Vuldb Updates

A vulnerability was found in SourceCodester Zoo Management System 1.0. It has been rated as problematic. This impacts an unknown function of the component Add Classification. This manipulation causes cross site scripting. This vulnerability is registered as CVE-2022-33075. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability was found in itsourcecode Hospital Management System 1.0. It has been declared as critical. This affects an unknown part of the file /patientreport.php. Executing a manipulation of the argument editid can lead to sql injection. This vulnerability is tracked as CVE-2026-14731. The attack can be launched remotely. Moreover, an exploit is present.

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. It has been rated as critical. This vulnerability affects unknown code of the file /edit_exam.php. The manipulation of the argument ID leads to sql injection. This vulnerability is listed as CVE-2026-14732. The attack may be initiated remotely. In addition, an exploit is available.

A vulnerability categorized as critical has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This issue affects some unknown processing of the file /edit_coursea.php. The manipulation of the argument ID results in sql injection. This vulnerability is cataloged as CVE-2026-14733. The attack may be launched remotely. Furthermore, there is an exploit available.

A vulnerability identified as critical has been detected in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file /edit_product.php. This manipulation of the argument ID causes sql injection. This vulnerability is registered as CVE-2026-14734. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

A vulnerability labeled as critical has been found in code-projects Smart Parking System 1.0. The affected element is an unknown function of the file /parkings/parkings.php. Such manipulation of the argument street/city/status leads to sql injection. This vulnerability is documented as CVE-2026-14735. The attack can be executed remotely. Additionally, an exploit exists.

A vulnerability marked as critical has been reported in Ruijie RG-UAC up to 1.0-R1.8.2.p5. The impacted element is an unknown function of the file user_auth_commit.php. Performing a manipulation of the argument upload_image results in unrestricted upload. This vulnerability is reported as CVE-2026-14736. The attack is possible to be carried out remotely. Moreover, an exploit is present.

A vulnerability classified as critical has been found in Hanwang e-Face General Management Platform 6.3.5.4. This impacts an unknown function of the file /sysAuthStr/querySysAuthStr.do. The manipulation of the argument order leads to sql injection. This vulnerability is traded as CVE-2026-14737. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability classified as problematic was found in exo-explore exo up to 1.0.71. Affected is the function _image_cache_key of the file src/exo/worker/engines/mlx/vision.py of the component Vision Feature Cache. The manipulation results in use of weak hash. This vulnerability is known as CVE-2026-14738. It is possible to launch the attack remotely. Furthermore, an exploit is available. The pull request to fix this issue awaits acceptance.

A vulnerability was found in langchain-ai langgraph up to 1.2.4. It has been rated as problematic. The affected element is the function _freeze of the file libs/langgraph/langgraph/_internal/_cache.py of the component Task Result Cache. This manipulation of the argument default_cache_key causes use of weak hash. This vulnerability is tracked as CVE-2026-14742. The attack is possible to be carried out remotely. Moreover, an exploit is present. The pull request to fix this issue awaits acceptance.

A vulnerability categorized as critical has been discovered in code-projects Real State Services 1.0. The impacted element is an unknown function of the file /normalHomeSale.php. Such manipulation of the argument loc leads to sql injection. This vulnerability is listed as CVE-2026-14743. The attack may be performed from remote. In addition, an exploit is available.

A vulnerability identified as critical has been detected in code-projects Real State Services 1.0. This affects an unknown function of the file /normalHomeRent.php. Performing a manipulation of the argument loc results in sql injection. This vulnerability is cataloged as CVE-2026-14744. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability labeled as critical has been found in code-projects Real State Services 1.0. This impacts an unknown function of the file /single-list_rent.php. Executing a manipulation of the argument ID can lead to sql injection. This vulnerability is registered as CVE-2026-14745. It is possible to launch the attack remotely. Furthermore, an exploit is available.

A vulnerability marked as critical has been reported in code-projects Real State Services 1.0. Affected is an unknown function of the file /addprojectrent.php. The manipulation of the argument amen leads to sql injection. This vulnerability is documented as CVE-2026-14746. The attack can be initiated remotely. Additionally, an exploit exists.

A vulnerability described as critical has been identified in code-projects Real State Services 1.0. Affected by this vulnerability is an unknown functionality of the file /addprojectsale.php. The manipulation of the argument amen results in sql injection. This vulnerability is reported as CVE-2026-14747. The attack can be launched remotely. No exploit exists.

A vulnerability classified as critical has been found in AIAnytime Awesome-MCP-Server up to a884bb51bcd99e08e14fd712c749d55d9d9a13ab. Affected by this issue is some unknown functionality of the file mcp-wiki/src/mcp_wiki/server.py of the component mcp-wiki/wiki-summary. This manipulation of the argument url causes server-side request forgery. This vulnerability appears as CVE-2026-14748. The attack may be initiated remotely. In addition, an exploit is available. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability identified as problematic has been detected in cve-search up to 6.0.0. The affected element is an unknown function of the component MongoDB Query Handler. Performing a manipulation of the argument collection/fields/filter results in improper input validation. This vulnerability is identified as CVE-2026-59509. The attack can be initiated remotely. There is not any exploit available.

A vulnerability has been found in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be and classified as critical. Impacted is the function eval of the file application/pages/imba_calculator/calculate.php. The manipulation of the argument mathematical_sentence leads to code injection. This vulnerability is uniquely identified as CVE-2026-14749. The attack is possible to be carried out remotely. Moreover, an exploit is present. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was found in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be and classified as critical. The affected element is the function Notes_controller::accessing_dictionary_authorization of the file application/PHP/objects/notes/accessing_dictionary_authorization.php. The manipulation of the argument Password results in sql injection. This vulnerability was named CVE-2026-14750. The attack may be performed from remote. In addition, an exploit is available. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was found in mjperpinosa stumasy up to 327d1b0f2915ba79d7ef8ebb74553e987609d9be. It has been classified as critical. The impacted element is the function Notes_controller::search_scratch_data of the file application/PHP/objects/notes/search_scratch_data.php. This manipulation of the argument field_name causes sql injection. The identification of this vulnerability is CVE-2026-14751. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.