Total
5723 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2025-14637 | 1 Facebook-riares | 1 Online Pet Shop Management System | 2026-10-07 | 7.5 HIGH | 7.3 HIGH |
| A weakness has been identified in itsourcecode Online Pet Shop Management System 1.0. This vulnerability affects unknown code of the file /pet1/addcnp.php. This manipulation of the argument cnpname causes sql injection. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited. | |||||
| CVE-2026-86833 | 2026-10-07 | N/A | 5.4 MEDIUM | ||
| The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them into the HTML body of its email notifications, allowing unauthenticated attackers to inject arbitrary markup into the administrator and submitter notification emails the site sends. | |||||
| CVE-2026-65669 | 1 Microsoft | 1 Sql Server Management Studio | 2026-10-07 | N/A | 9.6 CRITICAL |
| Improper neutralization of special elements in output used by a downstream component ('injection') in SQL Server allows an unauthorized attacker to elevate privileges over a network. | |||||
| CVE-2026-102156 | 2026-10-07 | N/A | 6.8 MEDIUM | ||
| Improper neutralization of Lightweight Directory Access Protocol (LDAP) authentication input may allow an unauthenticated network attacker, under high-complexity conditions, to inject queries against the configured directory service. | |||||
| CVE-2026-102158 | 2026-10-07 | N/A | 6.5 MEDIUM | ||
| Improper validation of selected CloudVision CUE application programming interface (API) request parameters may allow an authenticated network user to perform SQL injection against the backend impacting its availability. | |||||
| CVE-2025-15078 | 1 Angeljudesuarez | 1 Student Management System | 2026-10-07 | 7.5 HIGH | 7.3 HIGH |
| A vulnerability was detected in itsourcecode Student Management System 1.0. The impacted element is an unknown function of the file /list_report.php. The manipulation of the argument sy results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. | |||||
| CVE-2025-15074 | 1 Itsourcecode | 1 Online Frozen Foods Ordering System | 2026-10-07 | 7.5 HIGH | 7.3 HIGH |
| A vulnerability was identified in itsourcecode Online Frozen Foods Ordering System 1.0. This vulnerability affects unknown code of the file /customer_details.php. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. | |||||
| CVE-2025-15075 | 1 Angeljudesuarez | 1 Student Management System | 2026-10-07 | 7.5 HIGH | 7.3 HIGH |
| A security flaw has been discovered in itsourcecode Student Management System 1.0. This issue affects some unknown processing of the file /student_p.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been released to the public and may be exploited. | |||||
| CVE-2025-15073 | 1 Itsourcecode | 1 Online Frozen Foods Ordering System | 2026-10-07 | 7.5 HIGH | 7.3 HIGH |
| A vulnerability was determined in itsourcecode Online Frozen Foods Ordering System 1.0. This affects an unknown part of the file /contact_us.php. This manipulation of the argument Name causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. | |||||
| CVE-2025-15088 | 2026-10-07 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability was detected in ketr JEPaaS up to 7.2.8. Affected by this vulnerability is the function postilService.loadPostils of the file /je/postil/postil/loadPostil. Performing a manipulation of the argument keyWord results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2025-15081 | 2026-10-07 | 6.5 MEDIUM | 6.3 MEDIUM | ||
| A vulnerability has been found in JD Cloud BE6500 4.4.1.r4308. This issue affects the function sub_4780 of the file /jdcapi. Such manipulation of the argument ddns_name leads to command injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2025-15077 | 1 Angeljudesuarez | 1 Student Management System | 2026-10-07 | 7.5 HIGH | 7.3 HIGH |
| A security vulnerability has been detected in itsourcecode Student Management System 1.0. The affected element is an unknown function of the file /form137.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. | |||||
| CVE-2026-18875 | 2 Ibm, Redhat | 2 Financial Transaction Manager, Openshift | 2026-10-07 | N/A | 7.3 HIGH |
| IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to RAG poisoning via unauthenticated runbook upsert (CWE-74) in the FTM AI agent server (api.vectordb.runbooks.js:51). An unauthenticated attacker can insert malicious runbook content into the agent's vector database to steer AI-driven MCP tool calls, potentially triggering unauthorized payment actions or exfiltrating payment data. | |||||
| CVE-2026-19179 | 2 Ibm, Redhat | 2 Financial Transaction Manager, Openshift | 2026-10-07 | N/A | 8.2 HIGH |
| IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to manipulate database queries due to improper neutralization of special elements in a boolean expression. | |||||
| CVE-2025-15133 | 1 Zspace | 2 Z4pro\+, Z4pro\+ Firmware | 2026-10-07 | 6.5 MEDIUM | 6.3 MEDIUM |
| A vulnerability was identified in ZSPACE Z4Pro+ 1.0.0440024. The impacted element is the function zfilev2_api_CloseSafe of the file /v2/file/safe/close of the component HTTP POST Request Handler. Such manipulation leads to command injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure. | |||||
| CVE-2025-15192 | 1 Dlink | 2 Dwr-m920, Dwr-m920 Firmware | 2026-10-07 | 6.5 MEDIUM | 6.3 MEDIUM |
| A security vulnerability has been detected in D-Link DWR-M920 up to 1.1.50. The impacted element is the function sub_415328 of the file /boafrm/formLtefotaUpgradeQuectel. Such manipulation of the argument fota_url leads to command injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. | |||||
| CVE-2025-15169 | 1 Biggidroid | 1 Simple Php Cms | 2026-10-07 | 5.8 MEDIUM | 4.7 MEDIUM |
| A weakness has been identified in BiggiDroid Simple PHP CMS 1.0. Affected by this issue is some unknown functionality of the file /admin/editsite.php. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way. | |||||
| CVE-2025-15166 | 1 Admerc | 1 Online Cake Ordering System | 2026-10-07 | 7.5 HIGH | 7.3 HIGH |
| A vulnerability was found in itsourcecode Online Cake Ordering System 1.0. This affects an unknown function of the file /updatesupplier.php?action=edit. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used. | |||||
| CVE-2025-15243 | 1 Carmelo | 1 Simple Stock System | 2026-10-07 | 7.5 HIGH | 7.3 HIGH |
| A flaw has been found in code-projects Simple Stock System 1.0. This affects an unknown function of the file /market/login.php. Executing a manipulation of the argument Username can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used. | |||||
| CVE-2025-15195 | 1 Code-projects | 1 Assessment Management | 2026-10-07 | 7.5 HIGH | 7.3 HIGH |
| A vulnerability was determined in code-projects Assessment Management 1.0. Affected by this issue is some unknown functionality of the file /admin/add-module.php. This manipulation of the argument linked[] causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. | |||||