CWE-74
CVEs classified under CWE-74, newest first.
1313 CVEsRSS
CVE-2026-114257High· 7.3PoCoretnom23 file-management-system-php File Download download.php readfile sql injection
A security vulnerability has been detected in oretnom23 file-management-system-php up to 2e3c1ebe60f121e8df4fb3f544f0e9591d9a01e4. Affected by this vulnerability is the function readfile of the file download.php of the component File Dow…
CVE-2026-114250Medium· 6.3PoCitsourcecode Sales-and-Inventory-System cust_edit.php sql injection
A flaw has been found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. This issue affects some unknown processing of the file /pages/cust_edit.php. This manipulation of the argument ID causes sql…
CVE-2026-114251Medium· 6.3PoCitsourcecode Sales-and-Inventory-System cust_del.php sql injection
A vulnerability has been found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. Impacted is an unknown function of the file /pages/cust_del.php. Such manipulation of the argument ID leads to sql …
CVE-2026-114252Medium· 6.3PoCitsourcecode Sales-and-Inventory-System cust_searchfrm.php sql injection
A vulnerability was found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac. The affected element is an unknown function of the file /pages/cust_searchfrm.php. Performing a manipulation of the argu…
CVE-2026-114242High· 7.3PoCdhikshitha29 Insurance-Management-System editPlan.php mysqli_query sql injection
A vulnerability was identified in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected is the function mysqli_query of the file /Admin/View/editPlan.php. Suc…
CVE-2026-114243High· 7.3PoCdhikshitha29 Insurance-Management-System EditPolicyHolder.php mysqli_query sql injection
A security flaw has been discovered in dhikshitha29 Insurance-Management-System 91de5edda5baa109ad8e9baf03ce6a3ceda84183/125362cc21dca20d74091a4913a5096bb58dd837. Affected by this vulnerability is the function mysqli_query of the file /A…
CVE-2026-114039Medium· 6.3PoCprojectworlds Advanced Library Management System report_search.php mysqli_query sql injection
A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is the function mysqli_query of the file report_search.php. Executing a manipulation of the argument dateto/datefrom can lead to sql injecti…
CVE-2026-113740Medium· 6.3PoCitsourcecode Online Cake Ordering System deletecustomer.php sql injection
A flaw has been found in itsourcecode Online Cake Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file /deletecustomer.php. This manipulation of the argument ID causes sql injection. The attack is p…
CVE-2026-113213High· 8.8Injection in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page
Injection in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-113397High· 7.4PoCDrayTek Vigor2960 IPsec mainfunction.cgi ruequest_certificate command injection
A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequest_certificate of the file /cgi-bin/mainfunction.cgi of the component IPsec Handler. Such manipulation of the argument…
CVE-2026-113396High· 7.4PoCDrayTek Vigor2960 Rename Table mainfunction.cgi rename_table command injection
A weakness has been identified in DrayTek Vigor2960 1.5.1.6 Revision 8218. The impacted element is the function rename_table of the file /cgi-bin/mainfunction.cgi of the component Rename Table Handler. This manipulation of the argument n…
CVE-2026-113391Critical· 9.9PoCDrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection
A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload Endpoint. Such manipulation leads to command injection. The at…
CVE-2026-113389Critical· 9.9PoCDrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injection
A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function set_table of the file /cgi-bin/mainfunction.cgi of the component CGI Process. The manipulation of the argument sectio…
CVE-2026-113381High· 7.3PoCOsclass Item Model Item.php findUserItems sql injection
A weakness has been identified in Osclass up to 8.3.1. Affected by this vulnerability is the function Item::findUserItems of the file oc-includes/osclass/model/Item.php of the component Item Model Handler. This manipulation of the argume…
CVE-2026-113388Medium· 4.3PoCopensource-socialnetwork Cache Settings dynamic.php input code injection
A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.1. This affects the function input of the file actions/administrator/cache/dynamic.php of the component Cache Settings. Performing a manipulation of the argume…
CVE-2026-112371Critical· 9.9PoCH3C Magic NX15 RPC esps write code injection
A vulnerability was determined in H3C Magic NX15 NX15V100R017. Impacted is the function write of the file /api/esps of the component RPC Interface. Executing a manipulation of the argument path can lead to code injection. The attack can …
CVE-2026-112252High· 7.3PoCWuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System ws.asmx xp_cmdshell sql injection
A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. Affected is the function xp_cmdshell of the file /ws.asmx. The manipulation of the argument sql…
CVE-2026-112153High· 7.3PoCvraj404 Criminal-Management-System Officer Registration Form addOfficer.php mysqli_error sql injection
A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This affects the function mysqli_error of the file Officers/addOfficer.php of the component Officer Registration Form. Per…
CVE-2026-112150High· 7.3PoCvraj404 Criminal-Management-System search.php sql injection
A security flaw has been discovered in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected is an unknown function of the file search.php. The manipulation of the argument Search results in sql inje…
CVE-2026-112151High· 7.3PoCvraj404 Criminal Management System Submission Form home.php sql injection
A weakness has been identified in vraj404 Criminal Management System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this vulnerability is an unknown functionality of the file home.php of the component Submission Form. This m…
CVE-2026-112152High· 7.3PoCvraj404 Criminal-Management-System Search searchOff.php mysqli_query sql injection
A security vulnerability has been detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this issue is the function mysqli_query of the file Officers/searchOff.php of the component Sear…
CVE-2026-112141High· 7.3PoCsatya-vinay Events-Management-System Registration-Edit doedit.php mysqli_query sql injection
A vulnerability was determined in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected is the function mysqli_query of the file doedit.php of the component Registration-Edit Handler. This manipula…
CVE-2026-112142High· 7.3PoCsatya-vinay Events-Management-System Registration-Delete dodelete.php sql injection
A vulnerability was identified in satya-vinay Events-Management-System up to 437c77ceb69bf9fe2e3f4f46f7871b83f425383a. Affected by this vulnerability is an unknown functionality of the file dodelete.php of the component Registration-Dele…
CVE-2026-112139High· 7.3PoCsubhajitkhan online-clinic-management-system Administrative Mutation admindocview.php sql injection
A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown function of the file admindocview.php of the component Administrative Mutation Handler…
CVE-2026-112140Medium· 6.3PoCllSourcell Doctor-Dignity chat_module.py _get_lib_module code injection
A vulnerability was found in llSourcell Doctor-Dignity up to 3f2ffb6c892f13b50a708d05900d3227acb40ded. This impacts the function _get_lib_module of the file python/mlc_chat/chat_module.py. The manipulation of the argument model_lib resul…
CVE-2026-112102Medium· 6.3PoCAXA Group NLP.js Condition Expression Pipeline evaluator.js Evaluator.walkFunction code injection
A vulnerability was detected in AXA Group NLP.js 4.27.0. This impacts the function Evaluator.walkFunction of the file packages/evaluator/src/evaluator.js of the component Condition Expression Pipeline. The manipulation of the argument co…
CVE-2026-112183Medium· 4.8MISP CSS Injection via Remote Tag Colour in Event Preview
MISP contains a CSS injection vulnerability in the remote event preview feature. When a user previews an event from a linked MISP server, the colour value associated with each remote tag is written directly into an inline CSS style attri…
CVE-2026-112100Medium· 5.5PoCDeepPavlov multitask_preprocessor.py MultiTaskPipelinePreprocessor.__init__ code injection
A vulnerability was determined in DeepPavlov up to 1.7.0. This affects the function MultiTaskPipelinePreprocessor.__init__ of the file deeppavlov/models/preprocessors/multitask_preprocessor.py. This manipulation of the argument preproces…
CVE-2026-112098Medium· 6.3PoCDeepPavlov Config Reference Resolver params.py resolve code injection
A security flaw has been discovered in DeepPavlov up to 1.7.0. Impacted is the function resolve of the file deeppavlov/core/common/params.py of the component Config Reference Resolver. The manipulation results in code injection. The atta…
CVE-2026-112090Medium· 6.3PoCDav-ee dairy-management-system pay.php mysqli_real_escape_string sql injection
A vulnerability was detected in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. This issue affects the function mysqli_real_escape_string of the file payment/pay.php. The …