Threat Intelligence Database

CVE-2026-105706 is a medium severity vulnerability in SourceCodester Drug Recommendation System version 1.0 that allows remote attackers to perform cross-site request forgery (CSRF) attacks. The vulnerability affects an unspecified function and requires user interaction to exploit. No official patch or remediation information is currently available.

CVE-2026-105705 is a cross-site scripting (XSS) vulnerability in SourceCodester Drug Recommendation System version 1.0. The flaw exists in the Admin/add_drug.php file, allowing remote attackers to inject malicious scripts. The vulnerability has a medium severity score of 5.3 and requires user interaction to exploit. Public exploit code is available, increasing the risk of attacks.

CVE-2026-105704 is an improper authentication vulnerability in SourceCodester Drug Recommendation System version 1.0. It involves manipulation of the user_id argument within the Auth Guard component, allowing remote attackers to bypass authentication. The vulnerability has a medium severity with a CVSS score of 6.9. Exploit code is publicly available, but no known active exploitation in the wild has been reported. No official patch or remediation guidance is currently provided.

CVE-2026-105703 is a medium severity vulnerability in PHPGurukul User Registration & Login and User Management System version 3.3. It involves incorrect authorization due to manipulation of the currentpassword argument in the change-password.php component. This flaw allows remote attackers with high privileges to bypass intended authorization controls. The vulnerability has been publicly disclosed but no official patch information is provided.

CVE-2026-105621 is a medium severity vulnerability in jishenghua jshERP versions 3.0 through 3.5. It affects the updateAccountHeadAndDetail function in the Financial Receipt Update Handler component, allowing improper authorization through remote manipulation. The vulnerability has a CVSS 4.0 base score of 5.3. Although the issue was reported early, the vendor has not responded or issued a patch. Public exploit code is available, but no confirmed active exploitation is reported.

CVE-2026-105611 is an improper authorization vulnerability in chillzhuang SpringBlade versions 5.0.0 and 5.0.1. It affects a function in the RoleController component related to user detail endpoints. The vulnerability allows remote attackers to manipulate an argument ID to bypass authorization controls. The issue was reported early to the project but has not yet received a response or fix. The vulnerability has a medium severity rating with a CVSS score of 5.1. Exploit code has been publicly disclosed but there are no known exploits in the wild at this time.

CVE-2026-105610 is a medium severity vulnerability in chillzhuang SpringBlade versions 5.0.0 and 5.0.1. It involves improper authorization related to the manipulation of the initPassword argument in the Parameter Submit Management component. The vulnerability can be exploited remotely and a public exploit exists. The vendor has been informed but has not yet responded or provided a fix.

The Universal Library for Linux (uldaq) by Measurement Computing Corporation contains a stack-based buffer overflow vulnerability. No specific affected versions or patch information are provided. There is no evidence of known exploits in the wild.

The Android application "Ticket Ryutsu Center" by Wavedash Co., Ltd. contains multiple unspecified vulnerabilities. No detailed technical information, affected versions, or exploit data are provided.

CVE-2026-105573 is a medium severity vulnerability in newbee-ltd newbee-mall versions 2.7.0 through 2.7.5. It involves business logic errors triggered by manipulation of the goodsCount argument in the Shopping Cart Quantity Handler component. The vulnerability can be exploited remotely without user interaction. Although the issue was reported early, the vendor has not yet responded or issued a fix. Public exploit code exists, but no known active exploitation in the wild has been reported.