Threat Intelligence Database

A SQL injection vulnerability exists in AojiaoZero Antaris version 1.0 in the _rewardPurchase function of the /ipn.php file, specifically in the PayPal IPN Payment Handler component. The vulnerability is triggered by manipulation of the item_number argument and can be exploited remotely. The vendor has not responded to disclosure attempts, and no patch or official remediation is currently available. The CVSS 4.0 base score is 5.3, indicating a medium severity level.

A critical cross-site scripting (XSS) vulnerability exists in OpenWrt LuCI where DHCPv6 lease hostnames are not properly encoded before being displayed in status tables. This allows an adjacent network attacker to inject malicious HTML or script code via DHCPv6 Client FQDN fields. When an administrator views the DHCP lease page, the injected script executes in their browser, potentially compromising the administrative interface.

A stored cross-site scripting (XSS) vulnerability exists in the luci-app-upnp component of OpenWrt's luci interface. Unauthenticated LAN clients can inject malicious JavaScript via UPnP IGD AddPortMapping SOAP requests by supplying crafted input in the NewPortMappingDescription field. This input is stored by miniupnpd and rendered without proper output encoding in luci-app-upnp, leading to script execution when administrators view the UPnP or Status pages. The vulnerability has a high severity score of 8.7.

CVE-2026-59260 is a high-severity vulnerability in the OpenWrt luci-app-samba4 component. It involves improper privilege management where read ACL permissions grant file.exec rights on /usr/sbin/smbd. This allows authenticated delegated users to execute the Samba daemon with command-line arguments they control. Attackers can leverage this to pass arbitrary Samba global options, including message commands, to a root smbd process, potentially leading to command execution triggered by SMB protocol message processing.

AstrBotDevs AstrBot versions 4.25.0, 4.25.1, and 4.25.2 contain a server-side request forgery (SSRF) vulnerability in the get_online_plugins function of the market_list endpoint. This vulnerability arises from manipulation of the custom_registry argument and can be exploited remotely without user interaction. The vendor has not responded to the disclosure, and no official patch or remediation is currently available. The vulnerability has a medium severity rating with a CVSS score of 5.3.

CVE-2026-15492 is a medium severity cross-site scripting (XSS) vulnerability in the igweze wizgrade product, specifically in the dashboard/studentConductManager.php file. The vulnerability allows remote attackers to perform XSS attacks due to improper input handling. The product uses a rolling release system, so specific affected or fixed versions are not disclosed. The vendor has not responded to the vulnerability disclosure, and no official patch or remediation guidance is currently available. Exploit details have been publicly disclosed, but no known exploits are reported in the wild.

CVE-2026-15493 is a medium severity cross-site scripting (XSS) vulnerability in the Akpali9 Attendance-Management-System affecting the processing of the export_date parameter in absent.php. The vulnerability allows remote attackers to inject malicious scripts via manipulation of this argument. The product uses a rolling release model, so no specific affected or fixed versions are identified. The vendor has not responded to disclosure attempts, and no patch or official remediation guidance is currently available.

This advisory relates to the Red Hat OpenShift for Windows Containers 10.17.0 product release, which enables deployment of Windows container workloads on Windows Server containers. No specific vulnerabilities or CVEs are identified in this advisory. There is no indication of active exploits or detailed technical vulnerabilities. The advisory is informational in nature.

CVE-2026-15499 is a medium severity vulnerability in AstrBotDevs AstrBot versions 4.25.0, 4.25.1, and 4.25.2. It involves improper authorization in the Scheduled Task Handler component, specifically in the FutureTaskTool.call function. Manipulating the argument payload["note"] can lead to unauthorized actions. Remote exploitation is possible, and a public exploit has been released. The vendor has not responded or provided a fix.

CVE-2026-15498 is a medium severity SQL injection vulnerability in the sergomanov SmartHomeAdatum product. It affects an unspecified function in the users.php file within the Login component. The vulnerability allows remote attackers to manipulate the Login argument to perform SQL injection. The product uses a rolling release model, so no specific affected or fixed versions are identified. The vendor has not responded to the disclosure, and no patch or remediation guidance is currently available.