Threat Intelligence Database

A weakness has been identified in SourceCodester Performance Indicator System 1.0. The affected element is an unknown function of the file /opils/staff/sales_history.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

CVE-2026-108967 is a SQL injection vulnerability in SourceCodester Performance Indicator System version 1.0. The flaw exists in the /opils/staff/edit_credit.php file, where manipulation of the 'credit' parameter allows injection of SQL commands. This vulnerability can be exploited remotely without authentication. Public exploit code is available, increasing the risk of attacks. The vulnerability has a medium severity rating with a CVSS score of 6.9.

CVE-2026-108966 is a SQL injection vulnerability in SourceCodester Performance Indicator System version 1.0. The vulnerability exists due to improper handling of the 'Category' argument in the /opils/staff/product.php file, allowing remote attackers to inject SQL code. An exploit is publicly available, but no official patch or fix has been indicated.

Exoproc is a TypeScript-based engine designed for Windows x64 that enables thread redirection and memory manipulation in external processes without using traditional DLL injection or creating remote threads. It supports native Windows processes and JVM instances, allowing interaction with Java classes and methods externally. The tool is intended for educational, security research, and malware analysis purposes, providing advanced instrumentation capabilities while explicitly disclaiming use for unauthorized exploitation.

This is a description of a local homelab environment designed for practicing system administration, networking, and offensive security techniques. The lab simulates an enterprise network with multiple VLANs, a perimeter firewall, Active Directory domain, and attacker platforms. It is intended as a training and testing environment rather than a vulnerability or active threat.

SourceCodester Performance Indicator System version 1.0 contains a SQL injection vulnerability in the /opils/staff/edit_quantity.php file. The vulnerability arises from improper handling of the 'pqty' parameter, allowing remote attackers to manipulate SQL queries. This flaw has a CVSS 4.0 base score of 6.9, indicating medium severity. The vulnerability has been publicly disclosed, but no official patch or fix has been provided yet. Exploitation requires no privileges or user interaction, but the impact is limited to low confidentiality, integrity, and availability impacts.

Perforce Helix Authentication Service (HAS) versions 2022.1 through 2025.2 include a vulnerability where the default SCIM bearer token is not replaced during installation, allowing unauthorized access to the SCIM API. This can be exploited to perform user and group operations. Additionally, a related prototype pollution vulnerability in the scim-patch dependency can be triggered via crafted SCIM PATCH requests, leading to application state corruption, service disruption, and potentially remote code execution in certain Node.js environments. The issue was fixed in version 2026.1 released on July 17, 2026.

CVE-2026-108964 is a SQL injection vulnerability in SourceCodester Performance Indicator System version 1.0. The flaw exists in the /opils/admin/addproduct.php file, where manipulation of the prodcategory argument allows remote attackers to perform SQL injection. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Exploit code has been publicly disclosed, but no known active exploitation in the wild has been reported. No official patch or remediation guidance is currently available.

CVE-2026-108962 is a code injection vulnerability in the storyicon comfyui_segment_anything project affecting the SLConfig._file2dict function in the local_groundingdino/util/slconfig.py file. The vulnerability allows remote attackers to manipulate the config argument, leading to code injection. The project uses rolling releases, so specific affected and fixed versions are not available. The vendor has been informed but has not yet responded or provided a patch. The CVSS 4.0 score rates this vulnerability as medium severity.

CVE-2026-108961 is a code injection vulnerability in PaddlePaddle PaddleX affecting versions 3.7.0, 3.7.1, and 3.7.2. The flaw exists in the NormalizeImage.__init__ function within the Preprocessor component, where manipulation of the scale argument can lead to code injection. This vulnerability can be exploited remotely. A fix has been developed but the pull request is still pending acceptance. The CVSS 4.0 score is 5.3, indicating a medium severity level.