Analysis

CVE-2022-50981 is a critical missing-authentication weakness (CWE-306) in devices shipped without a password by default, and the record states that setting one is not enforced. According to the record, an unauthenticated remote attacker could gain full access to affected devices. CISA KEV does not list this CVE and no confirmed exploitation appears in the sources consulted, while the record does not state affected or fixed versions.

CVE-2025-7013 describes an authorization bypass in the Menu Panel of QR Menu Pro Smart Menu Systems, classified as CWE-639 (authorization bypass through a user-controlled key). The record indicates that trusted identifiers can be abused. NVD scores it 9.8 (critical) under CVSS 3.1, while the USOM CNA entry lists 5.7.

CVE-2019-25232 is a buffer overflow in the DNS/IP field of the Clients Control Panel in NetPCLinker 1.0.0.0, as described in the record. NVD and the CNA list a CVSS 3.1 base score of 9.8 (critical), and the record does not include fixed versions. No confirmed exploitation appears in the sources consulted, and the CVE is not listed in CISA KEV.

Rapid7 InsightVM versions before 8.34.0 reportedly fail to verify signatures on assertions received at the Assertion Consumer Service (ACS) cloud endpoint, which the record says could allow account takeover of accounts set up through Security Console installations. The CNA rates the issue critical with a CVSS 3.1 base score of 9.6. The description states the issue is fixed in version 8.34.0, and no confirmed exploitation appears in the sources consulted.

CVE-2020-37056 affects the Crystal shard http-protection 0.2.0, where manipulated request headers can cause the protection middleware to accept a spoofed client IP. VulnCheck reports a CVSS 3.1 base score of 9.8 (critical) and classifies the flaw as CWE-290. The record shows no KEV listing and no confirmed fixed version, so administrators should review their use of forwarded-IP headers now.

CVE-2026-23997 is a stored cross-site scripting flaw in FacturaScripts 2025.71 and earlier, triggered through the Observations field and rendered without HTML entity encoding in the History view. NVD scores it 9 (CVSS 3.1, critical) and GitHub scores it 8. No confirmed exploitation appears in the sources consulted, and the record lists no fixed version.

Explorance Blue versions prior to 8.14.9 contain an SQL injection weakness (CWE-89) caused by insufficient validation of user input in a web application endpoint. The record states the flaw can be exploited without authentication and is rated critical with a CVSS 3.1 base score of 10.0. No confirmed exploitation appears in the sources consulted, and the record does not show the vulnerability in the CISA KEV catalog.

A SQL injection flaw (CWE-89) in code-projects Online Music Site 1.0 affects an unknown function in /Administrator/PHP/AdminAddCategory.php and can be triggered remotely. NVD rates it 9.8 (critical) under CVSS 3.1, and the record states that a public exploit has been released. No fixed version is listed, and the record is not listed in CISA KEV.

The Global Interactive Design Media Globalmedya Content Management System is affected by an SQL injection flaw (CWE-89) that the record says allows command line execution. NVD scores it 9.8 (critical) and the CNA USOM scores it 7.5, while the record lists versions up to 2025-07-21. The record does not show a KEV listing, and no confirmed exploitation appears in the sources consulted.

A critical SQL injection flaw (CWE-89) affects the tablon component of the Buroweb platform, version 2505.0.12, according to the CNA record. Several parameters do not correctly sanitize user input, which could allow an attacker to run database queries and reach confidential data. The record gives a CVSS 4.0 base score of 9.3 and lists no confirmed exploitation in the sources consulted.

BacklinkSpeed 2.4 is affected by a buffer overflow that can corrupt the Structured Exception Handler chain when a crafted file is imported. The record describes possible arbitrary code execution and control of the application. The record lists a CVSS 3.1 base score of 9.8 and no CISA KEV listing, and no confirmed exploitation appears in the sources consulted.

The CAI (Cybersecurity AI) framework, in versions up to and including 0.5.10, passes user-controlled input to shell commands through its function tools, which the record describes as OS command injection. According to the record, the find_file tool runs without user approval, which could let an attacker execute arbitrary commands on the host and bypass human-in-the-loop controls. A fix commit is referenced, but the record does not state a fixed release number.

MediaTek's February 2026 bulletin covers CVE-2026-20418, an out-of-bounds write (CWE-787) caused by a missing bounds check in the Thread component. The CNA scores it 9.8 (Critical) under CVSS 3.1 and says it could allow remote privilege escalation without user interaction. The record lists no fixed version and the CISA KEV catalog does not list it.

SandboxJS versions before 0.8.27 do not properly restrict __lookupGetter__, which the record says can be used to obtain prototypes, enabling a sandbox escape and possible remote code execution. The GitHub advisory provider rates it critical with a CVSS 3.1 base score of 10. The record identifies 0.8.27 as the fixed version and reports no confirmed active exploitation.

Interinfo DreamMaker versions before 2025/10/22 expose administrative functionality through the /servlet/baServer3 endpoint without requiring authentication, as tracked in CVE-2026-24728 (CWE-306). The CNA ART@zuso.ai assigned a CVSS 4.0 base score of 9.3. The record lists no affected product entries or fixed versions, so organizations should verify their exposure against the vendor advisory.