CVE Vulnerabilities - 5 October 2026

The Ordering API in the dotnet eShop sample application can be tricked by sending a specially crafted OrderNumber value. This can cause the system to retrieve or modify the wrong order data, potential...

The Feelcrm‑os 1.0.0 web application contains a flaw in its file‑upload feature that allows an attacker to send a file to the server without restriction. This can be triggered remotely and could let m...

The MemberController in feelcrm-os version 1.0.0 accepts a group_id value that can be tricked into running unwanted database commands. An attacker from anywhere on the internet could change, delete, o...

The PluginManager component in TallCMS up to version 4.8.0 can be tricked into running unauthorized code from a distance. This could let an attacker execute commands on your server, potentially compro...

The GetMemberByGroups function in Feelcrm‑OS version 1.0.0 can be tricked into running database commands when an attacker sends specially crafted group data. This can be done over the Internet and may...

The file‑upload feature on the Totolink A3002MU router allows a specially crafted file name to move outside the intended folder, letting an attacker write files to arbitrary locations on the device. T...

The web page /admin/schoolyear.php in the itsourcecode Online Admission System does not properly check the data it receives, allowing an attacker to send specially crafted input that tricks the databa...

The login.php file in the Food-waste-management-system can be tricked into using a attacker-chosen session ID. This lets a remote user take over a victim's session after they log in. Update the login ...

The web page /admin/key.php in itsourcecode Online Admission System 1.0 lets a user control a database query by changing the ID parameter. An attacker on the internet could exploit this to view, chang...

The web page new.php in itsourcecode Online Admission System does not properly check the information entered in the "schedid" field. An attacker on the internet could send specially crafted data that ...

The register1.php page in itsourcecode Online Admission System 1.0 accepts a user name (fname) without proper checks, allowing an attacker to send specially crafted data and change the underlying data...

The updateUser function in Jeebase 0.0.1 can be tricked into accepting specially crafted data, allowing a remote user to modify arbitrary attributes of a user record. This could let an attacker alter ...

The admin.php file in the Food-waste-management-system can be tricked into granting access without proper permission. Attackers can do this from anywhere on the internet, potentially seeing or changin...

The admin.php page in the Order Assignment feature of the Food-waste-management-system can be sent specially crafted data that makes the database run commands it should not. An attacker on the interne...

The Gerapy tool (versions up to 0.9.13) lets someone send a specially crafted project name that can move outside the intended folder, giving them the ability to read or modify files on the server. Bec...

The vgmstream program’s TXTP file parser may misuse memory, allowing a local user to cause the application to stop working unexpectedly. This risk occurs when specially crafted TXTP files are processe...

The django-haystack search library (versions up to 3.3.0) has a flaw in a function that builds search queries, allowing an attacker to inject harmful code from a distance. This could let a remote user...

The jsondiffpatch library used in several npm packages (beneidel/jsondiffpatch, jsondiffpatch, @rootio/jsondiffpatch) has a flaw that could let a malicious user execute code on your system. This could...

The admin newsletters page in osCommerce2 (up to version 2.3.4.1) can be tricked into running malicious code when a specially crafted request is sent. This can let an attacker take control of the serv...

The admin page that adds new symptoms in the SourceCodester Drug Recommendation System can be tricked into running unintended database commands when a user supplies a crafted symptom name. This could ...

The admin page add_drug.php in the Drug Recommendation System can be tricked into running unintended database commands when certain fields are submitted. An attacker from anywhere on the internet coul...

The web application used for drug recommendations contains a flaw in its edit_class.php page that lets a remote user change the way the system talks to its database. By sending specially crafted data,...

The MongoDB controller for Kubernetes does not fully check backup settings when a user edits the Ops Manager configuration. This can let someone with permission to change that configuration unintentio...

Versions of O2OA up to 10.0.1-ce have a flaw in the file upload feature that lets an attacker supply a malicious URL. When exploited, the server can be forced to make outbound requests to any address,...

The Department Search feature in feelcrm-os version 1.0.0 does not properly clean the text you type when searching. An attacker can send a specially crafted search term that makes a web page run their...