Analysis

CVE-2025-69565 describes a file upload weakness (CWE-434) in the /ExAddProduct.php component of code-projects Mobile Shop Management System 1.0. The record reports a CVSS 3.1 base score of 9.8 and a critical severity rating. No fixed version is listed in the sources consulted, and the vulnerability is not in CISA KEV.

CVE-2025-11423 is a memory corruption flaw in the formSafeEmailFilter function of Tenda CH22 firmware 1.0.0.1, triggered by manipulating the page argument and reachable remotely. The record reports a CVSS 3.1 base score of 9.8 from the CNA VulDB and states that a public exploit exists. No fixed version is listed in the sources consulted, and the CVE is not in CISA KEV.

CVE-2026-24872 is a critical vulnerability in ProjectSkyfire SkyFire involving improper pointer arithmetic, as described by the CNA. The record lists a CVSS 3.1 base score of 9.8 with network attack vector, low complexity, and no privileges or user interaction required. The sources consulted provide no structured affected or fixed version data, only the description's reference to versions before 5.4.8-stable5.

CVE-2025-11418 is a stack-based buffer overflow in the formWrlsafeset function of the HTTP Request Handler in Tenda CH22 firmware up to version 1.0.0.1. The CNA VulDB rates it critical with a CVSS 3.1 base score of 9.8 and describes remote attack as possible. The sources consulted report a publicly disclosed exploit but no confirmed exploitation in the wild and no vendor fix.

Versions of Jahlives openssl_encrypt before 1.4.0 build key bundles from untrusted data in PublicKeyBundle.from_dict() without verifying signatures, classified as CWE-347. The record links this to possible exposure of secrets, and the CVSS 3.1 base score is 9.8 (Critical). No confirmed exploitation appears in the sources consulted.

CVE-2026-56351 affects n8n before version 2.4.0 and involves SQL injection in the MySQL, PostgreSQL and Microsoft SQL nodes, caused by unescaped identifier values in node configuration parameters. Authenticated users with workflow creation permissions may be able to influence table or column names to run unauthorized database commands. The record reports a CVSS 3.1 base score of 9.6 from NVD, and CISA KEV does not list this CVE.

xrdp versions before 0.10.5 contain an unauthenticated stack-based buffer overflow in the RDP connection sequence, which the record attributes to improper bounds checking of user domain data. NVD scores the issue 9.8 under CVSS 3.1, and the record states that upgrading to 0.10.5 provides the patch. No confirmed exploitation appears in the sources consulted, and the issue is not listed in CISA KEV.

OAuth2 Proxy versions 7.15.2 through 7.15.4 can be induced to skip authentication for protected paths when the default trusted proxy set applies. According to the record, the flaw comes from trusting a client-supplied X-Forwarded-Uri header, so the allow-list check runs against a spoofed path. The record lists no fixed version and no exploitation confirmed by CISA KEV.

CVE-2025-41108 affects Ghost Robotics Vision 60 version 0.27.2 and is classified as CWE-287, Improper Authentication. NVD scores it 9.8 under CVSS 3.1 (critical), and the record describes a communication protocol without encryption or authentication that could let an attacker send commands to the robot. No confirmed exploitation appears in the sources consulted, and the record lists no fixed version.

CVE-2025-69564 is a critical SQL injection issue reported in code-projects Mobile Shop Management System 1.0, affecting the /ExAddNewUser.php endpoint. The NVD record carries a CVSS 3.1 score of 9.8 with network attack vector and no privileges or user interaction required. The record lists no fixed version, is not in CISA KEV, and no confirmed exploitation appears in the sources consulted.

A SQL injection flaw in the login.php file of code-projects Web-Based Inventory and POS System 1.0 can be triggered remotely through the emailid argument. NVD scores it 9.8 (CVSS 3.1, critical), while VulDB provides lower CVSS 4.0 scores. No fixed version appears in the consulted records, and the CVE is not listed in CISA KEV.

CVE-2026-50574 affects yt-dlp versions before 2026.06.09 when aria2c is configured as the external downloader for fragmented manifest formats such as HLS or DASH streams. Insufficiently sanitized input passed to aria2c can allow an attacker to write arbitrary files, which the advisory states can lead to code execution. The issue is fixed in 2026.06.09.

GeoVision GV-I/O Box 4E 2.09 contains OS command injection flaws in the libNetSetObj.so library, where values received over the network are passed without sanitization into system calls. The record describes a gateway-address handler reachable through the DVRSearch service and the Network.cgi endpoint, and the CNA rates it critical with a CVSS 3.1 base score of 9.1. No confirmed exploitation appears in the sources consulted, and the record lists no fixed version.

CVE-2026-12846 affects the GV-I/O Box 4E, where the DVRSearch service listening on UDP port 10001 can overflow a stack buffer through the Net Mask field. The CNA scores it 10.0 under CVSS 3.1 with a network attack vector and no privileges required. The record lists no affected or fixed versions and no confirmed exploitation in the sources consulted.

CVE-2026-12848 is a critical stack-based buffer overflow (CWE-121) in the DVRSearch UDP service of the GV-I/O Box, an embedded device with inputs and relay outputs. The CNA assigns a CVSS 3.1 base score of 10.0, and the record indicates that network users can reach the vulnerable service. The record lists no affected or fixed versions and no KEV listing, so exposure assessment and vendor contact are the immediate priorities.