CVEs added in
February 2026

OS Command Injection in openDCIM report_network_map

SQL Injection in openDCIM Config::UpdateParameter Handlers

Missing Authorization in openDCIM Installer and Upgrade

Stored XSS in Statamic SVG and Icon Components

Code Injection in Statamic Control Panel

Server-Side Request Forgery (SSRF) in Gradio gr.load()

Path Traversal in Gradio on Windows with Python 3.13+

OS Command Injection in WeGIA Database Restore Functionality

Authentication and Authorization Bypass in WeGIA Document

Path Traversal in Kaniko Build Context Handling

Improper Authentication in Statamic Control Panel Privilege

XSS in Kiteworks Email Protection Gateway Admin

Command Injection in Group-Office TNEF Attachment Processing

Missing Authorization in phpMyFAQ

SQL Injection in Group-Office Email Template Selection

Input Validation / Routing Normalization Mismatch

XSS in CleverTap Web SDK Visual Builder postMessage Origin

Unsafe Deserialization and Resource Exhaustion

Authorization Bypass in NestJS Fastify Platform

Horizontal Privilege Escalation / Insecure Direct Object

Stored Cross-Site Scripting (XSS) in PublicCMS File Handling

OS Command Injection in Totolink N300RH Web Management

Dynamic Code Evaluation in OpenStack Vitrage Query Parser

OS Command Injection in XWEB Pro MBird SMS Utility Route

OS Command Injection in XWEB Pro API Restore Action

OS Command Injection in XWEB Pro Wi‑Fi Configuration

OS Command Injection in XWEB Pro Modbus Debug Command Tool

OS Command Injection in XWEB Pro LCD State Configuration

OS Command Injection in XWEB Pro Devices Route Template

OS Command Injection in XWEB Pro Import Preconfiguration API

OS Command Injection in XWEB Pro Hostname Configuration

Missing Authentication in EV Charging Backend

Improper Restriction of Authentication Attempts

OS Command Injection in XWEB Pro Firmware Update Mechanism

OS Command Injection in XWEB Pro Restore Route

OS Command Injection in XWEB Pro get setup Route

OS Command Injection in XWEB Pro Utility Route OpenSSL

OS Command Injection in XWEB Pro Firmware Update Device

OS Command Injection in XWEB Pro Library Installation

OS Command Injection in XWEB Pro Firmware Update Route

Improper Restriction of Excessive Authentication Attempts

Authentication Bypass in Copeland XWEB Pro

OS Command Injection in XWEB Pro Contacts Import Route

OS Command Injection in XWEB Pro Firmware Update Devices

OS Command Injection in XWEB Pro Map Upload Filename

OS Command Injection in XWEB Pro Templates Route

Missing Authentication in Charging Backend

Missing Authentication in Charging Backend

Improper Restriction of Excessive Authentication Attempts

Missing Authentication / Broken Access Control

Authentication Rate Limiting / Brute-Force Protection

Improper Authentication Rate Limiting in WebSocket API

Missing Authentication in OCPP WebSocket Charging Endpoints

Improper Restriction of Excessive Authentication Attempts

Missing Authentication in EV Charging Backend

OS Command Injection in osctrl Admin Environment Hostname

Improper Access Control / Information Disclosure

Stored XSS in Initiative Project Management Platform

Insecure Direct Object Reference (IDOR) in Hoppscotch User

Broken / Missing Access Control in Hoppscotch Self-Hosted

Sensitive Information Exposure in Authentication Flows

Missing Authorization in Actual Sync API for Multi-User

SQL Injection in School Management System Setting Handler

Broken Access Control in Umbraco Engage

Missing Authorization / Access Control in Zulip Cloud

Broken Access Control / Missing Authentication

Path Traversal in Elixir.Hexpm.Store.Local Local Storage

Code Injection in fastCMS PluginController

Directory Traversal in ZenTaoPMS AI Module File Handling

Authorization Bypass / Insecure Authorization

Improper Authorization in Discourse Patreon Integration

Improper Session Management in D‑Link DSL-124 Web Interface

Broken Access Control in Ajenti Server Admin Panel

Path Traversal in Vitess Clustering System

Code Injection in Langflow CSV Agent

OS Command Injection in Vitess Backup Restore

Improper Input Validation in Koa ctx.hostname API

Code Injection / Sandbox Escape in Agenta Custom Code

OS Command Injection in WPGraphQL GitHub Actions Release

Privilege Escalation / Authorization Bypass in WireGuard

Unsafe Java Deserialization (CWE-502) in c3p0 Pools

SSRF in TerriaJS-Server Proxy Configuration

Password Reset Poisoning / Header Trust Vulnerability

Authentication Bypass via Insecure Token Validation

Path Traversal / Zip Slip in Zed Extension Archive

OS Command Injection in Manyfold Render Generation

SQL Injection in Fleet Device Management

Command Injection / CGI Argument Injection in TinyWeb Web

Code Injection / Expression Injection in n8n Workflow

Code Injection in n8n Workflow Automation

SQL Injection Leading to Remote Code Execution

Code Injection in n8n Task Runner Sandbox

Expression Injection / Code Injection in n8n Form Nodes

Path Traversal in Archive Extraction in Vikunja Backup

Stored XSS in Vikunja Task Management Platform

Input Injection & Cross-Site Scripting in Storybook Dev

Path Traversal in LORIS Electrophysiology Browser

Path Traversal & Unrestricted File Upload in LORIS Media

SQL Injection in z-9527 admin user controller endpoints

Cross-Site Scripting (Stored XSS) in Rucio WebUI Custom

Cross-Site Scripting (XSS) in Rucio WebUI 500 Error Handling

Insecure Direct Object Reference (IDOR) in OpenEMR DICOM

SQL Injection in OpenEMR Prescription Listing Functionality

Missing Authorization in OpenEMR REST API Document and

SQL Injection in OpenEMR Patient REST API

Authorization Bypass in OpenEMR Patient Portal

SQL Injection in OpenEMR Immunization Module

OS Command Injection in OneUptime NetworkPathMonitor

Remote Code Execution via Unsafe Remote Class Loading

SSRF in Plane 'Add Link' Feature

SSRF in esm.sh /http(s) Fetch Route

Path Traversal in Dart and Flutter SDKs

Server-Side Code Injection in Budibase Cloud View Filtering

Cross-Site Scripting (XSS) in asbplayer Chrome Extension

SSRF in esm.sh CDN Response Handling

Hard-Coded Credentials in Gardyn IoT Hub Ecosystem

Path Traversal in basic-ftp Node.js Client downloadToDir()

Authorization Bypass / Missing Authorization in udisks LUKS

Improper Certificate Validation in Rancher Manager CLI

Path Traversal in PersistentVolume Path Configuration on

SQL Injection in News Portal Project Admin Contact Page

SQL Injection in Document Management System /register.php

SQL Injection in College Management System Admin Salary

SQL Injection in College Management System login.php

SQL Injection in SourceCodester Simple and Nice Shopping

SSRF in changedetection.io Watch URL Handling

Access Control Bypass in Coturn TURN/STUN Server

Path Traversal and Server-Side Template Injection

Predictable Authentication Token in FreeScout TokenAuth

Unrestricted File Upload in FreeScout on Apache

XSS in Karakeep Reddit Metascraper Plugin

Code Injection / Sandbox Escape in Enclave JavaScript VM

Cross-Site Scripting (XSS) in RustFS Management Console

OS Command Injection in OliveTin Shell Mode and Webhook

Cross-Site Scripting (XSS) in Bugsink Stacktrace Viewer

Broken Access Control / Missing Authorization

Improper Input Validation in RustFS Object Storage

Path Traversal File Write in Rollup Module Bundler Core

Missing Authentication in Parse Dashboard AI Agent Endpoint

Broken Access Control in OpenEMR Order Types Management

Path Traversal in OpenEMR EtherFax Document Disposal

Stored XSS in OpenEMR GAD-7 Anxiety Assessment Form

Improper Certificate Validation in OpenEMR HTTP Client

SQL Injection in Category Management of itsourcecode News

SQL Injection in itsourcecode News Portal Project Category

SQL Injection in Login Component of Document Management

Path Traversal in Fiber Static Middleware on Windows

OS Command Injection in InSAT MasterSCADA BUK-TS MMadmServ

SQL Injection in InSAT MasterSCADA BUK-TS Web Interface

SQL Injection in Contact Activity Timeline API Endpoint

Missing Authorization in Mastodon FASP Experimental Feature

Input Validation and Path Normalization Error

Insufficient Entropy / Weak Cryptographic Secrets

Improper Access Control in GCOM EPON 1GE Administrative

SSRF in AVideo aVideoEncoder.json.php API

Missing Authentication in ActualBudget Server

Path Traversal in File Upload in MindsDB files

OS Command Injection in bleon-ethical/api-gateway-deploy

Code Injection in Apache Airflow 2 Web Server

SQL Injection in itsourcecode Document Management System

SQL Injection in itsourcecode Document Management System

OS Command Injection in yt-dlp URL Handling

SQL Injection in Ormar Aggregate Query Helpers (min/max)

Missing Authentication / Broken Access Control

Path Traversal / Local File Inclusion in ImageMagick File

SQL Injection in itsourcecode E-Logbook Health Monitoring

Improper Input Validation in free5GC UDM Nudm_UEAU Service

XSS in New API MarkdownRenderer Component

SSRF in Astro Custom Error Page Rendering

SQL Injection in itsourcecode Event Management System

Improper Input Validation and Error Handling in free5GC UDM

Open Redirect in Authentication / OAuth Flow in Traccar GPS

Improper Input Validation / Protocol State Handling

Stored XSS in Traccar GPS Tracking System

OS Command Injection in TOTOLINK X6000R NTPSyncWithHost

Improper Input Validation in Valkey Request Handling

OS Command Injection in TOTOLink X5000R setIptvCfg Handler

Injection in Valkey Lua Scripting Error Handling

Improper Certificate Validation in YMFE YApi Axios HTTPS

Improper Certificate Validation in jxcore jxm HTTPS Requests

Improper Certificate Validation in Ayms node-To Master

Improper Access Control in Student Result Management System

Unsafe Deserialization in Apache Camel LevelDB Aggregation

OS Command Injection in Vaelsys HTTP POST Request Handler

OS Command Injection in Tosei Online Store Management

Improper Access Control in Student Result Management System

SQL Injection in Online Reviewer System Student Result View

Improper Authorization in Configuration Handler of funadmin

SQL Injection in Vehicle Management System /billaction.php

Code Injection / Arbitrary Code Execution in OneUptime

SSRF in OpenClaw Cron Webhook Delivery

OS Command Injection in OpenClaw macOS Claude CLI Keychain

SSRF in Wallos Subscription Tracker

SQL Injection in Agri-Trading Online Shopping System

SQL Injection in ZoneMinder getNearEvents Status Endpoint

Template Injection / Code Injection in Metabase Email

Broken Access Control in ERP Document Endpoints

Unsafe Deserialization in Zumba Json Serializer

Improper File Access Control via Path Handling

Improper Privilege Management in Formwork CMS Account

Improper Authentication / SSO Logic Flaw in Sentry

Cross-Site Scripting (Stored XSS) in Statamic HTML

Code Injection / Improper Input Neutralization

Environment Variable Injection / Configuration Injection

Path Traversal in GetSimple CMS Uploaded Files Feature

Server-Side Request Forgery (SSRF) in OpenSift URL Ingest

XSS in OpenSift Chat and Study Content Rendering

Information Exposure in GetSimple CMS Data and Backup

Authentication and TLS Certificate Validation

Default Credentials (CWE-798) in MLflow Auth System

Directory Traversal / Path Traversal in MLflow Tracking

OS Command Injection in thesystem run_command Endpoint

SQL Injection in Part-DB Login Mechanism

SQL Injection in Blue-Smiley-Organizer datetime Parameter

Unrestricted File Upload in Chamilo LMS elFinder

Authorization Bypass / Incorrect Authorization

Command Injection in Deno node:child_process Implementation

XSS via Entity Shadowing (CWE-79) in fast-xml-parser

Unsafe Deserialization in openITCOCKPIT Changelog Processing

Stored XSS (CWE-79) in Vertex AI evals visualization

Improper Input Validation / Path Handling in ADB Explorer

Unsafe Deserialization in openITCOCKPIT Gearman Worker

SQL Injection in Registration Component of Simple

Local File Inclusion (LFI) in OpenSourcePOS Sales Invoice

Improper Privilege Management in Print Shop Pro WebDesk

XSS in Key Systems Global Facilities Management Software

XSS in Key Systems Global Facilities Management Software

Improper Privilege Management in Key Systems Global

Missing Authentication for Critical Functionality

Missing Authentication in Industrial Device

Cleartext Transmission of Sensitive Information

Authentication and Authorization Bypass in Smanga

OS Command Injection in UTT HiPER 520 Web Management

OS Command Injection in UTT HiPER 520 Web Management

OS Command Injection in EnOcean SmartServer IoT IP-852

OS Command Injection in Smanga rescan.php Media Scanner

SQL Injection in Fujian Smart Integrated Management

SQL Injection in Fujian Smart Integrated Management

SQL Injection in LibreNMS Address Search

SQL Injection in LibreNMS ajax_table.php IPv6 Search

SQL Injection in Ghost CMS

Path Traversal in node-tar Extraction Defaults

Path Traversal in Calibre PDB Readers Enables Arbitrary

Path Traversal in Calibre extract_pictures Arbitrary File

Path Traversal and Arbitrary File Write in Music Assistant

Prompt Injection / Command Injection via Control Characters

Authorization Bypass / Improper Access Control

Server-Side Request Forgery (SSRF) in OpenClaw

Command Injection in OpenClaw Contributor Maintenance Script

Server-Side Request Forgery (SSRF) in OpenClaw Gateway Tool

Path Traversal / Arbitrary File Read in OpenClaw Feishu

Missing Authentication / Authorization in OpenClaw Voice

CSRF in OpenClaw Browser Control Plane

Improper Authentication in OpenClaw BlueBubbles Webhook

Side-Channel / Information Exposure through Observable

Improper Input Validation in go-ethereum (geth)

SSRF in SillyTavern Asset Download Endpoint

Cross-Site Scripting (XSS) in Fabric.js JSON-to-SVG Export

Command Injection in systeminformation versions() Utility

OS Command Injection in systeminformation wifiNetworks()

XML Entity Expansion / Denial of Service in fast-xml-parser

Arbitrary File Read / Path Traversal in Penpot

Cross-Site Scripting (XSS) in Open WebUI Chat History

XSS in Open WebUI Chat Citation Rendering

Hardcoded Credentials in Ruckus Network Director OVA

Code Injection in Semantic Kernel InMemoryVectorStore Filter

Broken Access Control in Pterodactyl Wings Node Server

Improper Output Neutralization in jsPDF AcroForm PDF Object

Code Injection in jsPDF PDF Generation

SSRF in SoftVision webPDF PDF Converter

SQL Injection in Event Management System manage_register.php

SQL Injection in Event Management System Admin Login

SQL Injection in Event Management System manage_booking.php

Missing Authorization in Gogs Git Service

Access Control Bypass in Gogs Protected Branch Deletion

OS Command Injection in SECCN Dingcheng G10 session_login

Unrestricted File Upload in Tsinghua Unigroup Electronic

Remote Code Execution via Local File Inclusion and Log

OS Command Injection in Advantech WISE-6610 Background

Missing Authorization in MajorDoMo Market Module

SQL Injection in MajorDoMo Commands Module

Stored XSS in MajorDoMo Shoutbox Method Handling

Stored XSS in MajorDoMo Property Handling

OS Command Injection in MajorDoMo rc/index.php Execution

Code Injection in MajorDoMo Admin PHP Console

Improper Access Control in Rongzhitong Visual Integrated

Open Redirect / Token Leakage in GitHub Enterprise Server

Path Traversal in InvoicePlane Guest File Retrieval

Directory Traversal / Path Traversal in Rack::Directory

Broken Access Control / Privilege Escalation in PHPGurukul

SQL Injection in Community Project Scholars Tracking System

Unrestricted File Upload in Scholars Tracking System

Missing Authorization in CodeAstro Membership Management

Missing Authorization / Insecure Direct Object Reference

SQL Injection in CodeAstro Membership Management System

Missing Authentication / Authorization in ProjectWorlds

Missing Authentication / Authorization in ProjectWorlds

Broken Access Control in SourceCodester Customer Support

OS Command Injection in ZoneMinder image.php View

Stored XSS in Rent Fetch WordPress Plugin 'keyword'

Missing Authentication

OS Command Injection in node-sonos-http-api TTS Provider

SQL Injection in Sciyon Koyuan Thermoelectricity Heat

SQL Injection in Huace Monitoring and Early Warning System

XSS in lty628 aidigu Password Management Page

SQL Injection in Jorani alldayoffs Feature via entity

SQL Injection in phpgurukul Student Management System

Server-Side Template Injection (SSTI) in Datart Freemarker

OS Command Injection in Datart JDBC Configuration

Improper Certificate Validation in Guardian Gryphon Command

Hard-Coded Authentication Credentials in Beetel 777VR1 Web

OS Command Injection in Wavlink WL-NU516U1 Firewall CGI

Cross-Site Scripting (XSS) and Data Exposure in VS Code

Code Injection in VS Code Extension Markdown Preview

Code Injection in VS Code Code Runner Extension

Missing Authentication in Nanobot WhatsApp Bridge

Unrestricted File Upload in EFM ipTIME A6004MX VPN Client

Improper Access Control in BookController of LibrarySystem

OS Command Injection in LuLu UI run.js child_process.exec

Injection in directorytree/imapengine id() Function

Broken Authentication in Known Social Publishing Platform

Incorrect Access Control in LavaLite CMS Admin Backend

Unsafe Deserialization in ADB Explorer Settings Handling

Missing Authentication in Milvus Management Port

Path Traversal in lakeFS Local Block Adapter Storage

SSRF in Tandoor Recipes Cookmate Import

Path Traversal in BACnet Stack File Writing Functionality

Path Traversal / Zip Slip in MojoPortal CMS Skin Upload

Improper Authorization / Access Control in Cursor AI Code

Improper Input Validation in free5GC UPF PFCP Association

Command Injection in OpenSourcePOS

Information Exposure in Scraparr Readarr Integration

Command Injection in emp3r0r C2 Agent Metadata Handling

Code Injection in Yoke Air Traffic Controller

Missing Authentication / Broken Access Control

Unrestricted File Upload in Airleader Master Web Interface

Improper Authorization / Access Control in AutoGPT Graph

Authentication and Signature Validation Weakness

Improper Authorization in LavinMQ Policymaker Role

Authentication Bypass in authentik Proxy Provider Forward

Code Injection in authentik Delegated Permissions

Session Management Vulnerability in FrankenPHP Worker Mode

SQL Injection in thesystem App Authentication Username

SQL Injection in TheSystem Authentication server_name

Cryptographic Weakness in Password Storage in newbee-mall

Use of Hard-Coded Credentials in newbee-mall Initialization

SQL Injection in CordysCRM Employee List Interface

Local File Inclusion in Crawl4AI Docker API Endpoints

Code Injection in Crawl4AI Docker API /crawl Endpoint

CSRF in Dolibarr ERP & CRM perms.php Notes Field

Improper Resource Access Control in Keras Model Loading

Command Injection in sf-mcp-server Salesforce CLI

Broken Access Control / Privilege Management in OpenMetadata

Improper Access Control in Klaw Kafka Governance Portal

Authorization Bypass in Kanboard Plugin Installation Leads

Stored Cross-Site Scripting (XSS) in Statamic Content Titles

Privilege Escalation in Outline Membership Management

Directory Traversal in Voyager Admin Asset Endpoint

Code Injection in Chevereto Core

Cross-Site Scripting and Command Injection in ASTPP SIP

Information Exposure in Statping-ng 0.91.0

Information Exposure in Statping-ng Monitoring Endpoints

Code Injection / Unsafe Serialization in DiskCache

Directory Traversal in OpenSatKit FileUtil_GetFileInfo

Improper Certificate Validation in SunbirdEd Portal HTTP

Path Traversal in nanotar Archive Extraction Routines

OS Command Injection in Pacom Unison Client Report Templates

Authentication Bypass in ZLAN5143D

Missing Authentication for Critical Function in Device

OS Command Injection in Catalyst Server Templates

SQL Injection in EverShop Category Event Handling

Path Traversal / Improper Path Restriction in SiYuan getFile

SQL Injection in Worklenz Project and Task Management

Denial of Service via Unhandled Exception in Emmett Request

Cross-Site Scripting (XSS) in Docmost Public Share Pages

OS Command Injection in D-Link DCS-931L setSysAdmin

Path Traversal in FUXA SCADA/HMI File Handling

Missing Authorization in FUXA Scheduler Management

Authentication Bypass in FUXA Node-RED Plugin

Path Traversal File Write in FUXA SCADA/HMI Server

Authentication Bypass / Broken Access Control

Insecure Software Update Mechanism in SumatraPDF Updater

Unsafe Deserialization in PowerDocu Flow/App Package Parsing

Unrestricted File Upload and Unsafe Deserialization

Improper Input Validation in Adminer Version Check Endpoint

Authorization Bypass via Path Normalization Error

Authentication and Authorization Failures in PolarLearn

Improper Authorization in PlaciPy Placement Management

Injection / Improper Neutralization of Input in PlaciPy

CSRF in PlaciPy Placement Management System

Improper Authorization in PlaciPy Placement Management

Missing Authorization in Hollo Federated Microblogging

Remote Command Injection / Improper Authentication

Missing Authorization / Access Control in PlaciPy Results

Missing Authorization / Access Control in PlaciPy Student

Improper Authorization in PlaciPy Assessment Code

Improper Authentication and Resource Exhaustion

Command Injection in GitHub Super-Linter Action

Broken Authorization / Insecure Direct Object Reference

SQL Injection in Craft CMS element-indexes/get-elements

Missing Authorization / Access Control in FileRise Web File

Path Traversal in MarkUs Assignment Configuration Import

SQL Injection in itsourcecode News Portal Project

SQL Injection in code-projects Online Reviewer System

SQL Injection in code-projects Online Reviewer System Login

SQL Injection in Online Reviewer System btn_functions.php

SQL Injection in Event Management System manage_user.php

Code Injection in jsonpath

SQL Injection in Admin Category Editing of Online Music

SQL Injection in Online Music Site 1.0 Admin Category

OS Command Injection in D-Link DIR-823X set_filtering

SQL Injection in user-delete.php of Online Reviewer System

SQL Injection in Online Reviewer System 1.0

SQL Injection in Online Reviewer System exam-delete.php

SQL Injection in Online Reviewer System exam-update.php

SQL Injection in Online Reviewer System Pretest Question

SQL Injection in School Management System controller.php

SQL Injection in itsourcecode School Management System

OS Command Injection in UTT 进取 521G formPdbUpConfig

OS Command Injection in csv.php of Certificate Generation

OS Command Injection in UTT 进取 521G setSysAdm

Session Management Vulnerability in SourceCodester Prison

OS Command Injection in D-Link DIR-823X set_upnp Handler

SQL Injection in Login Component of Online Reviewer System

Missing Authentication in detronetdip E-commerce 1.0.0

Unrestricted File Upload in detronetdip E-commerce

SQL Injection in Directory Management System Forgot

SQL Injection in Student Web Portal /check_user.php

OS Command Injection in D-Link DIR-823X Static Route

OS Command Injection in D-Link DIR-823X Configuration

OS Command Injection in D-Link DIR-823X DDNS Service

OS Command Injection in D-Link DIR-823X QoS Configuration

SQL Injection in Online Food Ordering System

Unrestricted File Upload in code-projects Online Music Site

SQL Injection in Admin Category Update of Online Music Site

OS Command Injection in D-Link DIR-823X set_ac_status

OS Command Injection in D-Link DIR-823X Configuration

Command Injection in UTT HiPER 810 rehttpd

SQL Injection in Society Management System edit_activity.php

SQL Injection in Society Management System edit_expenses.php

SQL Injection in Society Management System

SQL Injection in itsourcecode Society Management System

Missing Authorization in Wekan Migration Functionality

Insecure Direct Object Reference (IDOR) in WeKan Checklist

Insecure Direct Object Reference (IDOR) in WeKan Checklist

Authorization Logic Flaw in WeKan Attachment Upload API

LDAP Injection in WeKan LDAP Authentication

Unsafe Deserialization in tpadmin WebUploader preview.php

SQL Injection in SourceCodester Online Class Record System

SQL Injection in controller.php of Online Class Record

SQL Injection in PHPGurukul Beauty Parlour Management System

SQL Injection in login.php of Online Class Record System

Command Injection in D-Link DWR-M921 USSD Configuration

OS Command Injection in D-Link DIR-823X set_language

SQL Injection in delete_post.php of Social Networking Site

OS Command Injection in UTT HiPER 810 formUser

SQL Injection in School Management System index.php

SQL Injection in eLection 2.0 Candidate Management Endpoint

SQL Injection in ATutor Admin User Deletion Functionality

Network Policy Enforcement Error in Antrea Kubernetes

Hard-Coded Credentials / Default Passwords in 3DP-MANAGER

Improper Certificate Validation / TLS Downgrade

OS Command Injection in OpenProject Repository Changes

Insecure Direct Object Reference (IDOR) in Spree Guest

Path Traversal in NiceGUI FileUpload.name

SQL Injection in Payload CMS JSON and richText Query

OS Command Injection in BeyondTrust Remote Support and

Path Traversal in Calibre EPUB Conversion CipherReference

Path Traversal in Calibre CHM Reader Enables Arbitrary File

Unsafe Deserialization in EPyT-Flow Custom Loader

Improper File Path Handling in Qdrant Vector Database

Command Injection in OpenClaw Gateway WebSocket API

Path Traversal File Write in Semantic Kernel

SSRF in Pydantic AI URL Download Functionality

OS Command Injection in Frigate go2rtc Stream Configuration

Client-Side Code Injection via Path Traversal

Code Injection / Sandbox Escape in SandboxJS SAFE_PROTOTYPES

Prototype Pollution / Injection in SandboxJS Property

Sandbox Escape / Code Injection in SandboxJS

Hard-Coded Credentials in PlaciPy Student Account Creation

Missing Authorization / Access Control in FUXA SCADA/HMI

Information Disclosure / Broken Access Control

Information Exposure in MCP Salesforce Connector

Authorization Bypass / Improper Access Control

SQL Injection in OpenSTAManager ajax_select.php componenti

OS Command Injection in OpenSTAManager P7M File Decoding

SQL Injection in editcampaignform.php of Simple Blood Donor

Access Control Bypass via Symbolic Links in Claude Code

Improper Input Validation in Claude Code Directory

Improper Authorization in OpenFGA Check Evaluation

Path Traversal in Gogs Wiki updateWikiPage Enables

Sensitive Information Exposure in Gophish Admin Dashboard

Improper Authentication in Gogs 2FA Recovery Code Validation

SQL Injection in SourceCodester Medical Center Portal

SQL Injection in CloudClassroom Post Query Details Page

OS Command Injection in Gogs Git Service

SQL Injection in TheJshen ContentManagementSystem

SQL Injection in Globitek CMS 1.4

SQL Injection in RimbaLinux AhadPOS alamatCustomer Parameter

SQL Injection in html5_snmp

SQL Injection in Medical Center Portal Management System

SQL Injection in School Management System controller.php

SQL Injection in Student Management System Billing Module

SQL Injection in Student Management System index.php

SQL Injection in Student Management System index.php

SQL Injection in Student Management System

SQL Injection in Fortinet FortiClientEMS HTTP Request

Improper Input Validation in ingress-nginx

Authorization Bypass in pgAdmin Server Mode

Code Injection in ChestnutCMS Template Creation Function

Unrestricted File Upload in Monstra CMS Files Manager Plugin

Path Traversal in My Text Editor Internal Storage Handler

XSS in Axigen Mail Server WebAdmin Interface

OS Command Injection in Pinger ping.php Parameters

CSRF in Axigen WebAdmin Interface

Improper Access Control in Axigen WebAdmin SSL Certificate

SSRF in AutoGPT Discord File Sending Component

SSRF in AutoGPT RSSFeedBlock URL Handling

Path Traversal in NavigaTUM propose_edits Endpoint

OS Command Injection in Godot MCP executeOperation Handler

Path Traversal File Write in SiYuan copyFile Allows

Missing Authorization in Devtron Attributes API

Improper Access Control in OpenSlides SAML-Linked Local

OS Command Injection in Group-Office

Path Traversal / Insecure Authorization Configuration

SQL Injection in FacturaScripts CodeModel::all()

SQL Injection in FacturaScripts REST API

Authentication and Cryptographic Key Management Weakness

Code Injection in Langroid TableChatAgent

Path Traversal in Alist File Operation Handlers

Improper Certificate Validation in Alist Storage Drivers

OS Command Injection in OpenClaw sshNodeCommand and SSH

OS Command Injection in melange Patch Pipeline

Command Injection in Melange Pipelines

Path Traversal in Melange Workspace Retrieval

Path Traversal in apko dirFS Filesystem Abstraction

Command Injection in n8n Community Package Installation

SQL Injection in OpenSTAManager Stampe Module

SQL Injection in OpenSTAManager ajax_complete.php get_sedi

Path Traversal in Unstructured partition_msg Attachment

Unrestricted File Upload / Arbitrary File Write

Path Traversal / Arbitrary File Write in n8n Workflows

OS Command Injection in n8n Git Node Workflow Actions

Information Disclosure via Uninitialized Memory

Path Traversal / Arbitrary File Overwrite in Comic Book

Missing Authentication in Synectix LAN 232 TRIO

Improper Input Validation in ingress-nginx Ingress Path

Missing Authentication in MOMA Seismic Station

Improper Input Validation in ingress-nginx Auth Method

Arbitrary Code Execution / Remote Code Execution

SQL Injection in Victor CMS post.php 'post' Parameter

Unrestricted File Upload in Victor CMS Admin Image Handler

XSS in Victor CMS Comment Author Field

SQL Injection in OXID eShop

OS Command Injection in Claude Code Agentic Tool

Improper URL/Domain Validation in Claude Code WebFetch

SQL Injection in Fikir Odalari AdminPando Login

SQL Injection in PEAR <version> Endpoint

SQL Injection in PEAR user::maintains() Role Filtering

SQL Injection in PEAR API Documentation Queue Insertion

SQL Injection in PEAR Bug Subscription Deletion

SQL Injection in PEAR Karma Queries

SQL Injection in PEAR Category Deletion Workflow

Command Injection in Ziroom ZHOME A0101 Router API

Insecure Direct Object Reference (IDOR) in Open eClass

Cross-Site Scripting (XSS) in Open eClass User Profiles

XSS in Open eClass Assignment Submissions

Sensitive Configuration Exposure in Dokans Multi-Tenancy

Unsafe Deserialization in Boltz Molecule Loader

Code Injection in FUXA Project Import Functionality

Unrestricted File Upload in FUXA upload Endpoint

Hard-Coded Credentials in FUXA Authentication Helper

Insecure Default Configuration in FUXA

Improper Privilege Management in Quick Heal Total Security

Arbitrary File Upload in FPDF AddFont() Function

SQL Injection in Shandong Kede IoT Smart Water Meter

Unrestricted File Upload in MediaCrush /upload Endpoint

Insecure Authorization / Permission Management

SQL Injection in YouDataSum CPAS Audit Management System

SSRF in Tiny File Manager URL Upload Feature

Information Exposure Through Side-Channel in PolarLearn

CSRF in PolarLearn GitHub/Google Authentication

Code Injection / Sandbox Escape in SandboxJS JavaScript

Missing Authentication / Access Control in NixOS Odoo

Path Traversal in OpenList Frontend File Operation Handlers

Command Injection in OpenClaw Docker Sandbox

Improper Output Neutralization / Injection in jsPDF

Stored XSS in FacturaScripts History Observations Field

OS Command Injection in Signal K Server set-system-time

Cleartext Sensitive Information Exposure in Amazon

Path Traversal and Unrestricted File Upload in Wildfire IM

Missing Access Control in lollms_generation_events

OS Command Injection in RaspAP raspap-webgui

Improper Authentication in ipTIME A8004T Hiddenloginsetup