VulDB Recent Entries

A vulnerability was found in code-projects Online Reviewer System 1.0. It has been rated as critical. This vulnerability affects unknown code of the file /system/system/admins/assessments/pretest/questions-view.php. The manipulation of the argument ID leads to sql injection. This vulnerability is uniquely identified as CVE-2026-2195. The attack is possible to be carried out remotely. Moreover, an exploit is present.

A vulnerability was found in D-Link DI-7100G C1 24.04.18D1. It has been declared as critical. This affects the function start_proxy_client_email. Executing a manipulation can lead to command injection. This vulnerability is handled as CVE-2026-2194. The attack can be executed remotely. Additionally, an exploit exists.

A vulnerability was found in D-Link DI-7100G C1 24.04.18D1. It has been classified as critical. Affected by this issue is the function set_jhttpd_info. Performing a manipulation of the argument usb_username results in command injection. This vulnerability is known as CVE-2026-2193. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability was found in Tenda AC9 15.03.06.42_multi and classified as critical. Affected by this vulnerability is the function formGetRebootTimer. Such manipulation of the argument sys.schedulereboot.start_time/sys.schedulereboot.end_time leads to stack-based buffer overflow. This vulnerability is traded as CVE-2026-2192. The attack may be launched remotely. Furthermore, there is an exploit available.

A vulnerability has been found in Tenda AC9 15.03.06.42_multi and classified as critical. Affected is the function formGetDdosDefenceList. This manipulation of the argument security.ddos.map causes stack-based buffer overflow. This vulnerability appears as CVE-2026-2191. The attack may be initiated remotely. In addition, an exploit is available.

A vulnerability, which was classified as critical, was found in itsourcecode School Management System 1.0. This impacts an unknown function of the file /ramonsys/user/controller.php. The manipulation of the argument ID results in sql injection. This vulnerability is reported as CVE-2026-2190. The attack can be launched remotely. Moreover, an exploit is present.

A vulnerability, which was classified as critical, has been found in itsourcecode School Management System 1.0. This affects an unknown function of the file /ramonsys/report/index.php. The manipulation of the argument ay leads to sql injection. This vulnerability is documented as CVE-2026-2189. The attack can be initiated remotely. Additionally, an exploit exists.

A vulnerability classified as critical was found in UTT 进取 521G 3.1.1-190816. The impacted element is the function sub_446B18 of the file /goform/formPdbUpConfig. Executing a manipulation of the argument policyNames can lead to os command injection. This vulnerability is registered as CVE-2026-2188. It is possible to launch the attack remotely. Furthermore, an exploit is available.

A vulnerability classified as critical has been found in Tenda RX3 16.03.13.11. The affected element is the function set_qosMib_list of the file /goform/formSetQosBand. Performing a manipulation of the argument list results in stack-based buffer overflow. This vulnerability is cataloged as CVE-2026-2187. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability described as critical has been identified in Tenda RX3 16.03.13.11. Impacted is the function fromSetIpMacBind of the file /goform/SetIpMacBind. Such manipulation of the argument list leads to stack-based buffer overflow. This vulnerability is listed as CVE-2026-2186. The attack may be performed from remote. In addition, an exploit is available.

A vulnerability marked as critical has been reported in Tenda RX3 16.03.13.11. This issue affects the function set_device_name of the file /goform/setBlackRule of the component MAC Filtering Configuration Endpoint. This manipulation of the argument devName/mac causes stack-based buffer overflow. This vulnerability is tracked as CVE-2026-2185. The attack is possible to be carried out remotely. Moreover, an exploit is present.

A vulnerability labeled as critical has been found in Great Developers Certificate Generation System up to 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73. This vulnerability affects unknown code of the file /restructured/csv.php. The manipulation of the argument photo results in os command injection. This vulnerability is identified as CVE-2026-2184. The attack can be executed remotely. There is not any exploit available. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The code repository of the project has not been active for many years.

A vulnerability identified as critical has been detected in Great Developers Certificate Generation System up to 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73. This affects an unknown part of the file /restructured/csv.php. The manipulation leads to unrestricted upload. This vulnerability is referenced as CVE-2026-2183. Remote exploitation of the attack is possible. No exploit is available. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The code repository of the project has not been active for many years.

A vulnerability categorized as critical has been discovered in UTT 进取 521G 3.1.1-190816. Affected by this issue is the function doSystem of the file /goform/setSysAdm. Executing a manipulation of the argument passwd1 can lead to command injection. The identification of this vulnerability is CVE-2026-2182. The attack may be launched remotely. Furthermore, there is an exploit available.

A vulnerability was found in Tenda RX3 16.03.13.11. It has been rated as critical. Affected by this vulnerability is an unknown functionality of the file /goform/openSchedWifi. Performing a manipulation of the argument schedStartTime/schedEndTime results in stack-based buffer overflow. This vulnerability was named CVE-2026-2181. The attack may be initiated remotely. In addition, an exploit is available.

A vulnerability was found in Tenda RX3 16.03.13.11. It has been declared as critical. Affected is an unknown function of the file /goform/fast_setting_wifi_set. Such manipulation of the argument ssid_5g leads to stack-based buffer overflow. This vulnerability is uniquely identified as CVE-2026-2180. The attack can be launched remotely. Moreover, an exploit is present.

A vulnerability was found in PHPGurukul Hospital Management System 4.0. It has been classified as critical. This impacts an unknown function of the file /admin/manage-users.php. This manipulation of the argument ID causes sql injection. This vulnerability is handled as CVE-2026-2179. The attack can be initiated remotely. Additionally, an exploit exists.

A vulnerability was found in r-huijts xcode-mcp-server up to f3419f00117aa9949e326f78cc940166c88f18cb and classified as critical. This affects the function registerXcodeTools of the file src/tools/xcode/index.ts of the component run_lldb. The manipulation of the argument args results in command injection. This vulnerability is known as CVE-2026-2178. It is possible to launch the attack remotely. Furthermore, an exploit is available. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. Applying a patch is advised to resolve this issue.

A vulnerability has been found in SourceCodester Prison Management System 1.0 and classified as critical. The impacted element is an unknown function of the component Login. The manipulation leads to session fixiation. This vulnerability is traded as CVE-2026-2177. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability, which was classified as critical, was found in JAY Login & Register Plugin up to 2.6.03 on WordPress. The affected element is the function jay_panel_ajax_update_profile. Executing a manipulation can lead to improper privilege management. This vulnerability appears as CVE-2025-15100. The attack may be performed from remote. There is no available exploit.