Vuldb Updates

A vulnerability identified as problematic has been detected in YiFang CMS up to 2.0.5. This impacts the function update of the file app/db/admin/D_friendLinkGroup.php of the component Extended Management Module. The manipulation of the argument Name leads to cross site scripting. This vulnerability is traded as CVE-2026-2934. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability described as critical has been identified in UTT HiPER 810G up to 1.7.7-171114. This issue affects the function strcpy of the file /goform/ConfigExceptMSN. Executing a manipulation of the argument remark can lead to buffer overflow. This vulnerability is handled as CVE-2026-2935. The attack can be executed remotely. Additionally, an exploit exists.

A vulnerability marked as critical has been reported in SourceCodester Student Result Management System 1.0. The affected element is an unknown function of the file /srms/script/admin/core/update_smtp.php. The manipulation leads to improper access controls. This vulnerability is traded as CVE-2026-2938. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability described as problematic has been identified in itsourcecode Student Management System 1.0. The impacted element is an unknown function of the file /add_student/ of the component Add Student Module. The manipulation results in cross site scripting. This vulnerability is known as CVE-2026-2939. It is possible to launch the attack remotely. Furthermore, an exploit is available.

A vulnerability classified as critical has been found in Zaher1307 tiny_web_server up to 8d77b1044a0ca3a5297d8726ac8aa2cf944d481b. This affects the function tiny_web_server/tiny.c of the file tiny_web_server/tiny.c of the component URL Handler. This manipulation causes out-of-bounds write. This vulnerability is handled as CVE-2026-2940. The attack can be initiated remotely. Additionally, an exploit exists. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability classified as problematic was found in SapneshNaik Student Management System up to f4b4f0928f0b5551a28ee81ae7e7fe47d9345318. This impacts an unknown function of the file index.php. Such manipulation of the argument Error leads to cross site scripting. This vulnerability is uniquely identified as CVE-2026-2943. The attack can be launched remotely. Moreover, an exploit is present. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. The vendor was contacted early about this disclosure but did not respond in any way.

A vulnerability categorized as critical has been discovered in The Plus Addons for Elementor Plugin up to 6.4.7 on WordPress. The affected element is an unknown function of the component AJAX Handler. Executing a manipulation of the argument email_data can lead to insufficient verification of data authenticity. This vulnerability is registered as CVE-2026-2385. It is possible to launch the attack remotely. No exploit is available.

A vulnerability described as critical has been identified in UTT HiPER 810G 1.7.7-171114. This affects the function strcpy of the file /goform/ConfigExceptAli. Executing a manipulation can lead to buffer overflow. This vulnerability is tracked as CVE-2026-2904. The attack can be launched remotely. Moreover, an exploit is present.

A vulnerability classified as critical has been found in Tenda HG9 300001138. This impacts an unknown function of the file /boaform/formWlanSetup of the component Wireless Configuration Endpoint. The manipulation of the argument ssid leads to stack-based buffer overflow. This vulnerability is listed as CVE-2026-2905. The attack may be initiated remotely. In addition, an exploit is available.

A vulnerability classified as critical was found in Tenda HG9 300001138. Affected is an unknown function of the file /boaform/formSamba of the component Samba Configuration Endpoint. The manipulation of the argument sambaCap results in stack-based buffer overflow. This vulnerability is cataloged as CVE-2026-2906. The attack may be launched remotely. Furthermore, there is an exploit available.

A vulnerability, which was classified as critical, has been found in Tenda HG9 300001138. Affected by this vulnerability is an unknown functionality of the file /boaform/formgponConf of the component GPON Configuration Endpoint. This manipulation of the argument fmgpon_loid/fmgpon_loid_password causes stack-based buffer overflow. This vulnerability is registered as CVE-2026-2907. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

A vulnerability, which was classified as critical, was found in Tenda HG9 300001138. Affected by this issue is some unknown functionality of the file /boaform/formLoopBack of the component Loopback Detection Configuration Endpoint. Such manipulation of the argument Ethtype leads to stack-based buffer overflow. This vulnerability is documented as CVE-2026-2908. The attack can be executed remotely. Additionally, an exploit exists.

A vulnerability has been found in Tenda HG9 300001138 and classified as critical. This affects an unknown part of the file /boaform/formPing of the component Diagnostic Ping Endpoint. Performing a manipulation of the argument pingAddr results in stack-based buffer overflow. This vulnerability is reported as CVE-2026-2909. The attack is possible to be carried out remotely. Moreover, an exploit is present.

A vulnerability was found in Tenda HG9 300001138 and classified as critical. This vulnerability affects unknown code of the file /boaform/formPing6. Executing a manipulation of the argument pingAddr can lead to stack-based buffer overflow. This vulnerability appears as CVE-2026-2910. The attack may be performed from remote. In addition, an exploit is available.

A vulnerability was found in Tenda FH451 up to 1.0.0.9. It has been classified as critical. This issue affects some unknown processing of the file /goform/GstDhcpSetSer. The manipulation leads to buffer overflow. This vulnerability is traded as CVE-2026-2911. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability was found in code-projects Online Reviewer System 1.0. It has been declared as critical. Impacted is an unknown function of the file /system/system/students/assessments/results/studentresult-view.php. The manipulation of the argument test_id results in sql injection. This vulnerability is known as CVE-2026-2912. It is possible to launch the attack remotely. Furthermore, an exploit is available.

A vulnerability, which was classified as critical, has been found in D-Link DWR-M960 1.01.07. Affected by this issue is the function sub_42B5A0 of the file /boafrm/formBridgeVlan of the component Bridge VLAN Configuration Endpoint. Performing a manipulation of the argument submit-url results in stack-based buffer overflow. This vulnerability is identified as CVE-2026-2925. The attack can be initiated remotely. Additionally, an exploit exists.

A vulnerability, which was classified as critical, was found in D-Link DWR-M960 1.01.07. This affects the function sub_4237AC of the file /boafrm/formLteSetup of the component LTE Configuration Endpoint. Executing a manipulation of the argument submit-url can lead to stack-based buffer overflow. This vulnerability is tracked as CVE-2026-2926. The attack can be launched remotely. Moreover, an exploit is present.

A vulnerability has been found in D-Link DWR-M960 1.01.07 and classified as critical. This vulnerability affects the function sub_462590 of the file /boafrm/formOpMode of the component Operation Mode Configuration Endpoint. The manipulation of the argument submit-url leads to stack-based buffer overflow. This vulnerability is listed as CVE-2026-2927. The attack may be initiated remotely. In addition, an exploit is available.

A vulnerability identified as problematic has been detected in skvadrik re2c up to 4.4. Impacted is the function check_and_merge_special_rules of the file src/parse/ast.cc. This manipulation causes null pointer dereference. The identification of this vulnerability is CVE-2026-2903. The attack can only be executed locally. Furthermore, there is an exploit available. It is suggested to install a patch to address this issue.