VulDB Recent Entries

A vulnerability marked as critical has been reported in code-projects Online Examination System 1.0. Affected by this issue is some unknown functionality of the file login.php. The manipulation of the argument username/password leads to sql injection. This vulnerability is listed as CVE-2026-2173. The attack may be initiated remotely. There is no available exploit.

A vulnerability labeled as critical has been found in code-projects Online Application System for Admission 1.0. Affected by this vulnerability is an unknown functionality of the file enrollment/index.php of the component Login Endpoint. Executing a manipulation can lead to sql injection. This vulnerability is tracked as CVE-2026-2172. The attack can be launched remotely. Moreover, an exploit is present.

A vulnerability identified as critical has been detected in code-projects Online Student Management System 1.0. Affected is an unknown function of the file accounts.php of the component Login. Performing a manipulation of the argument username/password results in sql injection. This vulnerability is identified as CVE-2026-2171. The attack can be initiated remotely. Additionally, an exploit exists.

A vulnerability categorized as critical has been discovered in D-Link DWR-M921 1.1.50. This impacts an unknown function of the file /boafrm/formLtefotaUpgradeFibocom. Such manipulation of the argument fota_url leads to command injection. This vulnerability is referenced as CVE-2026-2169. It is possible to launch the attack remotely. Furthermore, an exploit is available.

A vulnerability was found in D-Link DWR-M921 1.1.50. It has been rated as critical. This affects the function sub_419920 of the file /boafrm/formLtefotaUpgradeQuectel. This manipulation of the argument fota_url causes command injection. The identification of this vulnerability is CVE-2026-2168. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability was found in Totolink WA300 5.2cu.7112_B20190227. It has been declared as critical. The impacted element is the function setAPNetwork of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument Ipaddr results in os command injection. This vulnerability was named CVE-2026-2167. The attack may be performed from remote. In addition, an exploit is available.

A vulnerability was found in code-projects Online Reviewer System 1.0. It has been classified as critical. The affected element is an unknown function of the file /login/index.php of the component Login. The manipulation of the argument username/password leads to sql injection. This vulnerability is uniquely identified as CVE-2026-2166. The attack is possible to be carried out remotely. Moreover, an exploit is present.

A vulnerability was found in detronetdip E-commerce 1.0.0 and classified as critical. Impacted is an unknown function of the file /Admin/assets/backend/seller/add_seller.php of the component Account Creation Endpoint. Executing a manipulation of the argument email can lead to missing authentication. This vulnerability is handled as CVE-2026-2165. The attack can be executed remotely. Additionally, an exploit exists. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability has been found in detronetdip E-commerce 1.0.0 and classified as critical. This issue affects some unknown processing of the file /seller/assets/backend/profile/addadhar.php. Performing a manipulation of the argument File results in unrestricted upload. This vulnerability is known as CVE-2026-2164. Remote exploitation of the attack is possible. Furthermore, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability, which was classified as critical, was found in D-Link DIR-600 up to 2.15WWb02. This vulnerability affects unknown code of the file ssdp.cgi. Such manipulation of the argument HTTP_ST/REMOTE_ADDR/REMOTE_PORT/SERVER_ID leads to command injection. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is traded as CVE-2026-2163. The attack may be launched remotely. Furthermore, there is an exploit available.

A vulnerability, which was classified as critical, has been found in itsourcecode News Portal Project 1.0. This affects an unknown part of the file /admin/aboutus.php. This manipulation of the argument pagetitle causes sql injection. This vulnerability appears as CVE-2026-2162. The attack may be initiated remotely. In addition, an exploit is available.

A vulnerability classified as critical was found in itsourcecode Directory Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/forget-password.php. The manipulation of the argument email results in sql injection. This vulnerability is reported as CVE-2026-2161. The attack can be launched remotely. Moreover, an exploit is present.

A vulnerability classified as problematic has been found in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file /tourism/classes/Master.php?f=save_package. The manipulation of the argument Title leads to cross site scripting. This vulnerability is documented as CVE-2026-2160. The attack can be initiated remotely. Additionally, an exploit exists.

A vulnerability described as problematic has been identified in SourceCodester Simple Responsive Tourism Website 1.0. Affected is an unknown function of the file /tourism/classes/Master.php?f=register of the component Registration. Executing a manipulation of the argument firstname/lastname/username can lead to cross site scripting. This vulnerability is registered as CVE-2026-2159. It is possible to launch the attack remotely. Furthermore, an exploit is available.

A vulnerability marked as critical has been reported in code-projects Student Web Portal 1.0. This impacts an unknown function of the file /check_user.php. Performing a manipulation of the argument Username results in sql injection. This vulnerability is cataloged as CVE-2026-2158. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability labeled as critical has been found in D-Link DIR-823X 250416. This affects the function sub_4175CC of the file /goform/set_static_route_table. Such manipulation of the argument interface/destip/netmask/gateway/metric leads to os command injection. This vulnerability is listed as CVE-2026-2157. The attack may be performed from remote. In addition, an exploit is available.

A vulnerability identified as problematic has been detected in code-projects Online Student Management System 1.0. The impacted element is an unknown function of the file /admin/announcement/index.php?view=add of the component Announcement Management Module. This manipulation causes cross site scripting. This vulnerability is tracked as CVE-2026-2156. The attack is possible to be carried out remotely. Moreover, an exploit is present.

A vulnerability categorized as critical has been discovered in D-Link DIR-823X 250416. The affected element is the function sub_4208A0 of the file /goform/set_dmz of the component Configuration Handler. The manipulation of the argument dmz_host/dmz_enable results in os command injection. This vulnerability is identified as CVE-2026-2155. The attack can be executed remotely. Additionally, an exploit exists.

A vulnerability was found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. It has been rated as problematic. Impacted is an unknown function of the file /registration.php of the component Patient Registration Module. The manipulation of the argument First Name leads to cross site scripting. This vulnerability is referenced as CVE-2026-2154. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

A vulnerability was found in mwielgoszewski doorman up to 0.6. It has been declared as problematic. This issue affects the function is_safe_url of the file doorman/users/views.py. Executing a manipulation of the argument Next can lead to open redirect. The identification of this vulnerability is CVE-2026-2153. The attack may be launched remotely. Furthermore, there is an exploit available.