CVE Vulnerabilities - 12 October 2026

The admin page (sum.php) can be tricked into running unauthorized database commands when a specially crafted ID is supplied. This lets an attacker read, change, or delete admission data from anywhere ...

The Baptism Information Management System version 1.0 contains a flaw in the ebaptism.php page where the ID parameter is not properly checked. An attacker on the internet can send specially crafted re...

The Baptism Information Management System version 1.0 contains a flaw in the pbaptism.php file that lets an attacker send specially crafted data to change how the system talks to its database. This co...

The SEMCMS content system (versions up to 5.0) has a weakness in the SEMCMS_Banner.php page that lets an attacker send specially crafted data to run unauthorized database commands. This can be done ov...

The SEMCMS software (versions up to 5.0) has a flaw in the SEMCMS_Download.php page that lets a remote user tamper with the database. This could let attackers view, modify, or delete information store...

The TinyFileManager web tool can be tricked into accepting files from an attacker and saving them on the server. This lets a malicious user place harmful files on the system, potentially leading to fu...

The fetch function in the collect_corpus component of houtini-ai voice-analyser-mcp (versions up to 2.1.1) can be forced to contact arbitrary URLs when a specially crafted sitemap_url is supplied. Thi...

The seo-crawler-mcp tool (versions up to 2.1.5) contains a flaw in its run_seo_audit function that lets an attacker cause the server to make arbitrary network calls. This could be used to reach intern...

The Jeewms system’s autocomplete feature can be tricked into running unwanted database queries when specially crafted input is supplied. This could allow an attacker to view, modify, or delete data st...

The PDA interface in erzhongxmu JEEWMS (up to the September 2026 release) accepts a search string that can be tricked into running unintended database commands. This means an attacker on the network c...

The JEEWMS system from erzhongxmu lets attackers send specially crafted text in the search box, which can cause the underlying database to run unwanted commands. This could let an outsider view, chang...

The inbound quality check feature in erzhongxmu JEEWMS can be tricked into running unauthorized database commands when a specially crafted search string is sent. This could let an attacker view, chang...

The JEEWMS web system from erzhongxmu lets a user send a specially crafted search string to the WvGiController.list function, causing the underlying database to run unintended commands. An attacker co...

The search feature in erzhongxmu JEEWMS (up to version 2026.09.27-W39) accepts a user‑supplied string that is not properly checked, allowing malicious commands to be run on the database. An attacker c...

The JEEWMS system from erzhongxmu lets attackers send specially crafted values to the getbinall or getbinallagv functions, causing the database to run unintended commands. This can be done over the ne...

The RuoYi system (versions up to 4.8.3) has a flaw in its role‑checking function that can be tricked into granting higher privileges. An attacker on the network could change user roles and gain access...

The sandbox feature in deepseek-harness versions up to 0.1.1-rc.2 can be tricked by sending a crafted profile value, allowing code to run outside the intended safe area. This could let an attacker exe...

The backend template editor in CicadasCMS can be tricked into writing files to any location on the server. An attacker who can reach the save function could place or replace files, potentially comprom...

The 2024.11.28.11 version of Yungengxin Cloud Billing contains a flaw in its billing driver that lets anyone with local access stop any running program by manipulating a process ID. This could be used...

The DHCP hostname feature in Netcore NR268 version 1.7.121109 can be tricked into executing malicious code entered as a hostname. An attacker on the network could use this to run unwanted scripts in a...

The smartwatch firmware up to version 0.0.8 lets nearby Bluetooth devices read the wearer’s heart‑rate without any pairing or approval. Someone standing close could see live health information, which ...

The DHCP management page on Netcore NR268 version 1.7.121109 accepts a hostname value that can be tricked into running malicious code in a user's browser. An attacker from anywhere on the network coul...

The admin page in the Drug Recommendation System lets attackers insert code by submitting specially crafted name or email values. This can cause unwanted scripts to run in a user’s browser, potentiall...

The student registration page in the SourceCodester Drug Recommendation System can be tricked into running unwanted code when a user enters specially crafted data in fields such as name, password, ema...

The CGI endpoint in Netcore NR268 version 1.7.121109 can be tricked into performing actions on behalf of a user without their consent. This means an attacker could cause the system to execute unwanted...