Analysis

CVE-2025-49915 is an SQL injection flaw (CWE-89) in the SMS Alert Order Notifications WordPress plugin (sms-alert), recorded as affecting versions from n/a through 3.8.5. The CNA-provided CVSS 3.1 score is 9.3 (critical), with a network attack vector and no privileges or user interaction required. The record shows no CISA KEV listing and no fixed version, so administrators should verify their installed version and check the vendor advisory.

CVE-2026-1595 is an SQL injection flaw in the student_id argument of /admin/edit_student_query.php in itsourcecode Society Management System 1.0, which the record says can be exploited remotely. NVD lists a CVSS 3.1 base score of 9.8 (Critical), while the CNA VulDB scores range from 5.5 to 7.5 depending on CVSS version. The record states a public exploit exists, but CISA KEV does not list this CVE and no fixed version is identified.

CVE-2024-5986 affects h2oai/h2o-3 version 3.46.0.1 and, according to the record, allows remote attackers to write arbitrary data to files on the server. The record links this to CWE-73 and assigns a CVSS 3.0 base score of 9.1 (Critical) from the CNA security@huntr.dev. No confirmed exploitation appears in the sources consulted, and no fixed version is listed in the record.

CVE-2020-37010 describes a classic buffer overflow (CWE-120) in the Advanced Search keywords input of BearShare Lite 5.2.5, which the record says can lead to arbitrary code execution. The CNA assigned a CVSS 3.1 base score of 9.8 (critical), but the record lists no affected version range or fixed version. CISA KEV does not list this CVE, and the sources consulted show no confirmed exploitation.

Maker.js, a Microsoft library for 2D vector drawing and shape modeling aimed at CNC and laser cutters, has a prototype pollution weakness (CWE-1321) in its extendObject function in versions up to and including 0.19.1. The function copies properties without hasOwnProperty checks and without filtering dangerous keys. A patch exists in a commit that is expected to ship in version 0.19.2.

Orval, a tool that generates TypeScript clients from API specifications, has an incomplete fix for CVE-2026-23947. A limited set of non-alphanumeric characters is still not escaped, which the record says can allow code injection. Fixed versions are 7.21.0 and 8.2.0 according to the CNA description.

CVE-2020-37050 describes a buffer overflow in Quick Player 1.3 that can be triggered by loading a crafted .m3l file, according to the record description. The CNA VulnCheck assigns a CVSS 3.1 base score of 9.8 (critical) and the record maps the flaw to CWE-120. The record shows no CISA KEV listing and contains no affected or fixed version data.

Online-Exam-System 2015 contains an SQL injection flaw (CWE-89) in its feedback module, reachable through the 'fid' parameter. The record states that an attacker could potentially extract, modify or delete database information. NVD rates it critical (9.8, CVSS 3.1), no fixed version is listed, and the CVE is not in the CISA KEV catalog.

CVE-2025-51958 is a critical OS command injection weakness (CWE-78) in the Aelsantex Runcommand plugin, version 2014-04-01, for DokuWiki. According to the record, unauthenticated attackers can execute arbitrary system commands, and the CNA scored it 9.8 under CVSS 3.1. No fixed version and no confirmed exploitation appear in the sources consulted, so defenders should first identify exposed installations.

CVE-2025-52626 is a potential OS command injection weakness (CWE-78) in HCL AION version 2.0. The record states it can allow unintended command execution and unauthorized actions on the underlying system. NVD scores it 9.8 (Critical) under CVSS 3.1, while the CNA lists 4.5.

A use-after-free (CWE-416) in the rtl8150 USB Ethernet driver of the Linux kernel can occur when the transmit routine reads skb->len after the USB request has already been submitted. The CNA scores it 9.8 (CVSS 3.1), and the record lists several stable kernel ranges as affected. The sources consulted show no confirmed exploitation and the vulnerability is not listed in CISA KEV.

CVE-2020-37000 is a stack-based buffer overflow in Free MP3 CD Ripper 2.8 that, according to the record, can be triggered by a crafted WAV file to execute arbitrary code. The CNA VulnCheck scores it CVSS 3.1 9.8 (Critical), and the record references a public exploit entry. The record does not list KEV status, EPSS data or fixed versions, so remediation status is unconfirmed.

CVE-2026-24729 affects the file upload function of Interinfo DreamMaker in versions before 2025/10/22, as described by the CNA ART@zuso.ai. The weakness is classified as CWE-434, and the CNA assigns a CVSS 4.0 base score of 10, which is critical. The record lists no affected or fixed version ranges, and no confirmed exploitation appears in the sources consulted.

The Eclipse OMR port library contains a classic buffer overflow (CWE-120) in an API that returns the names of supported processor features when the caller's output buffer is undersized. NVD rates it CVSS 3.1 9.8 (critical), and the CNA rates it 6.9 under CVSS 4.0. The issue is fixed in Eclipse OMR 0.8.0, and the record does not show it in CISA KEV.

CVE-2025-57795 affects Explorance Blue versions prior to 8.14.13 and is described as an authenticated remote file download flaw in a web service component. The CVSS 3.1 base score of 9.9 (critical) comes from the CNA, and the description states that default configurations can be leveraged to achieve remote code execution. No confirmed exploitation appears in the sources consulted, and the record shows no CISA KEV listing.