Base de CVEs

CVE-2026-2663 Média · 6.3 CWE-74 18/02/2026

Alixhan xh-admin-backend Database Query query sql injection

A security vulnerability has been detected in Alixhan xh-admin-backend up to 1.7.0. This issue affects some unknown processing of the file /frontend-api/system-service/api/system/role/query of the component Database Query Handler. Such manipulation of the argument prop leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-2019 Alta · 7.2 CWE-74 18/02/2026

Cart All In One For WooCommerce <= 1.1.21 - Authenticated (Administrator+) Code Injection via 'sc_assign_page' Setting

The Cart All In One For WooCommerce plugin for WordPress is vulnerable to Code Injection in all versions up to, and including, 1.1.21. This is due to insufficient input validation on the 'Assign page' field which is passed directly to the eval() function. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute arbitrary PHP code on the server.

CVE-2026-2621 Alta · 7.3 CWE-74 17/02/2026

Sciyon Koyuan Thermoelectricity Heat Network Management System AsyncTreeProxy.aspx sql injection

A security vulnerability has been detected in Sciyon Koyuan Thermoelectricity Heat Network Management System 3.0. This affects an unknown part of the file /SISReport/WebReport20/Proxy/AsyncTreeProxy.aspx. The manipulation of the argument PGUID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-2620 Alta · 7.3 CWE-74 17/02/2026

Huace Monitoring and Early Warning System ProjectRole.aspx sql injection

A weakness has been identified in Huace Monitoring and Early Warning System 2.2. Affected by this issue is some unknown functionality of the file /Web/SysManage/ProjectRole.aspx. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-2615 Alta · 7.2 CWE-74 17/02/2026

Wavlink WL-NU516U1 firewall.cgi singlePortForwardDelete command injection

A flaw has been found in Wavlink WL-NU516U1 up to 20251208. The affected element is the function singlePortForwardDelete of the file /cgi-bin/firewall.cgi. Executing a manipulation of the argument del_flag can lead to command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-2553 Média · 6.3 CWE-74 16/02/2026

tushar-2223 Hotel-Management-System HTTP POST Request home.php sql injection

A security flaw has been discovered in tushar-2223 Hotel-Management-System up to bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15. This affects an unknown part of the file /home.php of the component HTTP POST Request Handler. Performing a manipulation of the argument Name/Email results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-2548 Média · 6.3 CWE-74 16/02/2026

WAYOS FBM-220G rc sub_40F820 command injection

A flaw has been found in WAYOS FBM-220G 24.10.19. This affects the function sub_40F820 of the file rc. Executing a manipulation of the argument upnp_waniface/upnp_ssdp_interval/upnp_max_age can lead to command injection. The attack can be executed remotely. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-2533 Alta · 7.3 CWE-74 16/02/2026

Tosei Self-service Washing Machine tosei_datasend.php command injection

A flaw has been found in Tosei Self-service Washing Machine 4.02. Impacted is an unknown function of the file /cgi-bin/tosei_datasend.php. Executing a manipulation of the argument adr_txt_1 can lead to command injection. It is possible to launch the attack remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-2469 Alta · 7.6 CWE-74 14/02/2026

Versions of the package directorytree/imapengine before 1.22.3 are vulnerable to…

Versions of the package directorytree/imapengine before 1.22.3 are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the id() function in ImapConnection.php due to improperly escaping user input before including it in IMAP ID commands. This allows attackers to read or delete victim's emails, terminate the victim's session or execute any valid IMAP command on victim's mailbox by including quote characters " or CRLF sequences \r\n in the input.

CVE-2026-25814 Crítica · 9.8 CWE-74 09/02/2026

NoSQL Injection Risk via Unsanitized Query Parameters

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, User-controlled query parameters are passed directly into DynamoDB query/filter construction without validation or sanitization.

CVE-2026-2189 Crítica · 9.8 CWE-74 08/02/2026

Injeção de SQL no itsourcecode School Management System

Foi identificada uma vulnerabilidade no itsourcecode School Management System 1.0. Ela afeta uma função desconhecida do arquivo /ramonsys/report/index.php. A manipulação do argumento ay leva a injeção de SQL. O ataque pode ser iniciado remotamente. O exploit está publicamente disponível e pode ser utilizado.

CVE-2026-2182 Alta · 7.2 CWE-74 08/02/2026

UTT 进取 521G setSysAdm doSystem command injection

A weakness has been identified in UTT 进取 521G 3.1.1-190816. Affected by this issue is the function doSystem of the file /goform/setSysAdm. Executing a manipulation of the argument passwd1 can lead to command injection. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks.

CVE-2026-2179 Alta · 7.2 CWE-74 08/02/2026

PHPGurukul Hospital Management System manage-users.php sql injection

A vulnerability was determined in PHPGurukul Hospital Management System 4.0. This impacts an unknown function of the file /admin/manage-users.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2026-2171 Crítica · 9.8 CWE-74 08/02/2026

Injeção de SQL no login do Online Student Management System 1.0 da code-projects

Foi encontrada uma vulnerabilidade no Online Student Management System 1.0 da code-projects. Afetada está uma função desconhecida do arquivo accounts.php do componente Login. A manipulação do argumento username/password resulta em injeção de SQL. O ataque pode ser iniciado remotamente. O exploit foi tornado público e pode ser utilizado.

CVE-2026-2162 Alta · 7.2 CWE-74 08/02/2026

itsourcecode News Portal Project aboutus.php sql injection

A vulnerability was determined in itsourcecode News Portal Project 1.0. This affects an unknown part of the file /admin/aboutus.php. This manipulation of the argument pagetitle causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2026-2161 Crítica · 9.8 CWE-74 08/02/2026

Injeção de SQL no forget-password.php do itsourcecode Directory Management System 1.0

Foi identificada uma vulnerabilidade no itsourcecode Directory Management System 1.0. Afeta uma funcionalidade não especificada do arquivo /admin/forget-password.php. A manipulação do argumento email resulta em injeção de SQL. O ataque pode ser realizado remotamente. O exploit foi tornado público e pode ser utilizado.

CVE-2026-2135 Alta · 8.8 CWE-74 08/02/2026

UTT HiPER 810 formPdbUpConfig sub_43F020 command injection

A vulnerability was detected in UTT HiPER 810 1.7.4-141218. The impacted element is the function sub_43F020 of the file /goform/formPdbUpConfig. Performing a manipulation of the argument policyNames results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

CVE-2026-2118 Alta · 7.2 CWE-74 07/02/2026

UTT HiPER 810 rehttpd formReleaseConnect sub_4407D4 command injection

A vulnerability was determined in UTT HiPER 810 1.7.4-141218. The impacted element is the function sub_4407D4 of the file /goform/formReleaseConnect of the component rehttpd. Executing a manipulation of the argument Isp_Name can lead to command injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2026-2117 Crítica · 9.8 CWE-74 07/02/2026

Injeção de SQL no Society Management System 1.0 da itsourcecode

Foi identificada uma vulnerabilidade no itsourcecode Society Management System 1.0. O elemento afetado é uma função desconhecida do arquivo /admin/edit_activity.php. Ao manipular o argumento activity_id, ocorre injeção de SQL. O ataque pode ser iniciado remotamente. O exploit foi tornado público e pode ser utilizado.

CVE-2026-2116 Crítica · 9.8 CWE-74 07/02/2026

itsourcecode Society Management System: injeção de SQL em edit_expenses.php

Foi encontrada uma vulnerabilidade no itsourcecode Society Management System 1.0. Afetada está uma função desconhecida do arquivo /admin/edit_expenses.php. Tal manipulação do argumento expenses_id leva a injeção de SQL. É possível lançar o ataque remotamente. O exploit foi divulgado publicamente e pode ser usado.

CVE-2026-2115 Crítica · 9.8 CWE-74 07/02/2026

Injeção de SQL no Society Management System 1.0 da itsourcecode em delete_expenses.php

Foi identificada uma falha no itsourcecode Society Management System 1.0. Ela afeta algum processamento desconhecido do arquivo /admin/delete_expenses.php. Essa manipulação do argumento expenses_id causa injeção de SQL. É possível iniciar o ataque remotamente. O exploit foi publicado e pode ser utilizado.

CVE-2026-2114 Crítica · 9.8 CWE-74 07/02/2026

itsourcecode Society Management System - Injeção de SQL via admin_id (CVE-2026-2114)

Foi detectada uma vulnerabilidade no itsourcecode Society Management System 1.0. Ela afeta código não especificado do arquivo /admin/edit_admin.php. A manipulação do argumento admin_id resulta em injeção de SQL. O ataque pode ser realizado remotamente. O exploit está agora público e pode ser utilizado.

CVE-2026-2090 Crítica · 9.8 CWE-74 07/02/2026

Injeção de SQL no SourceCodester Online Class Record System (CVE-2026-2090)

Foi identificada uma vulnerabilidade no SourceCodester Online Class Record System 1.0. Este problema afeta um processamento desconhecido do arquivo /admin/message/search.php. A manipulação do argumento term pode levar a injeção de SQL. O ataque pode ser executado remotamente. A exploração foi divulgada publicamente e pode ser utilizada.

CVE-2026-2089 Crítica · 9.8 CWE-74 07/02/2026

SourceCodester Online Class Record System controller.php sql injection

A vulnerability was found in SourceCodester Online Class Record System 1.0. This vulnerability affects unknown code of the file /admin/subject/controller.php. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been made public and could be used.

CVE-2026-2088 Crítica · 9.8 CWE-74 07/02/2026

Injeção de SQL no PHPGurukul Beauty Parlour Management System via delid (CVE-2026-2088)

Foi identificada uma vulnerabilidade no PHPGurukul Beauty Parlour Management System 1.1. Ela afeta uma parte não especificada do arquivo /admin/accepted-appointment.php. A manipulação do argumento delid leva a injeção de SQL. O ataque pode ser realizado remotamente. A exploração foi divulgada publicamente e pode ser utilizada.