CWE-74
CVEs classified under CWE-74, newest first.
1318 CVEsRSS
CVE-2025-8154Medium· 5.3In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. By exploiting this vulnerability, a…
In Webhook API invocations, the component accepts user-supplied input for HTTP request headers without sufficient validation or sanitization, allowing these headers to be injected into HTTP responses. By exploiting this vulnerability, a…
CVE-2026-8231Medium· 6.3A vulnerability has been found in CodeAstro Online Catering Ordering System 1.0
A vulnerability has been found in CodeAstro Online Catering Ordering System 1.0. This affects an unknown function of the file /deleteorder.php. The manipulation of the argument ID leads to sql injection. The attack is possible to be carr…
CVE-2025-67486High· 7.2Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package
Dolibarr is an enterprise resource planning (ERP) and customer relationship management (CRM) software package. Versions 22.0.2 and earlier contains an authenticated remote code execution vulnerability in the user extrafields functionalit…
CVE-2026-7678Medium· 6.3PoCYunaiV yudao-cloud GoViewDataServiceImpl.java getDataBySQL sql injection
A vulnerability was identified in YunaiV yudao-cloud up to 2026.01. This affects the function getDataBySQL of the file yudao-module-report-biz/src/main/java/io/github/ruoyi/report/service/impl/GoViewDataServiceImpl.java. Such manipulatio…
GHSA-hhxr-7j22-694rLow· 6.3Duplicate Advisory: Prompt injection in Langflow Smart Transform can lead to code execution
Duplicate Advisory: Prompt injection in Langflow Smart Transform can lead to code execution
CVE-2026-7700Medium· 6.3⚖ disputedA weakness has been identified in langflow-ai langflow up to 1.10.2
A weakness has been identified in langflow-ai langflow up to 1.10.2. This affects the function eval of the file src/lfx/src/lfx/components/llm_operations/lambda_filter.py of the component LambdaFilterComponent. Executing a manipulation c…
CVE-2026-5833Medium· 5.3A security vulnerability has been detected in awwaiid mcp-server-taskwarrior up to 1.0.1
A security vulnerability has been detected in awwaiid mcp-server-taskwarrior up to 1.0.1. This impacts the function server.setRequestHandler of the file index.ts. Such manipulation of the argument Identifier leads to command injection. T…
CVE-2026-5739High· 7.3A security flaw has been discovered in PowerJob 5.1.0/5.1.1/5.1.2
A security flaw has been discovered in PowerJob 5.1.0/5.1.1/5.1.2. The affected element is the function GroovyEvaluator.evaluate of the file /openApi/addWorkflowNode of the component OpenAPI Endpoint. The manipulation of the argument nod…
CVE-2026-5736High· 7.3A vulnerability was identified in PowerJob 5.1.0/5.1.1/5.1.2
A vulnerability was identified in PowerJob 5.1.0/5.1.1/5.1.2. Impacted is an unknown function of the file powerjob-server/powerjob-server-starter/src/main/java/tech/powerjob/server/web/controller/InstanceController.java of the component …
CVE-2026-5719Medium· 6.3A flaw has been found in itsourcecode Construction Management System 1.0
A flaw has been found in itsourcecode Construction Management System 1.0. This affects an unknown function of the file /borrowedtool.php. Executing a manipulation of the argument code can lead to sql injection. It is possible to launch t…
CVE-2026-5681Medium· 6.3A flaw has been found in itsourcecode sanitize or validate this input 1.0
A flaw has been found in itsourcecode sanitize or validate this input 1.0. This impacts an unknown function of the file /borrowedequip.php of the component Parameter Handler. This manipulation of the argument emp_id causes sql injection.…
CVE-2026-5675Medium· 6.3A vulnerability was found in itsourcecode Construction Management System 1.0
A vulnerability was found in itsourcecode Construction Management System 1.0. This affects an unknown part of the file /borrowed_tool.php of the component Parameter Handler. The manipulation of the argument emp results in sql injection. …
CVE-2026-5672High· 7.3A vulnerability has been found in code-projects Simple IT Discussion Forum 1.0
A vulnerability has been found in code-projects Simple IT Discussion Forum 1.0. Affected by this issue is some unknown functionality of the file /edit-category.php of the component Parameter Handler. The manipulation of the argument cat_…
CVE-2026-5636Medium· 6.3A weakness has been identified in PHPGurukul Online Shopping Portal Project 2.1
A weakness has been identified in PHPGurukul Online Shopping Portal Project 2.1. This affects an unknown part of the file /cancelorder.php of the component Parameter Handler. This manipulation of the argument oid causes sql injection. Th…
CVE-2026-5635Medium· 6.3A security flaw has been discovered in PHPGurukul Online Shopping Portal Project 2.1
A security flaw has been discovered in PHPGurukul Online Shopping Portal Project 2.1. Affected by this issue is some unknown functionality of the file /categorywise-products.php of the component Parameter Handler. The manipulation of the…
CVE-2026-5631High· 7.3A vulnerability has been found in assafelovic gpt-researcher up to 3.4.3
A vulnerability has been found in assafelovic gpt-researcher up to 3.4.3. This affects the function extract_command_data of the file backend/server/server_utils.py of the component ws Endpoint. Such manipulation of the argument args lead…
CVE-2026-5620Medium· 6.3A vulnerability has been found in itsourcecode Construction Management System 1.0
A vulnerability has been found in itsourcecode Construction Management System 1.0. Affected is an unknown function of the file /borrowed_equip_report.php of the component Parameter Handler. The manipulation of the argument Home leads to …
CVE-2026-5565High· 7.3A security vulnerability has been detected in code-projects Simple Laundry System 1.0
A security vulnerability has been detected in code-projects Simple Laundry System 1.0. Affected by this issue is some unknown functionality of the file /delmemberinfo.php of the component Parameter Handler. Such manipulation of the argum…
CVE-2026-5198High· 7.3A vulnerability was determined in code-projects Student Membership System 1.0
A vulnerability was determined in code-projects Student Membership System 1.0. The impacted element is an unknown function of the file /admin/index.php of the component Admin Login. This manipulation of the argument username/password cau…
CVE-2026-5147High· 7.3PoCYunaiV yudao-cloud get-by-website sql injection
A security flaw has been discovered in YunaiV yudao-cloud up to 2026.01. This affects an unknown part of the file /admin-api/system/tenant/get-by-website. The manipulation of the argument Website results in sql injection. It is possible …
CVE-2025-13462Low· 3.3The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK
The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinter…
CVE-2026-27727Critical· 9.8PoCmchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked…
mchange-commons-java, a library that provides Java utilities, includes code that mirrors early implementations of JNDI functionality, including support for remote `factoryClassLocation` values, by which code can be downloaded and invoked…
CVE-2025-15450Medium· 6.3A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8
A vulnerability was identified in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected by this vulnerability is the function findOrderHosNum of the file /ssm_pro/orderHos/. Such manipulation of the argument hospit…
CVE-2025-15443Medium· 4.7A vulnerability was identified in CRMEB up to 5.6.1
A vulnerability was identified in CRMEB up to 5.6.1. This issue affects some unknown processing of the file /adminapi/product/product_export. Such manipulation of the argument cate_id leads to sql injection. The attack may be launched re…
CVE-2025-15442Medium· 4.7A vulnerability was determined in CRMEB up to 5.6.1
A vulnerability was determined in CRMEB up to 5.6.1. This vulnerability affects unknown code of the file /adminapi/export/product_list. This manipulation of the argument cate_id causes sql injection. The attack may be initiated remotely.…
CVE-2025-15439Medium· 6.3A vulnerability was identified in Daptin 0.10.3
A vulnerability was identified in Daptin 0.10.3. Affected by this vulnerability is the function goqu.L of the file server/resource/resource_aggregate.go of the component Aggregate API. The manipulation of the argument column/group/order …
CVE-2025-15425High· 7.3A vulnerability was determined in Yonyou KSOA 9.0
A vulnerability was determined in Yonyou KSOA 9.0. The impacted element is an unknown function of the file /worksheet/del_user.jsp of the component HTTP GET Parameter Handler. Executing a manipulation of the argument ID can lead to sql i…
CVE-2025-15424High· 7.3A vulnerability was found in Yonyou KSOA 9.0
A vulnerability was found in Yonyou KSOA 9.0. The affected element is an unknown function of the file /worksheet/agent_worksdel.jsp of the component HTTP GET Parameter Handler. Performing a manipulation of the argument ID results in sql …
CVE-2025-15421High· 7.3A vulnerability was detected in Yonyou KSOA 9.0
A vulnerability was detected in Yonyou KSOA 9.0. This vulnerability affects unknown code of the file /worksheet/agent_worksadd.jsp of the component HTTP GET Parameter Handler. The manipulation of the argument ID results in sql injection.…
CVE-2025-15436High· 7.3A vulnerability has been found in Yonyou KSOA 9.0
A vulnerability has been found in Yonyou KSOA 9.0. Affected by this issue is some unknown functionality of the file /worksheet/work_edit.jsp. Such manipulation of the argument Report leads to sql injection. The attack can be launched rem…