CVE-2026-105178 is a medium severity SQL injection vulnerability in SourceCodester Drug Recommendation System version 1.0. The flaw exists in the mysqli_real_escape_string function within the /Admin/add_symptom.php file, specifically in the Symptom Creation component. An attacker can remotely manipulate the txtname argument to execute SQL injection attacks. Public exploit code is available, increasing the risk of exploitation.
A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. The affected element is an unknown function of the file /Admin/add_drug.php of the component Drug Creation. Such manipulation of the argument txtname/cmdtype/txtusage/txtsideeffect/cmdcontraindication leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.
A vulnerability was determined in SourceCodester Drug Recommendation System 1.0. Impacted is an unknown function of the file /Admin/edit_class.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /Auth/add_student.php of the component Student Registration. The manipulation of the argument cmdschool results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.
maclof kubernetes-client 0.17.0 before 0.32.0 disables TLS certificate verification in parseKubeconfig() and parseKubeconfigFile() when a kubeconfig lacks certificate-authority-data, ignoring insecure-skip-tls-verify. On-path attackers can impersonate the Kubernetes API server to capture Bearer tokens or Basic credentials and tamper with WebSocket or REST API traffic.
CVE-2026-105174 is a path traversal vulnerability in Gerapy versions 0.9.0 through 0.9.13 affecting the project_create function in the Project Management component. This vulnerability allows remote attackers with limited privileges to manipulate the project_name argument to perform path traversal. The vulnerability has a medium severity with a CVSS score of 5.3. A patch identified by commit 6e481078cfba6388a67ca2d9792288405019ba3e is available and recommended to fix the issue.
A flaw has been found in code-projects Human Resource Management 1.0. This affects an unknown part of the file /humanresourcemanagementsystem/src/store/EventStore.php of the component Event Creation. Executing a manipulation of the argument eventSubject can lead to cross site scripting. The attack may be launched remotely. The exploit has been published and may be used.
This report describes an experiment involving the collection and analysis of TTY logs from actors or bots that successfully log into a DShield sensor. The logs capture commands executed by these actors, which are then parsed and sent daily to the DShield SIEM for correlation and further analysis. The data includes hashes of commands such as crontab entries executed by thousands of different IP addresses over a 90-day period. This activity provides insight into attacker behavior but does not describe a specific vulnerability or exploit.
A vulnerability was detected in itsourcecode Online Admission System 1.0. Affected by this issue is some unknown functionality of the file /login1.php. Performing a manipulation of the argument User results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used.
Feehi CMS version 2.1.1 and earlier contain a Server-Side Request Forgery (SSRF) vulnerability in the UEditor catchimage endpoint. The vulnerability arises because the private-IP validation does not block loopback or link-local addresses, enabling an attacker to make the server send HTTP requests to internal services. This could lead to unauthorized information disclosure from internal network resources.
Feehi CMS version 2.1.1 contains a directory traversal vulnerability that allows an authenticated backend user with article edit permissions to delete arbitrary files writable by the PHP process. This occurs because article image metadata is used to build a filesystem path passed to the unlink() function without proper path traversal or directory validation. The vulnerability has a CVSS score of 6.5, indicating a medium severity impact primarily on integrity.
Feehi CMS version 2.1.1 contains an incorrect access control vulnerability allowing a low-privilege backend administrator with administrator-update permission to change the password of the built-in super administrator account without providing the old password. This flaw arises because the server does not enforce protection for the super administrator account during password updates.
CVE-2026-78862 is a vulnerability in the Mercusys AC12 V2 router that allows a local attacker to execute arbitrary code via the UART serial interface on the device's printed circuit board. This vulnerability has a CVSS score of 6.8, indicating a medium severity level. No affected versions or patches are explicitly stated in the available data.
CVE-2026-78861 is a high-severity vulnerability in Mercusys AC12 V2 that allows a local attacker to execute arbitrary code by leveraging a hardcoded 512-bit RSA private key. This flaw enables unauthorized code execution without requiring privileges or user interaction. The vulnerability has a CVSS score of 7.7, indicating significant confidentiality and integrity impact but no availability impact. No affected versions or patch information are provided, and no known exploits are reported in the wild.
CVE-2026-78860 is a high-severity vulnerability in Mercusys AC12 V2 that allows a local attacker to execute arbitrary code by exploiting the storage of information in plaintext. This vulnerability has a CVSS score of 7.8, indicating significant impact on confidentiality, integrity, and availability. No affected versions or patch information are provided, and no known exploits are reported in the wild.
Bacularis versions 1.0.0 through 6.5.1 contain a Cross Site Scripting (XSS) vulnerability in the LabelFormat field when adding a new pool. This vulnerability allows an attacker with limited privileges and user interaction to inject malicious scripts, potentially impacting confidentiality and integrity of data. The vulnerability has a medium severity rating with a CVSS score of 5.4. No official patch or remediation guidance is currently provided.
Bacularis versions 5.4.0 through 6.5.1 are affected by a Cross Site Scripting (XSS) vulnerability in the Organization name field. This vulnerability allows an attacker to inject malicious scripts that can be executed in the context of a user's browser session. The CVSS score for this vulnerability is 6.1, indicating a medium severity level. No official patch or remediation information is provided in the available data. There are no known exploits in the wild at this time.
FineAdmin version 1.0 contains a critical SQL injection vulnerability in the ButtonService.GetListByFilter() function via the field/order parameter. This flaw allows unauthenticated attackers to execute crafted SQL statements, potentially exposing sensitive database information and impacting confidentiality, integrity, and availability.
ApiAdmin versions 5.0 and earlier contain a directory traversal vulnerability in the admin file-upload endpoint. This flaw allows any logged-in admin user to upload files with arbitrary extensions, including .php, without any validation or content checks. Uploaded files are stored in a web-accessible directory, enabling remote code execution by accessing the uploaded PHP file via HTTP.
ApiAdmin version 5.0 and earlier contains a SQL Injection vulnerability in the user-list endpoint GET /admin/User/getUsers via the gid parameter. This vulnerability allows an attacker with low privileges to execute unauthorized SQL queries, potentially leading to unauthorized data disclosure. The vulnerability has a medium severity rating with a CVSS score of 6.5. No patch or remediation information is currently provided.