Threat database

CVE-2026-110670 is a medium severity SQL injection vulnerability in cemtan sar2html version 4.0.0. The flaw exists in the updateDb function of the sar2html.py file within the Archive Processing component. It allows remote attackers to manipulate the s2host argument to perform SQL injection. No patch or vendor response has been reported yet.

CVE-2026-110669 is a security vulnerability in cemtan sar2html version 4.0.0 affecting the deleteHost, deleteRange, and deleteAll functions in sar2html.py. The flaw results in missing authentication, allowing remote attackers to perform unauthorized deletions. The vulnerability has a medium severity score of 6.9 and has been publicly disclosed, but no patch or vendor response is currently available.

CVE-2026-110668 is a medium severity SQL injection vulnerability in cemtan sar2html version 4.0.0. The flaw exists in the index function of the sar2html.py file, where manipulation of the 'sort' argument allows remote attackers to perform SQL injection. Public exploit code is available, but the vendor has not yet responded or issued a fix.

CVE-2026-110667 is a medium severity vulnerability in cemtan sar2html version 4.0.0 involving hard-coded credentials due to manipulation of the SECRET_KEY argument in sar2html.py. This flaw allows remote attackers to exploit the hard-coded credentials. The project has been informed but has not yet responded or issued a fix.

CVE-2026-110666 is a path traversal vulnerability in cemtan sar2html version 4.0.0. The flaw exists in the updateDb function of the sar2html.py file related to file upload handling. This vulnerability allows remote attackers to manipulate file paths, potentially accessing unauthorized files. The issue was reported early to the project, but no response or fix has been provided yet. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity.

A vulnerability was detected in cemtan sar2html 4.0.0. This affects an unknown part of the file sar2html.py of the component Search. Performing a manipulation of the argument Search results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.