Base de CVEs

CVE-2026-2087 Crítica · 9.8 CWE-74 07/02/2026

Injeção de SQL no login administrativo do Online Class Record System 1.0

Foi identificada uma falha no SourceCodester Online Class Record System 1.0. Afeta algumas funcionalidades desconhecidas do arquivo /admin/login.php. A manipulação do argumento user_email causa injeção de SQL. O ataque pode ser iniciado remotamente. O exploit foi publicado e pode ser utilizado.

CVE-2026-2080 Alta · 7.2 CWE-74 07/02/2026

UTT HiPER 810 formUser setSysAdm command injection

A vulnerability has been found in UTT HiPER 810 1.7.4-141218. This issue affects the function setSysAdm of the file /goform/formUser. The manipulation of the argument passwd1 leads to command injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-25586 Crítica · 10.0 CWE-74 06/02/2026

SandboxJS: fuga de sandbox com poluição de protótipo

SandboxJS é uma biblioteca de sandboxing para JavaScript. Antes da versão 0.8.29, é possível realizar uma fuga de sandbox ao sombrear hasOwnProperty em um objeto da sandbox, o que desativa a aplicação da lista de permissões de protótipos no caminho de acesso a propriedades. Isso permite acesso direto a __proto__ e outras propriedades de protótipo bloqueadas, possibilitando a poluição do Object.prototype do host e impacto persistente entre sandboxes. Esta vulnerabilidade está corrigida na versão 0.8.29.

CVE-2026-25520 Crítica · 10.0 CWE-74 06/02/2026

SandboxJS: escape do sandbox por valores de retorno de funções não encapsulados (CVE-2026-25520)

SandboxJS é uma biblioteca de sandboxing de JavaScript. Antes da 0.8.29, os valores de retorno das funções não são encapsulados. Object.values/Object.entries podem ser usados para obter um Array contendo o construtor Function do host; usando Array.prototype.at é possível obter o construtor Function do host, que pode ser usado para executar código arbitrário fora do sandbox. Esta vulnerabilidade está corrigida na 0.8.29.

CVE-2026-1977 Média · 6.3 CWE-74 06/02/2026

isaacwasserman mcp-vegalite-server visualize_data eval code injection

A security vulnerability has been detected in isaacwasserman mcp-vegalite-server up to 16aefed598b8cd897b78e99b907f6e2984572c61. Affected by this vulnerability is the function eval of the component visualize_data. Such manipulation of the argument vegalite_specification leads to code injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-1517 Média · 4.7 CWE-74 05/02/2026

iomad Company Admin Block sql injection

A vulnerability was identified in iomad up to 5.0. Affected is an unknown function of the component Company Admin Block. Such manipulation leads to sql injection. The attack can be executed remotely. It is best practice to apply a patch to resolve this issue.

CVE-2026-1802 Alta · 7.3 CWE-74 03/02/2026

Ziroom ZHOME A0101 zrMacClone.lua macAddrClone command injection

A security flaw has been discovered in Ziroom ZHOME A0101 1.0.1.0. This issue affects the function macAddrClone of the file luci\controller\api\zrMacClone.lua. The manipulation of the argument macType results in command injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-24043 Média · 5.4 CWE-74 02/02/2026

jsPDF Affected by Stored XMP Metadata Injection (Spoofing & Integrity Violation)

jsPDF is a library to generate PDFs in JavaScript. Prior to 4.1.0, user control of the first argument of the addMetadata function allows users to inject arbitrary XML. If given the possibility to pass unsanitized input to the addMetadata method, a user can inject arbitrary XMP metadata into the generated PDF. If the generated PDF is signed, stored or otherwise processed after, the integrity of the PDF can no longer be guaranteed. The vulnerability has been fixed in jsPDF@4.1.0.

CVE-2026-1746 Alta · 8.8 CWE-74 02/02/2026

JeecgBoot Online Report API loadDictItemByKeyword sql injection

A vulnerability was identified in JeecgBoot 3.9.0. This vulnerability affects unknown code of the file /JeecgBoot/sys/api/loadDictItemByKeyword of the component Online Report API. Such manipulation of the argument keyword leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-1735 Média · 4.3 CWE-74 01/02/2026

Yealink MeetingBar A30 Diagnostic command injection

A weakness has been identified in Yealink MeetingBar A30 133.321.0.3. This issue affects some unknown processing of the component Diagnostic Handler. This manipulation causes command injection. It is feasible to perform the attack on the physical device. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-1701 Crítica · 9.8 CWE-74 30/01/2026

Injeção de SQL no itsourcecode School Management System 1.0 (/enrollment/index.php)

Foi detectada uma vulnerabilidade de segurança no itsourcecode School Management System 1.0. O problema afeta um processamento não especificado do arquivo /enrollment/index.php. A manipulação do argumento ID leva a injeção de SQL. É possível realizar o ataque remotamente. O exploit foi divulgado publicamente e pode ser utilizado. Devido a definições de produto contraditórias na divulgação original, esta CVE foi inicialmente atribuída incorretamente ao Student Management System.

CVE-2026-1690 Média · 4.7 CWE-74 30/01/2026

Tenda HG10 formSysCmd system command injection

A flaw has been found in Tenda HG10 US_HG7_HG9_HG10re_300001138_en_xpon. This affects the function system of the file /boaform/formSysCmd. This manipulation of the argument sysCmd causes command injection. The attack may be initiated remotely. The exploit has been published and may be used.

CVE-2026-1689 Alta · 7.3 CWE-74 30/01/2026

Tenda HG10 Login formLogin checkUserFromLanOrWan command injection

A vulnerability was detected in Tenda HG10 US_HG7_HG9_HG10re_300001138_en_xpon. The impacted element is the function checkUserFromLanOrWan of the file /boaform/admin/formLogin of the component Login Interface. The manipulation of the argument Host results in command injection. The attack can be launched remotely. The exploit is now public and may be used.

CVE-2026-1687 Alta · 7.3 CWE-74 30/01/2026

Tenda HG10 Boa Webserver formSamba command injection

A weakness has been identified in Tenda HG10 US_HG7_HG9_HG10re_300001138_en_xpon. Impacted is an unknown function of the file /boaform/formSamba of the component Boa Webserver. Executing a manipulation of the argument serverString can lead to command injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks.

CVE-2026-1625 Alta · 8.8 CWE-74 29/01/2026

D-Link DWR-M961 SMS Message formSmsManage sub_4250E0 command injection

A vulnerability was detected in D-Link DWR-M961 1.1.47. The impacted element is the function sub_4250E0 of the file /boafrm/formSmsManage of the component SMS Message. Performing a manipulation of the argument action_value results in command injection. The attack may be initiated remotely. The exploit is now public and may be used.

CVE-2026-1624 Alta · 8.8 CWE-74 29/01/2026

D-Link DWR-M961 formLtefotaUpgradeFibocom command injection

A security vulnerability has been detected in D-Link DWR-M961 1.1.47. The affected element is an unknown function of the file /boafrm/formLtefotaUpgradeFibocom. Such manipulation of the argument fota_url leads to command injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

CVE-2026-1623 Média · 6.3 CWE-74 29/01/2026

Totolink A7000R cstecgi.cgi setUpgradeFW command injection

A weakness has been identified in Totolink A7000R 4.1cu.4154. Impacted is the function setUpgradeFW of the file /cgi-bin/cstecgi.cgi. This manipulation of the argument FileName causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks.

CVE-2026-1601 Média · 6.3 CWE-74 29/01/2026

Totolink A7000R cstecgi.cgi setUploadUserData command injection

A weakness has been identified in Totolink A7000R 4.1cu.4154. The impacted element is the function setUploadUserData of the file /cgi-bin/cstecgi.cgi. Executing a manipulation of the argument FileName can lead to command injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.

CVE-2026-1596 Alta · 8.8 CWE-74 29/01/2026

D-Link DWR-M961 formLtefotaUpgradeQuectel sub_419920 command injection

A flaw has been found in D-Link DWR-M961 1.1.47. This vulnerability affects the function sub_419920 of the file /boafrm/formLtefotaUpgradeQuectel. This manipulation of the argument fota_url causes command injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.

CVE-2026-1595 Crítica · 9.8 CWE-74 29/01/2026

Injeção de SQL no itsourcecode Society Management System via student_id (CVE-2026-1595)

Foi detectada uma vulnerabilidade no itsourcecode Society Management System 1.0. Ela afeta uma parte desconhecida do arquivo /admin/edit_student_query.php. A manipulação do argumento student_id resulta em injeção de SQL. O ataque pode ser executado remotamente. O exploit agora é público e pode ser utilizado.

CVE-2026-1594 Crítica · 9.8 CWE-74 29/01/2026

Injeção de SQL no add_expenses.php do Society Management System 1.0 da itsourcecode

Foi detectada uma vulnerabilidade de segurança no itsourcecode Society Management System 1.0. Afeta uma funcionalidade não especificada do arquivo /admin/add_expenses.php. A manipulação do argumento detail leva a injeção de SQL. A exploração remota do ataque é possível. O exploit foi divulgado publicamente e pode ser utilizado.

CVE-2026-1593 Crítica · 9.8 CWE-74 29/01/2026

Injeção de SQL no Society Management System em edit_expenses_query.php (CVE-2026-1593)

Foi identificada uma fraqueza no itsourcecode Society Management System 1.0. A vulnerabilidade afeta uma funcionalidade desconhecida do arquivo /admin/edit_expenses_query.php. A manipulação do argumento detail pode levar a injeção de SQL. O ataque pode ser iniciado remotamente. O exploit foi disponibilizado ao público e pode ser usado em ataques.

CVE-2026-1590 Crítica · 9.8 CWE-74 29/01/2026

Injeção de SQL no School Management System da itsourcecode (CVE-2026-1590)

Foi identificada uma vulnerabilidade no itsourcecode School Management System 1.0. Isso afeta uma função não identificada do arquivo /ramonsys/faculty/index.php. A manipulação do argumento ID leva a injeção de SQL. O ataque pode ser realizado remotamente. O exploit está disponível publicamente e pode ser utilizado.

CVE-2026-1589 Crítica · 9.8 CWE-74 29/01/2026

Injeção de SQL no itsourcecode School Management System 1.0 via txtsearch em /ramonsys/inquiry/index.php

Foi identificada uma vulnerabilidade no itsourcecode School Management System 1.0. Ela afeta uma função desconhecida do arquivo /ramonsys/inquiry/index.php. A manipulação do argumento txtsearch causa injeção de SQL. O ataque pode ser iniciado remotamente. O exploit foi divulgado publicamente e pode ser utilizado.

CVE-2026-1551 Alta · 8.8 CWE-74 28/01/2026

itsourcecode School Management System controller.php sql injection

A weakness has been identified in itsourcecode School Management System 1.0. This affects an unknown part of the file /ramonsys/course/controller.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks.