Threat Intelligence Database

CVE-2026-78062 is a medium severity vulnerability in vas3k TaxHacker versions 0.8.0, 0.8.1, and 0.8.2. It involves hard-coded credentials due to manipulation of the BETTER_AUTH_SECRET argument in the envSchema.parse function within the JWT Secret Handler component. The vulnerability can be exploited remotely. The project has been informed but has not yet responded. The product is a cloud service, and a patch is available.

CVE-2026-78063 is a command injection vulnerability in the Tenda CH22 router firmware version 1.0.0.1. The flaw exists in the formeditFileName function of the /goform/editFileName endpoint, where the editNameMit parameter can be manipulated to execute arbitrary commands remotely. The vulnerability has a medium severity rating with a CVSS score of 5.3. Public exploit code is available, but no official patch or remediation guidance has been provided by the vendor as of the publication date.

CVE-2026-78061 is a server-side request forgery (SSRF) vulnerability in vas3k TaxHacker versions 0.8.0, 0.8.1, and 0.8.2. The flaw exists in the buildImapConfig function within the Email Sync component, where manipulation of the host or port arguments can lead to SSRF. This vulnerability can be exploited remotely. A patch has been developed but is pending acceptance. The product is a cloud service, so remediation may be managed by the vendor.

SourceCodester Stock Management System version 1.0 contains a cross-site scripting (XSS) vulnerability in the /php_action/getOrderReport.php file. This vulnerability arises from improper handling of the clientName and clientContact parameters, allowing remote attackers to inject malicious scripts. The vulnerability has a medium severity with a CVSS score of 5.3. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

SourceCodester Stock Management System version 1.0 contains a cross-site scripting (XSS) vulnerability in the /php_action/printOrder.php file. The vulnerability arises from improper handling of the clientName and clientContact parameters, allowing remote attackers to inject malicious scripts. This issue has been publicly disclosed and can be exploited remotely. The vulnerability has a medium severity rating with a CVSS score of 5.3. No official patch or remediation guidance is currently available.

CVE-2026-78057 is a medium severity SQL injection vulnerability in the sambitraj Student-Management-System affecting the Management Mutation Handler component. The flaw allows remote attackers to manipulate several input arguments (roll_no, name, father_name, class, mobile, email, password, remark) to perform SQL injection. The product uses a rolling release strategy, so specific affected versions are not provided. The vendor has not responded to the issue report, and no patch or remediation is currently available. Exploit code has been published but no known exploitation in the wild has been reported.

CVE-2026-78056 is a medium severity SQL injection vulnerability in the sambitraj Student-Management-System affecting the Dashboard component. The flaw allows remote attackers to manipulate the roll_no or teacher_name parameters to execute SQL injection attacks. The product uses a rolling release model, so specific affected versions are not available. The vulnerability was reported early, but the vendor has not yet responded or provided a fix. Public exploit code is available, but no confirmed exploitation in the wild has been reported.

CVE-2026-78055 is a cross-site scripting (XSS) vulnerability in SourceCodester Class and Exam Timetabling System version 1.0. The issue arises from improper handling of the 'course' argument in the /BSIT2.php file, allowing remote attackers to inject malicious scripts. The vulnerability has a medium severity score of 5.3 and requires user interaction for exploitation. There is no official patch or remediation guidance currently available.

CVE-2026-78136 is a high severity vulnerability in chirpmyradio CHIRP before commit 39178db. It involves an eval injection flaw in the _clean_tmode function within drivers/kenwood_itm.py, triggered by crafted CSV data. This improper neutralization of directives in dynamically evaluated code (CWE-95) can lead to high impact on confidentiality, integrity, and availability.

SourceCodester Class and Exam Timetabling System version 1.0 contains a cross-site scripting (XSS) vulnerability in an unspecified function within the /BSIS1.php file. The vulnerability arises from improper handling of the 'course' argument, allowing remote attackers to inject malicious scripts. Public exploit code is available, but no official patch or remediation has been confirmed. The CVSS 4.0 base score is 5.3, indicating a medium severity risk.