Threat database

CVE-2026-108806 is a SQL injection vulnerability in the krupalshah EmployeeRecruitmentSystem affecting the Forgot Password Handler component. The vulnerability arises from unsafe use of the mysql_query function with the fpemail argument in source/authprocessing.php. It allows remote attackers to manipulate SQL queries. The product lacks versioning and is no longer supported by the maintainer. Public exploit details have been disclosed. No patch or remediation is available.

The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to permanently delete all comments on the site.

The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability (Administrator by default) to store a payload that is executed in the browser of any administrator who later opens that page. As the unfiltered_html capability is not available to administrators on multisite (or where DISALLOW_UNFILTERED_HTML is set), this leads to Stored Cross-Site Scripting.

The Hotel Booking WordPress plugin through 3.8 does not implement CSRF protection on its administrative booking order management, allowing attackers to trick a logged-in administrator into creating, deleting, or modifying arbitrary booking order records via a forged request.

The Hotel Booking WordPress plugin through 3.8 does not verify that a booking record belongs to the user requesting it, allowing any authenticated user such as a Subscriber to read other customers' booking details, including their name, email address, phone number and postal address, by referencing an identifier they do not own.

CVE-2026-108805 is a SQL injection vulnerability in the krupalshah EmployeeRecruitmentSystem affecting the mysql_query function in source/loginprocessing.php. The vulnerability arises from manipulation of the email/password arguments in the Login Handler component. It can be exploited remotely without authentication. The product uses continuous delivery with rolling releases, so no specific affected or fixed versions are available. The vendor did not respond to disclosure and no patch information is available. This vulnerability affects unsupported versions of the product.

CVE-2026-109080 is a SQL injection vulnerability in the bulk license plate search feature of the Flock Night Shift hosted service. An authenticated user could exploit this flaw to read license plate recognition data belonging to other customer organizations. The vulnerability does not allow modification of data. Flock identified and remediated the issue on 2026-08-12, and no customer action is required.

CVE-2026-108804 is a critical OS command injection vulnerability in the Web Management Backend of TRENDnet TEW-751DR, TEW-752DRU, and TEW733GR routers version 1.03B01 and 1.03B03. The flaw exists in the fwrite function of pigwidgeon.cgi, allowing remote attackers to inject operating system commands via the 'service' argument. The vulnerability affects routers that reached end-of-life in 2011, and the vendor does not provide patches or support for these models. Exploit code is publicly available, but no active exploitation in the wild is confirmed.

CVE-2026-108803 is a medium severity vulnerability in y_project RuoYi versions 4.8.0 through 4.8.3. It affects the changeStatus function in the /system/config/add component called Disable API. The vulnerability allows remote attackers to cause session expiration. The vendor has not responded to disclosure and no patch information is available.

CVE-2026-107203 is an incorrect authorization vulnerability in the Foreman package used by Red Hat Satellite 6. The flaw affects network interface handling where API checks only verify host permission but do not enforce search limits. This allows a low-privileged user with some host view permissions to access interface records of hosts they should not see within a shared domain or subnet. Additionally, if the user has edit permissions on some hosts, they can modify interfaces of unauthorized hosts, with changes being saved.

CVE-2026-107193 is a medium severity vulnerability in Red Hat Satellite 6's foreman package involving authorization bypass through user-controlled keys in permission filters. A low-privileged user allowed to delete filters for one role can delete filters belonging to other unlocked roles, causing those roles to lose access granted by the deleted filters.

CVE-2026-108802 is a medium severity cross-site scripting (XSS) vulnerability in y_project RuoYi versions 4.8.0 through 4.8.3. The flaw exists in the renderDrawer function of the /system/dict/data/add component, where manipulation of the cssClass argument can lead to XSS. The vulnerability can be exploited remotely and exploit code is publicly available. The vendor has not responded to the disclosure, and no patch or remediation guidance is currently available.

CVE-2026-21139 is a high-severity vulnerability in Samsung Continuity Service for Windows prior to version 4.6.1217.0. It involves improper access control that allows adjacent attackers to manipulate the connected mobile device. The vulnerability has a CVSS 4.0 base score of 7.3, indicating significant risk. No explicit affected versions or patch information is provided in the input data.

CVE-2026-21138 is a vulnerability in Samsung Mobile Smart Switch prior to version 3.7.73 where insufficient verification of data authenticity allows physical attackers to install arbitrary applications on the device. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No patch or remediation information is provided in the available data. The vulnerability requires physical access and does not require user interaction or privileges. No known exploits are reported in the wild.

Path traversal in Smart Switch prior to version 3.7.73 allows physical attackers to access files with Smart Switch privilege.

CVE-2026-21136 is an improper authorization vulnerability in Samsung Mobile Smart Switch prior to version 3.7.73. This flaw allows physical attackers to invoke the application restore process without proper authorization. The vulnerability has a medium severity with a CVSS 4.0 base score of 6.8. No known exploits are reported in the wild. No specific affected versions were explicitly stated beyond being prior to 3.7.73.

CVE-2026-21135 is an improper access control vulnerability in Samsung Internet browser versions prior to 30.0.5.6. It allows local attackers to access sensitive information without proper authorization. The vulnerability has a medium severity with a CVSS 4.0 score of 5.9. No specific affected versions were explicitly stated beyond being prior to 30.0.5.6. There is no information about available patches or vendor advisories confirming remediation status.

CVE-2026-21134 is an improper authentication vulnerability in Samsung Flow prior to version 4.9.22.4. This flaw allows adjacent attackers to access sensitive information without proper authentication. The vulnerability has a medium severity with a CVSS 4.0 base score of 6.1.

CVE-2026-21133 is a medium severity vulnerability in Samsung Flow prior to version 4.9.22.1. It is a path traversal flaw (CWE-22) that allows local attackers to access clipboard data by improperly limiting pathname access to restricted directories.

CVE-2026-21132 is an improper input validation vulnerability in Samsung Internet browser versions prior to 30.0.5.24. This flaw allows remote attackers to inject arbitrary scripts, but requires user interaction to trigger. The vulnerability has a medium severity rating with a CVSS 4.0 score of 6. Affected versions are those before 30.0.5.24. No explicit patch information is provided in the input data.