Analysis

A SQL injection vulnerability (CWE-89) has been reported in code-projects Online Reviewer System 1.0, where the ID argument of a student assessment page can influence database queries. The record states that the attack can be launched remotely and that the exploit has been publicly disclosed. NVD lists a CVSS 3.1 base score of 9.8, and the record does not show confirmed exploitation in the wild.

CVE-2026-25804 affects Antrea, a Kubernetes networking solution, where a uint16 arithmetic overflow in network policy priority assignment can produce incorrect OpenFlow priorities when many policies with varied priority values are handled. The record states this may lead to incorrect traffic enforcement. NVD lists a CVSS 3.1 score of 9.1, the GitHub CNA lists a CVSS 4.0 score of 8, and the record says the issue is patched in version 2.4.3.

SandboxJS, a JavaScript sandboxing library, has a critical vulnerability in versions before 0.8.29 that allows the sandbox to be escaped. According to the record, Map is included in the SAFE_PROTOYPES list, so its prototype can be reached and overwriting Map.prototype.has breaks the isolation. The issue is fixed in 0.8.29, and no confirmed exploitation appears in the sources consulted.

A SQL injection vulnerability (CWE-89) has been reported in code-projects Online Reviewer System 1.0, where the ID argument of an admin assessment page can be manipulated remotely. NVD rates it 9.8 (critical) under CVSS 3.1, while the CNA VulDB scores differ. The record notes public disclosure of an exploit, but no confirmed exploitation in the wild appears in the sources consulted and no fixed version is listed.

CVE-2025-13563 affects the Lizza LMS Pro plugin for WordPress in all versions up to and including 1.0.3. Its registration function does not restrict which user roles can be selected, which may allow an unauthenticated attacker to register with administrator rights. The CNA, Wordfence, scored the issue critical with a CVSS 3.1 base score of 9.8, and no confirmed exploitation appears in the sources consulted.

A vulnerability classified as unrestricted upload of a file with dangerous type (CWE-434) was reported in the Great Developers Certificate Generation System, in an unspecified part of /restructured/csv.php. The NVD record assigns a CVSS 3.1 base score of 9.8 (critical) and describes remote exploitation as possible. No confirmed exploitation appears in the sources consulted, and no fixed version is listed.

CVE-2026-2189 is a SQL injection flaw in itsourcecode School Management System 1.0, reported in an unidentified function of /ramonsys/report/index.php. The NVD base score is 9.8 (critical) under CVSS 3.1, and the record states the attack can be started remotely and that a public exploit is available. No vendor fix is listed in the sources consulted, and the vulnerability is not listed in CISA KEV.

A SQL injection flaw has been reported in the activity_id argument of /admin/edit_activity.php in itsourcecode Society Management System 1.0. NVD scores it CVSS 3.1 9.8 (Critical), and the record notes that an exploit has been made public. The CVE is not listed in CISA KEV, and no confirmed active exploitation appears in the sources consulted.

CVE-2026-22904 is a critical stack-based buffer overflow (CWE-121) caused by improper length handling when several cookie fields, including TRACKID, are parsed. According to the CNA record, an unauthenticated remote attacker can cause denial of service and possibly remote code execution. The affected products and versions are not identified in the sources consulted.

CVE-2017-20234 affects Belden GarrettCom Magnum 6K and 10K managed switches. A hardcoded string in the authentication mechanism allows unauthenticated attackers to bypass login controls and reach administrative functions and sensitive configuration. The record lists a CVSS 3.1 score of 9.8 (Critical), no KEV listing, and no fixed version.

CVE-2026-2165 is a missing authentication weakness (CWE-306) in an account creation endpoint of Detronetdip E-commerce 1.0.0, reachable remotely according to the record. NVD rates it 9.8 (critical) under CVSS 3.1, and the record states that a public exploit exists. The record also says the project was notified through an issue report and has not responded, so no fixed version is documented.

CVE-2020-37162 describes a buffer overflow in the registration key input of Wedding Slideshow Studio 1.36 and earlier, which the record says can lead to arbitrary code execution. The CVSS 3.1 base score is 9.8 (critical), reported by VulnCheck. The record lists no fix, and CISA KEV does not list this CVE.

A SQL injection vulnerability (CWE-89) has been reported in the code-projects Online Music Site 1.0, in the file /Administrator/PHP/AdminEditCategory.php, where the ID argument is not handled safely. NVD assigns a CVSS 3.1 base score of 9.8 (critical), and the record states that a public exploit is available. No confirmed exploitation in the wild appears in the sources consulted, and the CVE is not listed in CISA KEV.

CVE-2026-25641 is a critical sandbox escape in SandboxJS, a JavaScript sandboxing library, affecting versions before 0.8.29. The record describes a mismatch between the property key that is validated and the key used for the actual property access, caused by objects that coerce to different string values. The fix is available in 0.8.29, and no confirmed exploitation appears in the sources consulted.

CVE-2026-1615 affects versions of the jsonpath package before 1.3.0, which evaluate user-supplied JSON Path expressions through the static-eval module. A crafted expression can lead to arbitrary JavaScript execution, with the record describing impact as Remote Code Execution in Node.js and XSS in browsers. The record rates it critical with CVSS 3.1 score 9.8 and lists no confirmed exploitation.