Aggregator

甚至还出了一道ctf的题目

A vulnerability labeled as critical has been found in Great Developers Certificate Generation System up to 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73. This vulnerability affects unknown code of the file /restructured/csv.php. The manipulation of the argument photo results in os command injection. This vulnerability is identified as CVE-2026-2184. The attack can be executed remotely. There is not any exploit available. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The code repository of the project has not been active for many years.

A vulnerability identified as critical has been detected in Great Developers Certificate Generation System up to 97171bb0e5e22e52eacf4e4fa81773e5f3cffb73. This affects an unknown part of the file /restructured/csv.php. The manipulation leads to unrestricted upload. This vulnerability is referenced as CVE-2026-2183. Remote exploitation of the attack is possible. No exploit is available. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The code repository of the project has not been active for many years.

Submit #749715 / VDB-344888

A vulnerability categorized as critical has been discovered in UTT 进取 521G 3.1.1-190816. Affected by this issue is the function doSystem of the file /goform/setSysAdm. Executing a manipulation of the argument passwd1 can lead to command injection. The identification of this vulnerability is CVE-2026-2182. The attack may be launched remotely. Furthermore, there is an exploit available.

Submit #749714 / VDB-344887

Submit #749713 / VDB-344886

A vulnerability was found in Tenda RX3 16.03.13.11. It has been rated as critical. Affected by this vulnerability is an unknown functionality of the file /goform/openSchedWifi. Performing a manipulation of the argument schedStartTime/schedEndTime results in stack-based buffer overflow. This vulnerability was named CVE-2026-2181. The attack may be initiated remotely. In addition, an exploit is available.

A vulnerability was found in Tenda RX3 16.03.13.11. It has been declared as critical. Affected is an unknown function of the file /goform/fast_setting_wifi_set. Such manipulation of the argument ssid_5g leads to stack-based buffer overflow. This vulnerability is uniquely identified as CVE-2026-2180. The attack can be launched remotely. Moreover, an exploit is present.

Submit #749712 / VDB-344885

A vulnerability was found in PHPGurukul Hospital Management System 4.0. It has been classified as critical. This impacts an unknown function of the file /admin/manage-users.php. This manipulation of the argument ID causes sql injection. This vulnerability is handled as CVE-2026-2179. The attack can be initiated remotely. Additionally, an exploit exists.

Submit #749710 / VDB-344884

Submit #749703 / VDB-344883

A vulnerability was found in r-huijts xcode-mcp-server up to f3419f00117aa9949e326f78cc940166c88f18cb and classified as critical. This affects the function registerXcodeTools of the file src/tools/xcode/index.ts of the component run_lldb. The manipulation of the argument args results in command injection. This vulnerability is known as CVE-2026-2178. It is possible to launch the attack remotely. Furthermore, an exploit is available. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. Applying a patch is advised to resolve this issue.

Submit #749592 / VDB-344882

A vulnerability has been found in SourceCodester Prison Management System 1.0 and classified as critical. The impacted element is an unknown function of the component Login. The manipulation leads to session fixiation. This vulnerability is traded as CVE-2026-2177. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

Submit #749569 / VDB-344881

A new state-aligned cyberespionage threat group tracked as TGR-STA-1030/UNC6619, has conducted a global-scale operation dubbed the "Shadow Campaigns," where it targeted government infrastructure in 155 countries. [...]

Submit #749485 / VDB-344880

A vulnerability, which was classified as critical, was found in JAY Login & Register Plugin up to 2.6.03 on WordPress. The affected element is the function jay_panel_ajax_update_profile. Executing a manipulation can lead to improper privilege management. This vulnerability appears as CVE-2025-15100. The attack may be performed from remote. There is no available exploit.