Analysis

A SQL injection flaw has been reported in PHPGurukul Beauty Parlour Management System 1.1, in the administrative file /admin/accepted-appointment.php, through the delid argument. NVD assigns a CVSS 3.1 base score of 9.8 (Critical), and the record states that the exploit has been publicly disclosed. The sources consulted do not list a fixed version or confirmed exploitation in the wild.

A SQL injection flaw (CWE-89) in login.php of code-projects Online Examination System 1.0 can be triggered remotely through the username and password arguments. NVD rates it 9.8 (critical) under CVSS 3.1, while the CNA VulDB scores differ. The record shows no fixed version and no KEV listing.

CVE-2026-2198 is a SQL injection weakness (CWE-89) in code-projects Online Reviewer System 1.0, reachable through the difficulty_id argument of a PHP file in the admin assessments area. NVD rates it 9.8 (critical) under CVSS 3.1 with no privileges or user interaction required. The record says a public exploit exists, but the CVE is not listed in CISA KEV and no fixed version is listed.

CVE-2026-2234 affects C&Cm@il, a product developed by HGiga, and is described as a missing authentication flaw that lets unauthenticated remote attackers read and modify any user's mail content. The CNA assessed it as critical with a CVSS 3.1 base score of 9.1. No affected or fixed versions are listed in the record, and no confirmed exploitation appears in the sources consulted.

CVE-2026-2090 is an SQL injection flaw in SourceCodester Online Class Record System 1.0, affecting the /admin/message/search.php file through the term argument. NVD scores it 9.8 (Critical) under CVSS 3.1, and the description says it can be exploited remotely. The record lists no fixed version, and the CVE is not listed in CISA KEV.

A SQL injection flaw (CWE-89) has been reported in the WAF Firewall component of Xiaopi Panel, reachable through the ID argument of /demo.php and exploitable remotely. The NVD assessment gives a CVSS 3.1 base score of 9.8, while VulDB as CNA published lower scores. The exploit has been made public, the vendor did not respond, and the record lists no fixed version.

SandboxJS, a JavaScript sandboxing library, is affected by a sandbox escape in versions before 0.8.29. The flaw lets an attacker bypass prototype whitelist enforcement and pollute the host Object.prototype, with possible persistent effects across sandboxes. GitHub rates it Critical (CVSS 3.1 base score 10), and upgrading to 0.8.29 is the documented fix.

A SQL injection flaw (CWE-89) has been reported in Simple Blood Donor Management System 1.0 from code-projects, in the ID argument handled by editcampaignform.php. NVD scores it 9.8 (critical) under CVSS 3.1, while the CNA VulDB lists 7.3 under CVSS 3.1. The record states a public exploit exists, but no confirmed exploitation in the wild appears in the sources consulted.

CVE-2026-23696 is a critical SQL injection flaw (CWE-89) in the folder ownership management of Windmill Community and Enterprise Editions, affecting versions 1.276.0 through 1.603.2 according to the record. An authenticated attacker could use the owner parameter to read sensitive data, forge an administrative token and reach workflow execution endpoints. No confirmed exploitation appears in the sources consulted, and the record is still awaiting NVD analysis.

CVE-2026-39619 is a Cross-Site Request Forgery weakness in the Busiprof WordPress theme by priyanshumittal, affecting versions up to and including 2.5.2. According to the record, the flaw can be leveraged to upload a web shell to the web server, and Patchstack rates it critical with a CVSS 3.1 score of 9.6. The record lists no fixed version and no confirmed exploitation in CISA KEV.

CVE-2025-66603 affects the web server of Yokogawa FAST/TOOLS, which accepts the HTTP OPTIONS method. According to the record, an attacker could potentially use this information to support other attacks. NVD rates it 9.8 (critical) under CVSS 3.1, and no fixed version is listed in the record.

CVE-2026-2221 is a SQL injection flaw in the Login component of code-projects Online Reviewer System 1.0, reached through the Username argument of /login/index.php. NVD rates it 9.8 under CVSS 3.1, and the CNA states that a public exploit has been released. The record does not list a fix, and the CVE is not in CISA KEV.

Frigate versions before 0.16.4 contain a critical OS command injection flaw in the go2rtc integration, reachable through the exec directive in the video stream configuration. The record gives a CVSS 3.1 base score of 9.1 and states that exploitation requires an administrator or an internet-exposed installation without authentication. The record states 0.16.4 as the fixed version, and no confirmed exploitation appears in the sources consulted.

CVE-2026-25803 affects 3DP-MANAGER versions 2.0.1 and earlier, which create an administrator account with the default credentials admin/admin on first initialization. The advisory describes full administrative control over VPN tunnels and system settings for attackers who can reach the login interface, and the record rates it Critical (CVSS 3.1 9.8). The record states the issue will be fixed in version 2.0.2, and no confirmed exploitation appears in the sources consulted.

Payload CMS versions before 3.73.0 are vulnerable to SQL injection when querying JSON or richText fields, which allows blind SQL injection without authentication. The CVSS 3.1 base score is 9.8, and the description reports possible exposure of emails, password reset tokens and full account takeover. Upgrading to 3.73.0 or later is the documented fix.