OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveillance module that allows users with Clinician-level privileges to read and modify arbitrary database contents by submitting crafted values in the form_icd_codes[] POST parameter to the syndromicsurveillance/index endpoint. Attackers can inject an unquoted numeric IN() clause and UNION DISTINCT SELECT statement using hex-encoded literals to abuse MySQL extractvalue() for error-based exfiltration of bcrypt password hashes and execute stacked queries that reset passwords, resulting in full administrative account takeover.
A flaw was found in dnsmasq. When following a CNAME in a DNS response, the resolver can cache records for the CNAME target without checking that those records belong to the responding server's authorized zone. In split-DNS deployments that send some domains to a specific upstream, an attacker who controls that upstream can inject cache entries for unrelated names. Later clients may then receive attacker-chosen addresses for those names.
oapi-codegen versions 2.0.0 through 2.8.0 contain a code injection vulnerability. This flaw allows attackers who control an OpenAPI document to inject arbitrary Go code by supplying crafted non-literal enum entries in integer, number, or boolean schemas. The injected code executes when the generated package is built and imported. The vulnerability is fixed in version 2.8.1.
oapi-codegen versions 2.5.0 through 2.8.0 contain a code injection vulnerability. This flaw allows attackers who control an OpenAPI document to inject arbitrary Go code via the servers[].x-go-name field, which is emitted unescaped in the server-urls template. The injected code can include a func init() that executes when the victim builds and imports the generated package. The vulnerability is fixed in version 2.8.1.
Yamaha Corporation's wireless LAN router NWR100 has a vulnerability involving insecure storage of sensitive information. Configuration files exported via the router's CONFIG file export function can be accessed by unauthenticated attackers, potentially exposing sensitive data. This vulnerability has a CVSS score of 6.5, indicating a medium severity level.
Yamaha Corporation's wireless LAN router NWR100 contains a critical OS command injection vulnerability (CVE-2026-97854). This flaw allows an attacker to execute arbitrary operating system commands by sending a specially crafted request to the device. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. No patch or remediation information is currently provided.
CVE-2026-103665 is a vulnerability in the installer for Yamaha LAN Monitor for Windows. The installer may insecurely load DLL files from its launch directory, allowing a malicious DLL to be loaded if placed there. This can lead to arbitrary code execution with administrative privileges.
Yamaha Corporation's YMS-VPN8 and YMS-VPN8-CP products register Windows services with unquoted file paths. This misconfiguration can allow a user with write permissions on the system drive to execute arbitrary code with SYSTEM privileges. The vulnerability has a CVSS score of 6.7, indicating a medium severity level.
The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billing_first_name, billing_last_name' parameter in all versions up to, and including, 3.7.29 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the Newsman Remarketing feature is enabled and a non-empty Remarketing ID is configured in the plugin settings.
The Newsmatic WordPress theme by blazethemes contains a blind SQL Injection vulnerability in the 'slug' parameter in all versions up to and including 1.5.0. This flaw allows unauthenticated attackers to inject additional SQL commands due to improper escaping and insufficient query preparation, potentially exposing sensitive database information.
The MW WP Form WordPress plugin versions up to and including 5.1.7 contain a vulnerability that allows unauthenticated attackers to access sensitive personal information. By exploiting the 'post_id' parameter and enumerating sequential post IDs, attackers can retrieve names, email addresses, and message contents from other users' form submissions. This issue requires the targeted form to have the querystring setting enabled, which is a standard feature of the plugin.
Meta Box – A Framework for Dynamic Websites WordPress plugin versions up to 5.15.2 are vulnerable to stored cross-site scripting (XSS) via the 'profile_background' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view affected pages. Exploitation depends on how consuming plugins or themes expose and render this field.
NEX-Forms – Ultimate Forms Plugin for WordPress versions up to and including 9.3.2 contains a stored cross-site scripting (XSS) vulnerability via the 'type' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access the affected pages.
open versions from 7.2.0 up to but not including 11.0.0 contain an OS command injection vulnerability on Windows and WSL. This flaw allows attackers to execute arbitrary PowerShell commands by supplying specially crafted URLs that include $(...) subexpressions. The vulnerability arises because these URLs are passed unescaped to powershell -EncodedCommand in index.js, enabling code execution. Fixed versions are 11.0.0 and later.
CVE-2026-5702 is a Cross-Site Request Forgery (CSRF) vulnerability in the SABBATIC application. This flaw allows an attacker to trick an authenticated user into performing unauthorized actions by clicking a malicious link or loading a crafted page that sends unauthorized requests to the vulnerable endpoint. The vulnerability has a medium severity rating with a CVSS score of 4.8. No affected versions or patches are specified in the available data.
CVE-2026-5700 is a stored Cross-Site Scripting (XSS) vulnerability in the SABBATIC application. It occurs in the 'observaciones' parameter of the /mis-gastos endpoint, allowing attackers to inject and store malicious JavaScript code. When a user views the affected page, the injected script executes in their browser. This vulnerability has a medium severity score of 4.8 and does not have any known exploits in the wild. No affected versions or patches have been specified.
CVE-2026-5699 is a stored Cross-Site Scripting (XSS) vulnerability in the SABBATIC application. It allows an attacker to inject and store malicious JavaScript code via the 'companyName' parameter at the /empresa endpoint. When a user views the affected page, the injected script executes in their browser. The vulnerability has a medium severity score of 4.8 and does not currently have a known exploit in the wild or an available patch.
CVE-2026-5698 is a stored Cross-Site Scripting (XSS) vulnerability in the SABBATIC application. It allows attackers to inject and store malicious JavaScript code via the 'titulo_es' and 'add_etiquetas[]' parameters on the '/categorías' endpoint. When a user views the affected page, the stored script executes in their browser. The vulnerability has a medium severity with a CVSS score of 4.8.
CVE-2026-5697 is a stored Cross-Site Scripting (XSS) vulnerability in the SABBATIC application. It allows an attacker to inject and store malicious JavaScript code via the 'nombre' parameter in the '/usuario' endpoint. When a user views the affected page, the injected script executes in their browser. The vulnerability has a medium severity rating with a CVSS score of 4.8.