Threat database

CVE-2026-105186 is a medium severity SQL injection vulnerability in itsourcecode Online Admission System version 1.0. The flaw exists in the /new.php file where manipulation of the schedid argument can lead to SQL injection. The vulnerability can be exploited remotely without user interaction. An exploit has been published but there are no known reports of active exploitation in the wild. No patch or remediation information is currently available.

A vulnerability was detected in itsourcecode Online Admission System 1.0. This affects an unknown function of the file /admin/examinee.php. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used.

A security vulnerability has been detected in itsourcecode Online Admission System 1.0. The impacted element is an unknown function of the file /admin/creteria.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

A weakness has been identified in itsourcecode Online Admission System 1.0. The affected element is an unknown function of the file /admin/confirm.php. This manipulation of the argument schedid causes sql injection. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks.

CVE-2026-105182 is a SQL injection vulnerability in SourceCodester Online Reviewer Management System version 1.0. It affects an unknown function in the file /reviewer_0/admins/assessments/activities/btn_functions.php with the 'Title' argument. The vulnerability allows remote attackers to perform SQL injection attacks. The exploit code has been publicly released. The CVSS 4.0 score is 6.9, indicating a medium severity.

A vulnerability was identified in itsourcecode Online Admission System 1.0. This issue affects some unknown processing of the file register1.php. The manipulation of the argument fname leads to sql injection. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

A vulnerability was determined in Jeebase 0.0.1. This vulnerability affects the function updateUser of the file /user/update/info of the component UserService. Executing a manipulation of the argument user/tempUser can lead to dynamically-determined object attributes. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

This entry is a daily update from the SANS Internet Storm Center (ISC) titled 'ISC Stormcast For Monday, October 5th, 2026.' It provides general information about the ISC's activities and links to a podcast but does not contain any specific security threat or vulnerability details.

A weakness has been identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Admin/add_user.php of the component Password Handler. Executing a manipulation of the argument Password can lead to missing encryption of sensitive data. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.

In Modem, there is a possible information disclosure due to a logic error. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01645293; Issue ID: MSV-6761.

CVE-2026-20542 is a use-after-free vulnerability in the apusys component of MediaTek chipsets. This memory corruption flaw can lead to local privilege escalation if the attacker already has System privileges. Exploitation does not require user interaction. Multiple MediaTek chipset versions are affected. The vulnerability has a medium severity rating with a CVSS score of 6.7.

In Modem, there is a possible out of bounds read due to a missing permission check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01774038; Issue ID: MSV-8911.

In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01774038; Issue ID: MSV-8912.

In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01774038; Issue ID: MSV-8913.

In Modem, there is a possible out of bounds read due to a missing permission check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01774038; Issue ID: MSV-8914.

CVE-2026-20537 is a use-after-free vulnerability in the aidl component of MediaTek chipsets. It can cause memory corruption leading to local privilege escalation if the attacker already has System privileges. Exploitation does not require user interaction. The vulnerability affects multiple MediaTek chipset models.

CVE-2026-20536 is a use-after-free vulnerability in the aidl component of MediaTek chipsets. It can cause memory corruption and potentially lead to local privilege escalation if the attacker already has System privileges. Exploitation does not require user interaction. Multiple MediaTek chipset models are affected.

CVE-2026-20535 is a missing authorization vulnerability in MediaTek chipsets affecting multiple models. The flaw exists in the aidl component where a permission check is missing, potentially allowing a local attacker with existing System privileges to escalate their privileges further without user interaction. The vulnerability has a medium severity rating with a CVSS score of 6.7. No public exploits are known, and no patch links are provided in the available data.

In Modem, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote denial of service, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: MOLY01797547; Issue ID: MSV-9155.

CVE-2026-20533 is an integer overflow vulnerability in MediaTek chipsets that can lead to local escalation of privilege. Exploitation does not require user interaction but requires the attacker to already have System privilege. The vulnerability affects multiple MediaTek chipset versions and has a medium severity rating with a CVSS score of 6.7.