com/y1shiny1shin/vuldb-project/issues/1.

Analyst Notes: As of April 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The flaw is highly accessible due to the lack of required authentication.

Analyst Recommendation

Given the availability of a public proof-of-concept and the ease of exploitation, this vulnerability presents a high risk to any organization utilizing the affected software. Security teams should prioritize isolating the application from the public internet and applying strict input validation controls as a temporary measure until a vendor-supplied patch is released.

---METADATA---
VENDOR: thiagoralves
PRODUCT: OpenPLC_v3
AFFECTED_VERSIONS: 0 and later
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenPLC Runtime v3 contains a path traversal vulnerability in its compile_program function, allowing remote authenticated users to write arbitrary files to the filesystem.

Executive Summary:
A critical path traversal vulnerability in OpenPLC Runtime v3 allows authenticated attackers to achieve remote code execution by overwriting arbitrary system files.

Vulnerability Details

CVE-ID: CVE-2026-71268

Affected Software: thiagoralves OpenPLC_v3

Affected Versions: 0 and later

Vulnerability: The application fails to validate the file path during the processing of uploaded Structured Text files, enabling a path traversal flaw (CWE-22) that permits arbitrary file writes. The vulnerability is accessible to authenticated users, though the presence of hardcoded default credentials significantly lowers the barrier to entry.

Business Impact

Successful exploitation grants an attacker the ability to overwrite sensitive system configuration files or inject malicious code into startup scripts. Given the CVSS score of 9.9, this vulnerability poses a catastrophic risk to system integrity and availability, potentially leading to a complete compromise of the underlying host and any connected industrial control systems.

Remediation Plan

Immediate Action: Upgrade to the latest version of OpenPLC v3 immediately to incorporate path validation logic into the compile_program function.

Proactive Monitoring: Review access logs for unusual file upload activity or attempts to access system directories such as /etc/ or /home/.

Compensating Controls: Change the default credentials (openplc:openplc) immediately and restrict network access to the OpenPLC web interface to trusted management subnets.

Exploitation Status

Public Exploit Available: No (exploit_available: unknown)

Analyst Notes: As of Aug 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly exploitable due to the combination of insecure file handling and weak default authentication.

Analyst Recommendation

This is a critical vulnerability that requires immediate remediation. Administrators must prioritize updating the software and enforcing strong, unique credentials to prevent unauthorized access and potential remote code execution.

---METADATA---
VENDOR: rxi
PRODUCT: microtar
AFFECTED_VERSIONS: 0 and later
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A stack buffer overflow exists in rxi microtar due to improper boundary checks when copying filenames into the header structure.

Executive Summary:
A critical stack buffer overflow in the rxi microtar library allows for potential remote code execution when processing maliciously crafted filenames.

Vulnerability Details

CVE-ID: CVE-2026-71267

Affected Software: rxi microtar

Affected Versions: 0 and later

Vulnerability: The functions mtar_write_file_header and mtar_write_dir_header perform a strcpy operation into a fixed-size 100-byte stack buffer without verifying the input length. This allows an attacker to supply a filename exceeding 99 characters, triggering an overflow that can be exploited by unauthenticated remote attackers.

Business Impact

Successful exploitation of this buffer overflow could lead to arbitrary code execution, allowing an attacker to gain control over the host process. Given the 9.8 CVSS score, this represents a major threat to system integrity and availability, particularly for applications that handle untrusted archives or user-provided filenames.

Remediation Plan

Immediate Action: Review applications utilizing the microtar library to ensure all input filenames are strictly validated for length before being passed to library functions.

Proactive Monitoring: Monitor for application crashes or segmentation faults that may indicate an attempt to exploit memory corruption vulnerabilities.

Compensating Controls: Compile the application with modern memory safety protections, such as stack canaries and Address Space Layout Randomization (ASLR), to increase the difficulty of successful exploitation.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of Aug 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is inherent to the library's design and requires developers to implement input validation at the call site.

Analyst Recommendation

Developers should immediately audit their use of the microtar library and implement mandatory length checks for all filenames. Until a formal library update is available, manual input sanitization is the most effective way to mitigate this critical risk.

---METADATA---
VENDOR: Aircoookie
PRODUCT: WLED
AFFECTED_VERSIONS: 0 and later
CONFIDENCE: medium
MISSING: patch
---END_METADATA---

Description Summary:
The WLED project contains a broken access control vulnerability in the GET /json/cfg endpoint that allows unauthenticated modification of configuration settings.

Executive Summary:
An unauthenticated broken access control flaw in the WLED configuration endpoint exposes the device to unauthorized settings modification.

Vulnerability Details

CVE-ID: CVE-2026-71264

Affected Software: Aircoookie WLED

Affected Versions: 0 and later

Vulnerability: This vulnerability (CWE-862) exists within the /json/cfg endpoint. It permits an unauthenticated attacker to perform unauthorized configuration changes, which could lead to full control over the device settings.

Business Impact

The CVSS score of 8.2 highlights a high risk of unauthorized configuration manipulation. In an industrial or commercial lighting environment, this could lead to service disruption, device bricking, or the use of compromised devices as a pivot point within the internal network.

Remediation Plan

Immediate Action: Review the official WLED project repository for security guidance and apply any available firmware updates. If no update is available, restrict access to the WLED interface to trusted network segments only.

Proactive Monitoring: Monitor network traffic to the WLED device for unauthorized access to the /json/cfg endpoint.

Compensating Controls: Place the device on an isolated VLAN with no direct access from the public internet or untrusted internal segments.

Exploitation Status

Public Exploit Available: No confirmed public exploit is available in the provided data.

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The accessibility of the configuration endpoint without authentication makes this a significant risk for exposed IoT devices.

Analyst Recommendation

Users of WLED should prioritize network-level isolation for these devices until a formal patch is applied. The lack of authentication on the configuration endpoint is a severe security oversight that must be mitigated by restricting network exposure as a primary defense.

---METADATA---
VENDOR: IoTSharp
PRODUCT: IoTSharp
AFFECTED_VERSIONS: All versions prior to the patched version
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
IoTSharp fails to enforce authorization on its BlobStorageController, allowing unauthenticated remote attackers to perform arbitrary file operations via path traversal.

Executive Summary:
A critical authentication bypass and path traversal vulnerability in IoTSharp is currently being actively exploited in the wild.

Vulnerability Details

CVE-ID: CVE-2026-71262

Affected Software: IoTSharp IoTSharp

Affected Versions: All versions prior to the patched version

Vulnerability: The application fails to apply authorization requirements to the BlobStorageController, permitting unauthenticated attackers to access sensitive endpoints. Furthermore, improper input sanitization on file paths allows for arbitrary file system access, including the potential for remote code execution via web shell upload.

Business Impact

This vulnerability carries a CVSS score of 9.8, reflecting its critical severity. Successful exploitation allows unauthorized actors to read, modify, or delete sensitive data, and potentially gain full control over the host system. Given its inclusion in the CISA Known Exploited Vulnerabilities (KEV) catalog, the urgency for remediation is extreme to prevent data breaches or total system compromise.

Remediation Plan

Immediate Action: Update to the latest version of IoTSharp as soon as it is made available by the vendor to implement mandatory authorization checks and path sanitization.

Proactive Monitoring: Review application and web server access logs for requests targeting the BlobStorageController or unusual file path patterns that suggest directory traversal attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block directory traversal sequences (such as double dots and slashes) and restrict access to the BlobStorageController endpoints.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: This vulnerability is confirmed to be actively exploited in the wild as of August 4, 2026. The combination of missing authentication and path traversal makes this an highly attractive target for threat actors.

Analyst Recommendation

Due to confirmed active exploitation in the wild, organizations must prioritize this vulnerability immediately. Apply the latest available vendor security updates and monitor network traffic for signs of compromise until patching is complete.

---METADATA---
VENDOR: SourceCodester
PRODUCT: Pharmacy Sales and Inventory System
AFFECTED_VERSIONS: 1.0
CONFIDENCE: high
MISSING: patch
CREDITS: renyu (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359725","name":"VDB-359725 | SourceCodester Pharmacy Sales and Inventory System ajax.php sql injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359725/cti","name":"VDB-359725 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/800971","name":"Submit #800971 | sourcecodester Pharmacy Sales and Inventory System V1.0 SQL injection","tags":["third-party-advisory"]},{"url":"https://github.com/y1shiny1shin/vuldb-project/issues/2","name":null,"tags":["exploit","issue-tracking"]},{"url":"https://www.sourcecodester.com/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.703Z
---END_METADATA---

Description Summary:
SourceCodester Pharmacy Sales and Inventory System 1.0 is susceptible to remote SQL injection via the ID argument in the /ajax.php?action=save_category endpoint.

Executive Summary:
A critical SQL injection vulnerability in SourceCodester Pharmacy Sales and Inventory System 1.0 allows unauthenticated remote attackers to manipulate database queries.

Vulnerability Details

CVE-ID: CVE-2026-7126

Affected Software: SourceCodester Pharmacy Sales and Inventory System

Affected Versions: 1.0

Vulnerability: This vulnerability is a SQL injection flaw (CWE-89) triggered by improper sanitization of the ID argument within the /ajax.php?action=save_category endpoint. The vulnerability is exploitable by unauthenticated remote attackers.

Business Impact

The ability for an unauthenticated attacker to inject arbitrary SQL commands poses a significant risk to data confidentiality and integrity. Successful exploitation could lead to unauthorized access to sensitive pharmacy records, inventory data, or potential database compromise. With a CVSS score of 7.3, this high-severity flaw requires immediate attention to prevent unauthorized data exfiltration or system manipulation.

Remediation Plan

Immediate Action: As no official patch is currently available, administrators should restrict access to the /ajax.php endpoint via network-level controls or web server configuration.

Proactive Monitoring: Monitor server access logs for anomalous requests containing SQL syntax or unusual parameters directed toward the /ajax.php file.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common SQL injection patterns targeting the identified vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the referenced GitHub issue.

Analyst Notes: As of April 29, 2026, there is no confirmed active exploitation in the wild; however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The vulnerability is highly accessible due to the lack of required authentication.

Analyst Recommendation

Given the availability of public proof-of-concept code and the ease of exploitation, this vulnerability presents a clear risk to environments running the affected system. Organizations should prioritize isolating the vulnerable application from public access until a security update is provided by the vendor. Immediate implementation of WAF rules and heightened monitoring is essential to mitigate the risk of exploitation.

---METADATA---
VENDOR: ESPHome
PRODUCT: esphome
AFFECTED_VERSIONS: 0 through 2026.7.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
ESPHome through 2026.7.0 contains a vulnerability related to incomplete validation of data, which may allow for significant system impact.

Executive Summary:
ESPHome versions up to 2026.7.0 are affected by an input validation vulnerability that could result in total system compromise.

Vulnerability Details

CVE-ID: CVE-2026-71259

Affected Software: ESPHome esphome

Affected Versions: 0 through 2026.7.0

Vulnerability: This vulnerability involves a flaw in configuration validation (CWE-184). The attack vector is local, requiring user interaction to trigger, but could lead to high confidentiality, integrity, and availability impacts.

Business Impact

With a CVSS score of 8.6, this vulnerability represents a high risk to organizational security. Successful exploitation could lead to unauthorized control over the affected ESPHome environment, potentially allowing attackers to manipulate device configurations or gain unauthorized access to the underlying system.

Remediation Plan

Immediate Action: Monitor the official ESPHome GitHub repository for the release of a security patch and apply it as soon as it becomes available.

Proactive Monitoring: Review system configuration logs for unexpected validation errors or unauthorized modifications to device settings.

Compensating Controls: Ensure devices running ESPHome are isolated within restricted network segments to limit the potential impact of a local exploit.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability.

Analyst Recommendation

Given the high CVSS score and the potential for total impact, administrators should prioritize this issue. Closely track vendor communications regarding the patch, and ensure that all affected instances are updated once a fix is released.

---METADATA---
VENDOR: debevv
PRODUCT: nanoMODBUS
AFFECTED_VERSIONS: 0 through 1.23.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
nanoMODBUS contains an out-of-bounds stack read and wild-pointer write vulnerability in its Modbus identification response handling, which can be triggered by a malicious server.

Executive Summary:
A critical memory corruption vulnerability in the nanoMODBUS library allows for potential arbitrary code execution via a malicious server response.

Vulnerability Details

CVE-ID: CVE-2026-71256

Affected Software: debevv nanoMODBUS

Affected Versions: 0 through 1.23.0

Vulnerability: The library fails to perform bounds checking on the object_id field when processing Modbus Device Identification responses (CWE-125). An unauthenticated remote attacker can provide a crafted response that causes an out-of-bounds read, leading to an arbitrary-address write with controlled data.

Business Impact

The ability to perform arbitrary-address writes typically results in remote code execution or complete application crashes. With a CVSS score of 9.8, this vulnerability poses a severe threat to the availability and integrity of any system integrating the nanoMODBUS library.

Remediation Plan

Immediate Action: Monitor the official debevv nanoMODBUS GitHub repository for the release of a patched version. If a patch is not yet available, evaluate the feasibility of disabling Modbus identification features in affected deployments.

Proactive Monitoring: Monitor network traffic for anomalous Modbus protocol traffic patterns or unexpected device identification responses.

Compensating Controls: Deploy network-based intrusion detection systems to inspect Modbus traffic and filter out malformed or suspicious identification response packets.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The technical nature of the flaw makes it highly exploitable for memory corruption attacks.

Analyst Recommendation

This vulnerability is critical due to the potential for memory corruption and code execution. Organizations should track the project repository for updates and move to version 1.23.1 or later as soon as it becomes available.

---METADATA---
VENDOR: debevv
PRODUCT: nanoMODBUS
AFFECTED_VERSIONS: 0 through 1.23.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
A buffer overflow vulnerability exists in nanoMODBUS versions up to 1.23.0, potentially allowing for arbitrary code execution or denial of service.

Executive Summary:
The nanoMODBUS library contains a buffer overflow vulnerability that poses a high risk of service disruption or unauthorized data access.

Vulnerability Details

CVE-ID: CVE-2026-71255

Affected Software: debevv nanoMODBUS

Affected Versions: 0 through 1.23.0

Vulnerability: This is a buffer overflow vulnerability (CWE-787) that occurs due to improper bounds checking. It is remotely exploitable and does not require authentication or user interaction.

Business Impact

The CVSS score of 8.6 reflects the significant risk posed by this vulnerability. Exploitation can lead to service crashes or the compromise of data integrity, which may disrupt critical industrial or automation processes reliant on the nanoMODBUS library.

Remediation Plan

Immediate Action: Check for available vendor updates and apply the latest version of nanoMODBUS immediately upon release.

Proactive Monitoring: Monitor network traffic for malformed MODBUS packets or unexpected spikes in CPU usage that may indicate a crash or exploitation attempt.

Compensating Controls: Deploy network-level intrusion detection systems to identify and block traffic patterns indicative of buffer overflow attempts against MODBUS services.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability.

Analyst Recommendation

The severity of this flaw necessitates immediate attention. Organizations utilizing nanoMODBUS should evaluate their exposure and prepare for an urgent update once the vendor provides a patched release.

---METADATA---
VENDOR: debevv
PRODUCT: nanoMODBUS
AFFECTED_VERSIONS: nanoMODBUS through v1.23.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
An out-of-bounds write vulnerability in nanoMODBUS allows unauthenticated attackers to corrupt memory and potentially achieve remote code execution via a malformed Modbus request.

Executive Summary:
A critical out-of-bounds write vulnerability in nanoMODBUS is confirmed to be under active exploitation in the wild.

Vulnerability Details

CVE-ID: CVE-2026-71254

Affected Software: debevv nanoMODBUS

Affected Versions: nanoMODBUS through v1.23.0

Vulnerability: The Modbus server-side function handle_read_file_record fails to validate the cumulative response size of sub-requests, leading to an integer overflow in the accumulator. This allows unauthenticated network clients to trigger an out-of-bounds write, corrupting memory beyond the designated buffer.

Business Impact

With a CVSS score of 9.8, this flaw poses a severe risk to operational technology and embedded systems. Exploitation can lead to a complete denial of service or remote code execution, which may result in the loss of control over industrial processes or critical infrastructure. Inclusion in the CISA KEV catalog necessitates immediate administrative attention.

Remediation Plan

Immediate Action: Update to the latest version of nanoMODBUS to ensure proper bounds checking on cumulative response sizes is enforced.

Proactive Monitoring: Monitor network traffic for malformed Modbus packets or unexpected server crashes which may indicate exploitation attempts.

Compensating Controls: Implement strict network segmentation and firewall rules to limit access to Modbus services to authorized, trusted IP addresses only.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: This vulnerability is confirmed to be actively exploited in the wild as of August 5, 2026. The lack of memory protection on many embedded targets makes this vulnerability particularly dangerous.

Analyst Recommendation

Given the active exploitation and the critical nature of the flaw, IT and OT teams should treat this as a top-priority item. Ensure all deployments of nanoMODBUS are updated and verify that network-level access controls are strictly enforced.

---METADATA---
VENDOR: raghav993
PRODUCT: toner-management
AFFECTED_VERSIONS: All versions
CONFIDENCE: medium
MISSING: patch
---END_METADATA---

Description Summary:
The toner-management application contains missing authorization checks in its administrative state-changing handlers, allowing unauthorized users to modify system states.

Executive Summary:
A missing authorization vulnerability in the toner-management application allows unauthenticated attackers to perform administrative state changes, creating a critical risk to system integrity.

Vulnerability Details

CVE-ID: CVE-2026-71252

Affected Software: raghav993 toner-management

Affected Versions: All versions

Vulnerability: This vulnerability (CWE-862) involves the absence of necessary authorization checks for administrative functions. An unauthenticated attacker can interact with state-changing handlers, potentially leading to unauthorized system modifications.

Business Impact

With a CVSS score of 8.2, this vulnerability represents a significant threat to the operational integrity of the toner-management system. An attacker could alter configurations or system states without authentication, potentially leading to unauthorized control, service disruption, or data manipulation that could impact business operations.

Remediation Plan

Immediate Action: Review the project repository for available security patches or configuration changes, and restrict network access to the administrative interfaces of the application.

Proactive Monitoring: Monitor server access logs for requests directed at administrative endpoints originating from unauthorized or external IP addresses.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block unauthorized access attempts to administrative URLs and state-changing API endpoints.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is highly accessible as it does not require authentication to trigger.

Analyst Recommendation

Due to the lack of authentication requirements for critical administrative functions, this vulnerability should be addressed with high urgency. If an official patch is not yet available, organizations should move the application to a restricted network segment inaccessible to untrusted users.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An unauthenticated remote OS command injection vulnerability exists in the Totolink A8000RU CGI handler via the merge parameter in the setWiFiEasyCfg function.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows unauthenticated remote attackers to execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-7125

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: This vulnerability occurs in the setWiFiEasyCfg function within /cgi-bin/cstecgi.cgi. The merge parameter is inadequately sanitized, allowing remote command injection by an unauthenticated attacker.

Business Impact

The device is subject to total compromise, which poses a significant threat to internal network security. The 9.8 CVSS score justifies treating this as a high-priority security issue.

Remediation Plan

Immediate Action: Update to the latest firmware version and disable the Wi-Fi Easy Configuration feature if possible.

Proactive Monitoring: Review router logs for any suspicious system-level commands being executed.

Compensating Controls: Restrict management interface access to local or trusted administrative subnets only.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, a public exploit is available, making this a high-risk vulnerability.

Analyst Recommendation

All affected users should immediately update their firmware. If a patch is unavailable, the device must be isolated from the WAN to prevent remote exploitation.

---METADATA---
VENDOR: Adaltas
PRODUCT: backmeup
AFFECTED_VERSIONS: 0 through 0.0.2
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The backmeup npm package is vulnerable to OS command injection due to insecure concatenation of input parameters when constructing shell commands.

Executive Summary:
A high severity OS command injection vulnerability in the Adaltas backmeup package allows authenticated users to execute arbitrary commands on the underlying host system.

Vulnerability Details

CVE-ID: CVE-2026-71243

Affected Software: Adaltas backmeup

Affected Versions: 0 through 0.0.2

Vulnerability: This vulnerability involves CWE-78: OS Command Injection. The software fails to sanitize input options such as name, source, destination, and filter before including them in shell command strings, allowing an authenticated user with low privileges to inject and execute arbitrary system commands.

Business Impact

The vulnerability carries a CVSS score of 8.8, reflecting the high risk posed by successful exploitation. An attacker successfully leveraging this flaw could gain full control over the host system, leading to unauthorized data exfiltration, modification of critical system files, or complete service disruption.

Remediation Plan

Immediate Action: Currently, there is no vendor-supplied patch available. Users should evaluate the necessity of the backmeup package and consider removing or disabling it until a secure version is released.

Proactive Monitoring: Security teams should monitor system logs for suspicious process execution patterns or unexpected shell commands originating from the service user account.

Compensating Controls: Implement strict input validation or use a Web Application Firewall (WAF) to inspect and block malicious payloads containing shell metacharacters in request parameters.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently dangerous due to the direct concatenation of user-controlled input into system-level commands.

Analyst Recommendation

Given the high CVSS score and the nature of command injection, this vulnerability poses a severe threat to system integrity. Organizations using the backmeup package are advised to restrict access to the application and monitor for signs of unauthorized activity while awaiting an official security update.

---METADATA---
VENDOR: crater-invoice
PRODUCT: crater
AFFECTED_VERSIONS: 6.0.6
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Crater fails to verify company ownership when accessing notes, allowing authenticated users to bypass authorization checks and view or manage notes belonging to other companies.

Executive Summary:
An authorization bypass vulnerability in Crater version 6.0.6 allows authenticated users to access unauthorized data, posing a significant risk to data confidentiality and integrity.

Vulnerability Details

CVE-ID: CVE-2026-71242

Affected Software: crater-invoice crater

Affected Versions: 6.0.6

Vulnerability: This is an authorization bypass vulnerability (CWE-639) where the application relies on blanket permission checks rather than validating that the requesting user owns the specific data record. The flaw is accessible to authenticated users with low privileges.

Business Impact

Successful exploitation permits unauthorized access to sensitive financial notes and records across different company accounts. With a CVSS score of 8.2, this high-severity flaw could lead to significant data breaches, regulatory non-compliance, and loss of client trust by allowing lateral movement between isolated business entities within the platform.

Remediation Plan

Immediate Action: Update the Crater installation to the latest patched version provided by the vendor.

Proactive Monitoring: Review system access logs for unusual patterns, specifically looking for users accessing note records outside of their assigned company context.

Compensating Controls: Implement strict database-level row security or application-layer middleware to enforce company-ownership checks until the official patch is deployed.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable by any authenticated user due to the missing ownership comparison logic.

Analyst Recommendation

Given the high CVSS score and the direct impact on data isolation, organizations should prioritize patching this vulnerability. Administrators must verify that their environment is updated to a version beyond 6.0.6 to ensure that company-ownership validation is correctly enforced.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An unauthenticated remote OS command injection vulnerability exists in the Totolink A8000RU CGI handler via the addrPrefixLen parameter in the setIpv6LanCfg function.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows unauthenticated remote attackers to execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-7124

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: The vulnerability is located in the setIpv6LanCfg function of the /cgi-bin/cstecgi.cgi file. An unauthenticated attacker can supply a malicious addrPrefixLen parameter to trigger OS command injection.

Business Impact

This flaw permits total device takeover, which can lead to severe security breaches, including data exfiltration and denial of service. The 9.8 CVSS score reflects the high impact on confidentiality, integrity, and availability.

Remediation Plan

Immediate Action: Apply the vendor-supplied firmware update and disable IPv6 if it is not currently in use.

Proactive Monitoring: Monitor router logs for anomalous execution attempts or unexpected configuration changes.

Compensating Controls: Use a firewall to block access to the management interface from the WAN side.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, a public exploit is available for this vulnerability.

Analyst Recommendation

Immediate remediation is essential. Users should prioritize updating their firmware to the latest version to mitigate this critical risk.

---METADATA---
VENDOR: grocy
PRODUCT: grocy
AFFECTED_VERSIONS: All versions prior to a patched release
CONFIDENCE: high
MISSING: patch
CREDITS: Bobur Abdugafforov (finder)
SOURCES_JSON: [{"url":"https://github.com/grocy/grocy","name":null,"tags":["third-party-advisory"]}]
---END_METADATA---

Description Summary:
Grocy contains a stored cross-site scripting vulnerability in its API request-body parser, enabling authenticated attackers to execute malicious scripts within a user session.

Executive Summary:
A stored cross-site scripting vulnerability in the Grocy API parser allows authenticated attackers to execute malicious scripts, leading to potential session hijacking or unauthorized actions.

Vulnerability Details

CVE-ID: CVE-2026-71236

Affected Software: grocy

Affected Versions: All versions prior to a patched release

Vulnerability: This is a stored cross-site scripting (XSS) flaw in the GetParsedAndFilteredRequestBody function. Although the application uses HTMLPurifier, it incorrectly reverses entity encoding, which reintroduces dangerous characters and allows for the execution of arbitrary JavaScript in the context of other users.

Business Impact

The vulnerability is rated with a CVSS score of 8.7, indicating high severity. An authenticated attacker can leverage this XSS to compromise user sessions, steal sensitive information, or perform unauthorized actions on behalf of other users. This may lead to a complete breakdown of administrative controls and potential data loss within the application.

Remediation Plan

Immediate Action: Monitor for official security updates from the Grocy GitHub repository and apply them immediately.

Proactive Monitoring: Audit API activity logs for unusual request payloads containing script tags or encoded HTML entities.

Compensating Controls: Enforce strict Content Security Policy (CSP) headers to restrict the execution of unauthorized scripts and use a WAF to filter malicious content in API requests.

Exploitation Status

Public Exploit Available: Unknown.

Analyst Notes: As of August 28, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable once an attacker has gained low-level authentication.

Analyst Recommendation

While this flaw requires authentication, the impact is significant. Security teams should prioritize patching as soon as a fix is released and ensure that authentication controls are hardened to prevent malicious actors from reaching the vulnerable API endpoints.

---METADATA---
VENDOR: absmach
PRODUCT: magistrala
AFFECTED_VERSIONS: 0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Magistrala Rules Engine allows authenticated users to execute arbitrary Go or Lua scripts server-side, leading to code injection.

Executive Summary:
A critical code injection vulnerability in the Magistrala Rules Engine allows authenticated attackers to execute arbitrary scripts on the server.

Vulnerability Details

CVE-ID: CVE-2026-71235

Affected Software: absmach magistrala

Affected Versions: 0

Vulnerability: This vulnerability (CWE-94) occurs because the Rules Engine allows authenticated users to embed and execute Go or Lua scripts server-side, which can be leveraged to gain unauthorized system control.

Business Impact

An attacker successfully exploiting this vulnerability gains the ability to execute arbitrary code with the privileges of the Magistrala service, potentially resulting in full system compromise. The CVSS score of 8.8 reflects the high impact on system integrity and the potential for lateral movement within an IoT infrastructure.

Remediation Plan

Immediate Action: Review vendor advisories for available security patches or configuration changes that restrict script execution capabilities within the Rules Engine.

Proactive Monitoring: Audit all user-created rules and monitor server processes for anomalous script execution or unauthorized outbound network traffic originating from the engine.

Compensating Controls: Restrict access to the Rules Engine creation interface to only highly trusted administrators and isolate the Magistrala instance within a segmented network zone.

Exploitation Status

Public Exploit Available: No (exploit_available: false)

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The requirement for authenticated access necessitates robust identity management to prevent exploitation.

Analyst Recommendation

This vulnerability is highly dangerous due to the nature of server-side code execution. Organizations should immediately review their usage of the Magistrala Rules Engine and apply updates as soon as the vendor provides a formal patch.

---METADATA---
VENDOR: InvoiceNinja
PRODUCT: InvoiceNinja
AFFECTED_VERSIONS: 5.0.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
InvoiceNinja v5.0.0 is susceptible to Stored Cross-site Scripting (XSS) due to the unsafe rendering of the terms field in the client portal via the Laravel Blade raw output directive.

Executive Summary:
InvoiceNinja v5.0.0 contains a Cross-site Scripting vulnerability that allows authenticated users to execute arbitrary scripts in the client portal, posing a significant risk to user session security.

Vulnerability Details

CVE-ID: CVE-2026-71233

Affected Software: InvoiceNinja InvoiceNinja

Affected Versions: 5.0.0

Vulnerability: The application uses the Laravel Blade {!! !!} directive to render the terms field, which fails to sanitize input, allowing an authenticated user with sufficient privileges to inject malicious scripts that execute in the context of other users.

Business Impact

With a CVSS score of 8.7, this XSS flaw facilitates session hijacking, unauthorized account actions, and potential data theft from the client portal. Such compromises can lead to severe reputational damage and the loss of sensitive financial or client data.

Remediation Plan

Immediate Action: Review vendor documentation for the latest stable release and apply all available security updates to address the improper rendering of user input.

Proactive Monitoring: Inspect web application logs for suspicious script injection patterns in invoice or quote templates and monitor for unauthorized portal access attempts.

Compensating Controls: Utilize a Web Application Firewall (WAF) with robust XSS filtering rules to detect and block malicious payloads submitted via the invoice terms field.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 6, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability requires authenticated access, which limits the attack surface to existing users or compromised accounts.

Analyst Recommendation

Security teams should treat this XSS vulnerability as a priority, particularly for public-facing portals. Immediate remediation through software updates is essential to prevent session-based attacks that could lead to unauthorized data access or platform manipulation.

---METADATA---
VENDOR: thebradleysanders
PRODUCT: IOTSmartHome
AFFECTED_VERSIONS: 0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The IOTSmartHome platform is vulnerable to SQL injection via the lastLogin cookie, allowing unauthenticated attackers to bypass authentication and extract sensitive database information.

Executive Summary:
A critical SQL injection vulnerability in IOTSmartHome allows unauthenticated attackers to bypass authentication and exfiltrate sensitive data from the underlying database.

Vulnerability Details

CVE-ID: CVE-2026-71231

Affected Software: thebradleysanders IOTSmartHome

Affected Versions: 0

Vulnerability: This is an SQL Injection (CWE-89) vulnerability located in the checkCookie function within gui/login.php. The application fails to sanitize the decoded contents of the lastLogin cookie before concatenating it into a database query, enabling attackers to inject malicious SQL commands.

Business Impact

Successful exploitation allows an attacker to bypass authentication mechanisms, granting them unauthorized access to the application. Furthermore, the use of UNION-based injection allows for the extraction of sensitive information, including user credentials, which could lead to widespread account compromise and a severe breach of confidentiality.

Remediation Plan

Immediate Action: Update IOTSmartHome to the latest version immediately to receive the necessary input sanitization fixes. If an update is unavailable, disable the affected login functionality or restrict access to the web interface.

Proactive Monitoring: Monitor database logs for suspicious query patterns, such as unexpected UNION statements or syntax errors indicative of injection attempts. Review authentication logs for unusual login activity.

Compensating Controls: Utilize a WAF to inspect and block incoming HTTP requests containing suspicious base64-encoded payloads in the lastLogin cookie.

Exploitation Status

Public Exploit Available: false

Analyst Notes: As of August 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly exploitable due to the predictable nature of the cookie-based authentication flow.

Analyst Recommendation

Given the critical severity and the ease of exploitation, immediate remediation is required. Ensure that all database interactions are parameterized and that input validation is strictly enforced to prevent further injection risks.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An unauthenticated remote OS command injection vulnerability in the Totolink A8000RU CGI handler occurs via the setIptvCfg function.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows unauthenticated remote attackers to execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-7123

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: This vulnerability affects the setIptvCfg function in the /cgi-bin/cstecgi.cgi file, where improper handling of the setIptvCfg argument allows for remote OS command injection.

Business Impact

This vulnerability allows an attacker to gain full control of the network device. The CVSS score of 9.8 indicates that this is a critical risk, potentially allowing an attacker to reroute traffic or disable security controls.

Remediation Plan

Immediate Action: Update to the latest firmware version and disable the IPTV configuration feature if not strictly required.

Proactive Monitoring: Monitor for unusual traffic patterns and unauthorized configuration changes on the router.

Compensating Controls: Implement strict network access control lists (ACLs) to prevent unauthorized access to the router's management interface.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, a public exploit is available, making this vulnerability highly accessible to malicious actors.

Analyst Recommendation

The severity and exploitability of this vulnerability demand immediate attention. Users should update their firmware to the latest available version and apply recommended network hardening techniques immediately.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
An unauthenticated remote OS command injection vulnerability exists in the Totolink A8000RU CGI handler via the enable parameter in the setUPnPCfg function.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows unauthenticated remote attackers to execute arbitrary commands.

Vulnerability Details

CVE-ID: CVE-2026-7122

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: The vulnerability resides in the setUPnPCfg function within the /cgi-bin/cstecgi.cgi file. Lack of input sanitization on the enable argument permits remote OS command injection by an unauthenticated user.

Business Impact

The flaw provides an attacker with the ability to execute commands with high privileges on the device. Given the 9.8 CVSS score, this represents a major threat to network integrity, allowing for potential man-in-the-middle attacks or total network traffic interception.

Remediation Plan

Immediate Action: Disable UPnP and remote management features immediately, and apply available firmware updates.

Proactive Monitoring: Review system logs for suspicious process execution or unexpected configuration changes.

Compensating Controls: Use a firewall to block external access to the device's web management interface.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, a public exploit is available, making this a high-risk vulnerability. Urgent remediation is recommended.

Analyst Recommendation

Organizations utilizing the Totolink A8000RU must treat this as a critical security incident. The presence of public exploits necessitates immediate isolation of the device from untrusted networks until a secure firmware version can be deployed.

---METADATA---
VENDOR: NASA-AMMOS
PRODUCT: plandev (sequencing-server)
AFFECTED_VERSIONS: 0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The NASA-AMMOS plandev sequencing-server contains an authentication bypass flaw in the session role derivation middleware, allowing unauthenticated attackers to perform unauthorized administrative actions.

Executive Summary:
A critical authentication bypass in the NASA-AMMOS plandev sequencing-server allows unauthenticated attackers to inject arbitrary expansion rules and modify command dictionaries.

Vulnerability Details

CVE-ID: CVE-2026-71214

Affected Software: NASA-AMMOS plandev (sequencing-server)

Affected Versions: 0

Vulnerability: The application incorrectly trusts client-supplied JSON request bodies to derive authorization roles, bypassing the intended JWT-based authentication. This allows unauthenticated users to impersonate administrative roles and perform unauthorized writes to command expansion rules and dictionaries.

Business Impact

This vulnerability carries a CVSS score of 9.8 and allows for the manipulation of sequencing rules that govern spacecraft activities. Unauthorized modification of these rules or command dictionaries could result in significant operational disruption, data integrity loss, and potential safety risks to associated hardware operations.

Remediation Plan

Immediate Action: Update the sequencing-server component to the latest version provided by NASA-AMMOS. Review the vendor security advisory to verify if specific configuration changes are required in addition to the software update.

Proactive Monitoring: Review application access logs for requests to /command-expansion/put-expansion or /put-dictionary that lack valid Authorization headers or show anomalous session_variables.

Compensating Controls: Implement strict network-level access controls to ensure only known, authorized clients can reach the sequencing-server endpoints.

Exploitation Status

Public Exploit Available: No (exploit_available unknown).

Analyst Notes: As of Aug 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is highly severe because it permits unauthorized modification of critical system logic without requiring authentication.

Analyst Recommendation

Given the critical nature of the sequencing-server and the risk posed by arbitrary command expansion, immediate patching is required. Organizations should treat this as a high-priority remediation to ensure the integrity of sequencing operations.

---METADATA---
VENDOR: Typemill
PRODUCT: Typemill
AFFECTED_VERSIONS: 0 through 2.25.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
Typemill's login endpoint lacks rate-limiting or account lockout mechanisms when the captcha is disabled, allowing for potential brute-force attacks.

Executive Summary:
A lack of authentication rate-limiting in Typemill versions up to 2.25.0 creates a high risk of unauthorized account access through brute-force attacks.

Vulnerability Details

CVE-ID: CVE-2026-71213

Affected Software: Typemill Typemill

Affected Versions: 0 through 2.25.0

Vulnerability: This is an improper restriction of excessive authentication attempts (CWE-307) occurring within the ControllerWebAuth login function. The vulnerability is exploitable by unauthenticated remote attackers.

Business Impact

The absence of account lockout or rate-limiting measures significantly increases the risk of successful credential stuffing or brute-force attacks against administrative or user accounts. With a CVSS score of 8.1, this vulnerability is considered High severity, as it could lead to full unauthorized access to the application and sensitive data compromise.

Remediation Plan

Immediate Action: Ensure the CAPTCHA feature is enabled in the Typemill configuration to mitigate automated login attempts while awaiting a formal security patch.

Proactive Monitoring: Review web access logs for high volumes of POST requests to the /tm/login endpoint originating from single or suspicious IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to rate-limit requests to the login endpoint and block IP addresses exhibiting aggressive authentication patterns.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of August 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently exploitable due to the default configuration lacking protective barriers against automated login attempts.

Analyst Recommendation

Given the High severity score, administrators must prioritize securing the authentication process immediately. Enabling the CAPTCHA is a vital, non-disruptive step to prevent account takeover attempts until an official update providing robust rate-limiting is released.

---METADATA---
VENDOR: Totolink
PRODUCT: A8000RU
AFFECTED_VERSIONS: 7.1cu.643_b20200521
---END_METADATA---

Description Summary:
A remote OS command injection vulnerability in the Totolink A8000RU CGI handler allows unauthenticated attackers to execute arbitrary commands via the wizard parameter.

Executive Summary:
A critical OS command injection vulnerability in the Totolink A8000RU router allows unauthenticated remote attackers to gain full system control.

Vulnerability Details

CVE-ID: CVE-2026-7121

Affected Software: Totolink A8000RU

Affected Versions: 7.1cu.643_b20200521

Vulnerability: This is an OS command injection vulnerability within the setWizardCfg function of the /cgi-bin/cstecgi.cgi component. The application fails to sanitize the wizard argument, allowing an unauthenticated remote attacker to inject and execute arbitrary system commands.

Business Impact

The vulnerability allows for full remote compromise of the device, which could be used as a pivot point into the local network. With a CVSS score of 9.8, the risk of complete device takeover and subsequent lateral movement is severe.

Remediation Plan

Immediate Action: Disconnect the affected device from the internet or apply the latest manufacturer firmware patch if available.

Proactive Monitoring: Monitor network traffic for unusual outbound connections or shell-like activity originating from the router.

Compensating Controls: Restrict management interface access to trusted IP addresses only via firewall rules.

Exploitation Status

Public Exploit Available: Yes

Analyst Notes: As of April 27, 2026, a public exploit is available, significantly increasing the probability of exploitation. Immediate action is required to secure the device.

Analyst Recommendation

Due to the availability of public exploit code and the critical nature of the vulnerability, immediate mitigation is required. If a firmware update is not available, the device should be isolated from external network access to prevent compromise.

---METADATA---
VENDOR: mrswapnilsahu
PRODUCT: Stock-Inventory-Management-System
AFFECTED_VERSIONS: 0 through 1.0
CONFIDENCE: high
MISSING: patch
---END_METADATA---

Description Summary:
The Stock-Inventory-Management-System contains a SQL injection vulnerability and hardcoded credentials in the login module, allowing for total authentication bypass by unauthenticated remote attackers.

Executive Summary:
This critical vulnerability in the Stock-Inventory-Management-System allows unauthenticated remote attackers to gain full administrative access via SQL injection or hardcoded credentials.

Vulnerability Details

CVE-ID: CVE-2026-71207

Affected Software: mrswapnilsahu Stock-Inventory-Management-System

Affected Versions: 0 through 1.0

Vulnerability: The application is susceptible to SQL injection due to improper sanitization of login parameters, which is compounded by the presence of hardcoded administrative credentials. An unauthenticated attacker can leverage these flaws to bypass security controls entirely.

Business Impact

A successful exploit grants an attacker unrestricted administrative access to the inventory system. This could lead to the complete compromise of sensitive inventory data, unauthorized modification of records, and potential system-wide disruption, justifying the critical CVSS score of 9.8.

Remediation Plan

Immediate Action: Update to the latest version of the application as soon as the vendor provides a patch. In the interim, restrict access to the login interface using network-level controls.

Proactive Monitoring: Review application access logs for anomalous login patterns or SQL syntax characters in authentication fields.

Compensating Controls: Implement a Web Application Firewall (WAF) with SQL injection protection rules to block malicious payloads targeting the login module.

Exploitation Status

Public Exploit Available: No

Analyst Notes: As of Aug 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The presence of hardcoded credentials makes this software inherently insecure, and immediate replacement or isolation is advised.

Analyst Recommendation

Given the critical nature of this vulnerability and the ease of exploitation through trivial SQL injection or known credentials, organizations should prioritize the removal or patching of this software. Immediate action is required to prevent unauthorized access and potential data exfiltration.

---METADATA---
VENDOR: go-shiori
PRODUCT: shiori
AFFECTED_VERSIONS: 1.6.0 and 1.6.1
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
Shiori versions 1.6.0 and 1.6.1 contain an authentication bypass vulnerability in the CheckToken function due to improperly secured v1 API endpoints.

Executive Summary:
An authentication bypass vulnerability in Shiori 1.6.0 and 1.6.1 allows unauthorized access due to incomplete security logic in v1 API endpoints.

Vulnerability Details

CVE-ID: CVE-2026-71206

Affected Software: go-shiori shiori

Affected Versions: 1.6.0 and 1.6.1

Vulnerability: The vulnerability exists in the CheckToken function, where new v1 API endpoints were exposed with incomplete security controls. This allows an attacker to bypass standard authentication requirements.

Business Impact

With a CVSS score of 8.2, this vulnerability poses a significant risk of unauthorized access to the Shiori instance. An attacker could potentially access, modify, or delete bookmarked content or other sensitive data stored within the application, leading to a loss of data integrity and confidentiality.

Remediation Plan

Immediate Action: Upgrade all instances of Shiori to version 1.6.2 or later to resolve the authentication logic flaw.

Proactive Monitoring: Review application access logs for unusual patterns or access attempts to v1 API endpoints by unauthorized accounts.

Compensating Controls: Place the Shiori application behind a VPN or reverse proxy that requires secondary authentication before reaching the application layer.

Exploitation Status

Public Exploit Available: False

Analyst Notes: As of August 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The vulnerability is limited to the specific API implementation flaws introduced in the affected versions.

Analyst Recommendation

Users of the Shiori bookmarking application should update to version 1.6.2 immediately. The presence of an authentication bypass in an application designed to store user data necessitates prompt attention to maintain the security of the bookmarking environment.

---METADATA---
VENDOR: OpenStack
PRODUCT: Swift
AFFECTED_VERSIONS: 1.9.1 up to (excluding) 2.35.4, 2.36.0 up to (excluding) 2.36.3, 2.37.0 up to (excluding) 2.37.3, 2.38.0
CONFIDENCE: high
MISSING: none
---END_METADATA---

Description Summary:
OpenStack Swift contains an inefficient regular expression complexity vulnerability that can be exploited by unauthenticated remote attackers to cause a denial of service.

Executive Summary:
OpenStack Swift is vulnerable to a denial of service attack via inefficient regular expression complexity, which may lead to significant system resource exhaustion.

Vulnerability Details

CVE-ID: CVE-2026-71190

Affected Software: OpenStack Swift

Affected Versions: 1.9.1 up to (excluding) 2.35.4, 2.36.0 up to (excluding) 2.36.3, 2.37.0 up to (excluding) 2.37.3, 2.38.0

Vulnerability: The software is susceptible to CWE-1333, which involves inefficient regular expression complexity. An unauthenticated remote attacker can supply specifically crafted input to trigger high CPU consumption, resulting in a denial of service condition.

Business Impact

Exploitation of this vulnerability leads to service unavailability, which can severely impact business operations that rely on the Swift object storage service. With a CVSS score of 8.7, this vulnerability poses a high risk to service continuity and platform stability.

Remediation Plan

Immediate Action: Upgrade to the patched versions (2.35.4, 2.36.3, 2.37.3, or later as applicable) provided by the OpenStack project.

Proactive Monitoring: Monitor resource utilization, specifically CPU spikes on Swift nodes, which may indicate an ongoing denial of service attempt.

Compensating Controls: Deploy a Web Application Firewall or rate-limiting middleware to inspect and filter incoming requests for patterns that match known complex regular expression attacks.

Exploitation Status

Public Exploit Available: Unknown

Analyst Notes: As of August 5, 2026, there is no public information indicating active exploitation or a public proof-of-concept for this vulnerability. The flaw is inherently problematic as it allows remote attackers to disrupt services without authentication.

Analyst Recommendation

Given the potential for service disruption, organizations should schedule and apply the necessary patches as soon as possible. Maintaining service uptime is critical, and this update is essential for protecting the availability of OpenStack Swift.

---METADATA---
VENDOR: Tenda
PRODUCT: HG3
AFFECTED_VERSIONS: Tenda HG3: 2.0
CONFIDENCE: high
MISSING: patch
CREDITS: 2er00ne (VulDB User) (reporter)
SOURCES_JSON: [{"url":"https://vuldb.com/vuln/359719","name":"VDB-359719 | Tenda HG3 formCountrystr os command injection","tags":["vdb-entry","technical-description"]},{"url":"https://vuldb.com/vuln/359719/cti","name":"VDB-359719 | CTI Indicators (IOB, IOC, TTP, IOA)","tags":["signature","permissions-required"]},{"url":"https://vuldb.com/submit/800859","name":"Submit #800859 | Tenda HG3 N300 Wi-Fi xPON ONT HARD_VERSION=V2.0 , Version: 300003070 Remote code execution","tags":["third-party-advisory"]},{"url":"https://www.notion.so/Tenda-HG3-1-33d0c75766a8808d8b38e9d090cec7ab","name":null,"tags":["exploit"]},{"url":"https://www.tenda.com.cn/","name":null,"tags":["product"]}]
PROFILE: batch@eb21ac00f78b
MODEL: gemini-3.1-flash-lite
GENERATED: 2026-08-29T13:56:39.703Z
---END_METADATA---

Description Summary:
Tenda HG3 version 2.0 contains an OS command injection vulnerability in the /boaform/formCountrystr endpoint, allowing remote attackers to execute arbitrary system commands via the countrystr argument.

Executive Summary:
A critical OS command injection vulnerability in Tenda HG3 routers enables remote attackers to execute unauthorized commands, posing a severe risk of full system compromise.

Vulnerability Details

CVE-ID: CVE-2026-7119

Affected Software: Tenda HG3

Affected Versions: Tenda HG3: 2.0

Vulnerability: The vulnerability is an OS command injection flaw (CWE-78) triggered by improper validation of the countrystr argument within the /boaform/formCountrystr function. The CVSS vector (PR:L) indicates that the attacker must possess low-level privileges to successfully interact with the vulnerable endpoint.

Business Impact

The ability to perform OS command injection grants an attacker the power to execute arbitrary code with the privileges of the web server. This could lead to a complete takeover of the affected networking device, resulting in unauthorized network access, data exfiltration, or the use of the device as a pivot point for further attacks on the internal network. With a CVSS score of 8.8, this flaw represents a high-severity risk that could lead to significant operational disruption and security breaches.

Remediation Plan

Immediate Action: Since no specific patch version is currently identified, users should restrict administrative access to the affected device management interface and disable remote access features.

Proactive Monitoring: Security teams should monitor network traffic for suspicious requests targeting the /boaform/formCountrystr endpoint and review system logs for unauthorized command execution patterns.

Compensating Controls: Implement a Web Application Firewall (WAF) or equivalent network filtering rules to block or sanitize malicious input directed at the identified vulnerable endpoint.

Exploitation Status

Public Exploit Available: Yes, a published proof-of-concept exists, as documented in the technical write-up provided by the reference.

Analyst Notes: As of April 29, 2026, there is no confirmed active exploitation in the wild, however, per CISA's SSVC assessment a proof-of-concept exists, so exploitation risk should be treated as credible. The presence of a published PoC significantly lowers the barrier for entry for malicious actors.

Analyst Recommendation

Given the severity of this command injection vulnerability and the availability of public proof-of-concept material, immediate defensive action is required. Organizations utilizing Tenda HG3 devices should isolate these systems from the public internet and apply vendor-provided updates as soon as they become available to mitigate the risk of remote code execution.