Analysis

CVE-2026-2196 is a SQL injection weakness (CWE-89) in code-projects Online Reviewer System 1.0, located in exam-update.php and triggered through the test_id argument. NVD rates it 9.8 (critical) under CVSS 3.1, and the record states that an exploit has been made public. The sources consulted show no fixed version and no KEV listing.

CVE-2026-22903 describes a stack-based buffer overflow in a modified build of the lighttpd web server, triggered by an overly long SESSIONID cookie in an HTTP request sent without authentication. The CNA rates it critical with a CVSS 3.1 base score of 9.8, and the record shows no CISA KEV listing. The record does not list affected versions or fixes.

A SQL injection flaw (CWE-89) has been reported in Student Web Portal 1.0, where manipulation of the Username argument in /check_user.php can alter database queries. The record states the attack can be started remotely, and NVD rates it 9.8 (CVSS 3.1, critical). The CVE is not listed in CISA KEV, and the record identifies no fixed version.

CVE-2026-2190 is an SQL injection flaw in itsourcecode School Management System 1.0, triggered by manipulating the ID argument in a controller file. NVD scores it 9.8 under CVSS 3.1, and the record states that an exploit has been made public. The CVE is not listed in CISA KEV, and the record contains no fixed version.

A SQL injection flaw (CWE-89) in code-projects Online Reviewer System 1.0 was reported in the exam-delete.php script, where the test_id argument is affected. NVD rates it 9.8 Critical under CVSS 3.1, and the record states that a public exploit has been disclosed. No fixed version or vendor patch is listed in the sources consulted.

A SQL injection flaw (CWE-89) has been reported in code-projects Online Reviewer System 1.0, in the user-delete.php file, where the ID argument is not handled safely. NVD scores it 9.8 (CVSS 3.1, critical), and the record states that the exploit has been publicly released. The CVE is not listed in the CISA KEV catalog, so no confirmed active exploitation appears in the sources consulted.

A SQL injection flaw (CWE-89) has been reported in the Administrator Login component at /admin/index.php of News Portal Project 1.0, where the email argument can be manipulated remotely. NVD rates it critical with a CVSS 3.1 base score of 9.8, and the record states that a public exploit has been published. The record does not list a fixed version, and it is not listed in the CISA KEV catalog.

CVE-2026-25592 is an arbitrary file write, classified as CWE-22 path traversal, in the SessionsPythonPlugin of Microsoft's Semantic Kernel .NET SDK, affecting versions prior to 1.71.0. The description states the issue is fixed in Microsoft.SemanticKernel.Core 1.71.0, and the record lists a CVSS 3.1 base score of 9.9 from the GitHub CNA. No confirmed exploitation appears in the sources consulted, and the vendor describes an allow-list Function Invocation Filter as an interim mitigation.

VulDB has published CVE-2026-2184, an OS command injection weakness (CWE-78) in the Great Developers Certificate Generation System, reachable through the photo argument of /restructured/csv.php. The record states the attack can be carried out remotely, and NVD scores it as critical with CVSS 3.1 9.8. No fixed version is listed, the product follows a rolling release model, and the upstream repository has been inactive for many years.

CVE-2021-4477 describes a firewall bypass in Hirschmann HiLCOS OpenBAT and BAT450 products when IPv6 IPsec VPN connections are used, allowing VPN traffic to avoid configured firewall rules. The record is rated critical with a CVSS v3.1 score of 9.1 from VulnCheck, and it is not listed in CISA KEV. The record does not identify affected or fixed versions.

The ProSolution WP Client plugin for WordPress is affected by an unrestricted file upload weakness in all versions up to and including 1.9.9. According to the record, unauthenticated attackers may upload arbitrary files, which may make remote code execution possible. The record rates the issue 9.8 (Critical) under CVSS 3.1, and no confirmed exploitation appears in the sources consulted.

CVE-2026-2217 is a SQL injection flaw (CWE-89) reported in itsourcecode Event Management System 1.0, involving the ID argument handled by /admin/manage_user.php. The record rates it critical with CVSS 3.1 score 9.8 from NVD and states that a public exploit exists. No fixed version and no confirmed active exploitation appear in the sources consulted.

CVE-2026-5850 is a critical OS command injection flaw in the setVpnPassCfg function of the CGI Handler in Totolink A7100RU firmware 7.4cu.2313_b20191024, which the record says is remotely exploitable. The CNA-supplied CVSS 3.1 base score is 9.8, and the record states that a public exploit is available. No fixed version is listed in the sources consulted, and no confirmed active exploitation appears in them.

CVE-2026-2133 is an unrestricted file upload weakness in code-projects Online Music Site 1.0, reachable through the txtimage argument of /Administrator/PHP/AdminUpdateCategory.php. NVD rates it 9.8 (Critical) under CVSS 3.1, and the record states the attack can be carried out remotely. The record notes that a public exploit reference exists, but CISA KEV does not list this CVE and no confirmed exploitation appears in the sources consulted.

CVE-2026-39617 is a Cross-Site Request Forgery (CSRF) weakness in the Bluestreet theme by priyanshumittal, classified as CWE-352. The record lists the affected range as up to and including 1.7.3 and gives a CVSS 3.1 base score of 9.6 (critical). No confirmed exploitation in the wild appears in the sources consulted, and the record marks the CVE as not listed in CISA KEV.