Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

AlienVault OTX General

CVE Database V5

SANS ISC Handlers Diary

SecurityWeek

Threatpost

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit NetSec

Reddit InfoSec News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

CVE-2026-2090 is a medium-severity SQL Injection vulnerability affecting SourceCodester Online Class Record System version 1. 0. The flaw exists in the /admin/message/search. php file where manipulation of the 'term' parameter allows remote attackers to inject SQL commands without authentication or user interaction. This vulnerability can lead to unauthorized data access or modification, impacting confidentiality, integrity, and availability of the system. Although no known exploits are currently active in the wild, the vulnerability has been publicly disclosed, increasing the risk of exploitation. European educational institutions or organizations using this system could face data breaches or service disruptions. Mitigation requires immediate input validation and parameterized queries in the affected code, along with monitoring for suspicious database activity. Countries with significant deployments of SourceCodester products or with strategic emphasis on digital education are most at risk. The vulnerability’s CVSS 4.

CVE-2026-2090 is a SQL Injection vulnerability identified in SourceCodester Online Class Record System version 1.0, specifically in the /admin/message/search.php script. The vulnerability arises from improper sanitization or validation of the 'term' parameter, which is used in SQL queries without adequate escaping or parameterization. This allows an unauthenticated remote attacker to inject arbitrary SQL commands by manipulating the 'term' argument, potentially leading to unauthorized data retrieval, modification, or deletion within the backend database. The attack vector requires no user interaction or privileges, making exploitation straightforward once the system is accessible over the network. The vulnerability has been publicly disclosed, although no active exploits have been reported in the wild yet. The CVSS 4.0 base score is 6.9, reflecting a medium severity level due to the remote, unauthenticated nature of the attack but limited impact on system-wide availability or integrity. The lack of patches or vendor-provided fixes necessitates immediate remediation by implementing secure coding practices such as prepared statements and input validation. This vulnerability poses a significant risk to organizations using this software, especially those managing sensitive educational records, as attackers could exfiltrate confidential information or disrupt system operations.

Detailed information about CVE-2026-2090: SQL Injection in SourceCodester Online Class Record System affecting SourceCodester Online Class Record System. Get re

CVE-2026-2090: SQL Injection in SourceCodester Online Class Record System - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-2090: SQL Injection in SourceCodester Online Class Record System

CVE-2026-2089 is a medium-severity SQL injection vulnerability in SourceCodester Online Class Record System version 1. 0, specifically in the /admin/subject/controller. php file. The vulnerability allows remote attackers to manipulate the 'ID' parameter without authentication or user interaction, enabling unauthorized access or modification of the backend database. Although no known exploits are currently observed in the wild, the exploit code has been publicly disclosed, increasing the risk of exploitation. This vulnerability can compromise the confidentiality, integrity, and availability of educational data managed by the system. European educational institutions using this software are at risk, especially those with limited security controls. Mitigation requires immediate code review and patching of the vulnerable parameter handling, implementation of prepared statements or parameterized queries, and enhanced input validation. Countries with significant deployment of SourceCodester products or with large educational sectors relying on such systems are most likely affected. Given the medium CVSS score of 6.

CVE-2026-2089 identifies a SQL injection vulnerability in the SourceCodester Online Class Record System version 1.0, located in the /admin/subject/controller.php file. The vulnerability arises from improper sanitization or validation of the 'ID' parameter, which is directly used in SQL queries. An attacker can remotely exploit this flaw by manipulating the 'ID' argument in HTTP requests to execute arbitrary SQL commands on the backend database. This can lead to unauthorized data disclosure, data modification, or even complete compromise of the database server. The vulnerability requires no authentication or user interaction, making it highly accessible to remote attackers. The CVSS 4.0 vector indicates network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and partial impact on confidentiality, integrity, and availability (VC:L, VI:L, VA:L). Although no active exploitation has been reported, the public availability of exploit code increases the risk of attacks. The affected product is primarily used in educational environments to manage class records, making sensitive student and academic data vulnerable. The lack of official patches or vendor advisories necessitates immediate action by users to implement mitigations. This vulnerability exemplifies common risks in web applications that fail to properly sanitize user inputs, emphasizing the need for secure coding practices such as using parameterized queries and rigorous input validation.

Detailed information about CVE-2026-2089: SQL Injection in SourceCodester Online Class Record System affecting SourceCodester Online Class Record System. Get re

CVE-2026-2089: SQL Injection in SourceCodester Online Class Record System - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-2089: SQL Injection in SourceCodester Online Class Record System

CVE-2026-2088 is a medium severity SQL injection vulnerability in PHPGurukul Beauty Parlour Management System version 1. 1, specifically in the /admin/accepted-appointment. php file. The vulnerability arises from improper sanitization of the 'delid' parameter, allowing remote attackers to manipulate SQL queries without authentication or user interaction. Exploitation can lead to partial compromise of confidentiality, integrity, and availability of the backend database. Although no known exploits are currently in the wild, the public disclosure increases risk. European organizations using this software, particularly small to medium beauty parlour businesses, may be targeted. Mitigation requires immediate input validation, parameterized queries, and restricting access to administrative interfaces. Countries with higher adoption of PHP-based SMB management tools and significant beauty service sectors, such as Germany, France, Italy, Spain, and the UK, are most likely affected. Given the ease of exploitation and potential data impact, organizations should prioritize patching or applying mitigations promptly.

CVE-2026-2088 identifies a SQL injection vulnerability in PHPGurukul Beauty Parlour Management System version 1.1, located in the /admin/accepted-appointment.php script. The vulnerability stems from improper handling of the 'delid' parameter, which is used in SQL queries without adequate sanitization or use of prepared statements. This flaw allows an unauthenticated remote attacker to inject malicious SQL code by manipulating the 'delid' argument, potentially leading to unauthorized data access, modification, or deletion within the backend database. The attack vector requires no user interaction and no privileges, making it highly accessible to attackers scanning for vulnerable installations. The CVSS 4.0 base score is 6.9 (medium severity), reflecting the network attack vector, low complexity, and no required authentication, but limited scope and impact on confidentiality, integrity, and availability (all rated low). While no public exploit code is known to be actively used in the wild, the vulnerability is publicly disclosed, increasing the risk of exploitation. The affected product is a niche PHP-based management system used primarily by beauty parlours to handle appointments and administrative tasks. The lack of official patches or updates at the time of disclosure necessitates immediate mitigation efforts by users. The vulnerability highlights the importance of secure coding practices, particularly input validation and the use of parameterized queries to prevent SQL injection attacks.

Detailed information about CVE-2026-2088: SQL Injection in PHPGurukul Beauty Parlour Management System affecting PHPGurukul Beauty Parlour Management System. Ge

CVE-2026-2088: SQL Injection in PHPGurukul Beauty Parlour Management System - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-2088: SQL Injection in PHPGurukul Beauty Parlour Management System

CVE-2026-2087 is a medium-severity SQL injection vulnerability found in SourceCodester Online Class Record System version 1. 0, specifically in the /admin/login. php file via the user_email parameter. This flaw allows unauthenticated remote attackers to manipulate SQL queries, potentially leading to unauthorized data access or modification. Although no known exploits are currently in the wild, the exploit code has been published, increasing the risk of exploitation. The vulnerability does not require user interaction or privileges, making it easier to exploit. European educational institutions using this system could face data breaches or service disruptions. Mitigation requires immediate input validation and prepared statements, as no official patches are currently available. Countries with higher adoption of SourceCodester products or significant educational technology deployments are at greater risk. Organizations should prioritize monitoring and restrict access to vulnerable endpoints until remediation is applied.

CVE-2026-2087 identifies a SQL injection vulnerability in SourceCodester Online Class Record System version 1.0, specifically within the /admin/login.php endpoint. The vulnerability arises from improper sanitization of the user_email parameter, allowing attackers to inject malicious SQL code. This flaw enables remote, unauthenticated attackers to manipulate backend database queries, potentially extracting sensitive information, bypassing authentication, or altering data integrity. The vulnerability is exploitable over the network without any user interaction or privileges, increasing its risk profile. The CVSS 4.0 base score is 6.9 (medium severity), reflecting the ease of exploitation and potential impact on confidentiality, integrity, and availability, albeit with limited scope and no privilege escalation. No official patches or fixes have been published yet, and while no active exploitation has been reported, the availability of exploit code raises the likelihood of future attacks. The vulnerability affects only version 1.0 of the product, which is used primarily in educational environments to manage class records and administrative functions. Given the critical nature of educational data, exploitation could lead to unauthorized disclosure of student and staff information, disruption of administrative operations, and potential compliance violations under data protection regulations.

Detailed information about CVE-2026-2087: SQL Injection in SourceCodester Online Class Record System affecting SourceCodester Online Class Record System. Get re

CVE-2026-2087: SQL Injection in SourceCodester Online Class Record System - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2026-2087: SQL Injection in SourceCodester Online Class Record System

CVE-2026-2086 is a high-severity buffer overflow vulnerability in the UTT HiPER 810G device management interface, specifically in the strcpy function handling the GroupName parameter in /goform/formFireWall. This flaw allows remote attackers to execute code or cause denial of service without authentication or user interaction. The vulnerability affects version 1. 7. 7-171114 and earlier, with a CVSS 4. 0 score of 8. 7. Although the vendor has not responded or issued a patch, a public exploit exists, increasing the risk of exploitation. European organizations using this device for network management could face significant confidentiality, integrity, and availability risks. Mitigation requires immediate network segmentation, disabling remote management if possible, and monitoring for exploit attempts.

CVE-2026-2086 identifies a critical buffer overflow vulnerability in the UTT HiPER 810G network device, specifically in the management interface component. The flaw resides in the strcpy function within the /goform/formFireWall endpoint, where improper handling of the GroupName argument allows an attacker to overflow the buffer. This vulnerability can be exploited remotely without requiring authentication or user interaction, making it highly accessible to attackers. The buffer overflow can lead to arbitrary code execution or denial of service, severely compromising the device's confidentiality, integrity, and availability. The affected version is 1.7.7-171114 and earlier, with no vendor patch available as of the publication date. The CVSS 4.0 vector indicates network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:L), no user interaction (UI:N), and high impact on confidentiality, integrity, and availability (VC:H/VI:H/VA:H). The exploit is publicly available, increasing the likelihood of active exploitation. The vendor was contacted but did not respond, leaving organizations reliant on mitigation strategies rather than patches. This vulnerability is particularly concerning for environments where UTT HiPER 810G devices manage firewall configurations or other critical network functions.

Detailed information about CVE-2026-2086: Buffer Overflow in UTT HiPER 810G affecting UTT HiPER 810G. Get real-time updates, technical details, and mitigation s

Geographic Threat Map

Global Threat Distribution

Threat Levels

Recent Threats

CVE-2026-2090: SQL Injection in SourceCodester Online Class ...

CVE-2026-2089: SQL Injection in SourceCodester Online Class ...

CVE-2026-2088: SQL Injection in PHPGurukul Beauty Parlour Ma...

CVE-2026-2087: SQL Injection in SourceCodester Online Class ...

CVE-2026-2086: Buffer Overflow in UTT HiPER 810G

Country Risk Levels

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility