rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-1506 D-Link DIR-615 MAC Filter Configuration adv_mac_filter.php os command injection
A vulnerability was determined in D-Link DIR-615 4.10. Impacted is an unknown function of the file /adv_mac_filter.php of the component MAC Filter Configuration. This manipulation of the argument mac causes os command injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized. This vulnerability only affects products that are no longer supported by the maintainer.
Problem types: cwe_id: CWE-78
description: OS Command Injection
cwe_id: CWE-77
description: Command Injection
Affected products: vendor: D-Link
product: DIR-615
CVSS v3.1: version: 3.1
baseScore: 7.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: Zephyr369 (VulDB User)
Published: 2026-01-28T02:32:09.027Z
CVE-2026-1507 Uncaught Exception vulnerability in AVEVA PI Data Archive
The affected products are vulnerable to an uncaught exception that could allow an unauthenticated attacker to remotely crash core PI services resulting in a denial-of-service.
Problem types: cwe_id: CWE-248
description: CWE-248 Uncaught Exception
Affected products: vendor: AVEVA
product: PI Data Archive PI Server
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2026-02-10T20:19:18.886Z
CVE-2026-1508 Court Reservation < 1.10.9 - Event Deletion via CSRF
The Court Reservation  WordPress plugin before 1.10.9 does not have CSRF check in place when deleting events, which could allow attackers to make a logged in admin delete them via a CSRF attack
Problem types: description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Court Reservation
default_status: unaffected
Credits: lang: en
value: Bob Matyas
lang: en
value: WPScan
Published: 2026-03-10T06:00:06.715Z
CVE-2026-1509 Avada (Fusion) Builder <= 3.15.1 - Authenticated (Subscriber+) Limited Arbitrary WordPress Action Execution
The Avada (Fusion) Builder plugin for WordPress is vulnerable to Arbitrary WordPress Action Execution in all versions up to, and including, 3.15.1. This is due to the plugin's `output_action_hook()` function accepting user-controlled input to trigger any registered WordPress action hook without proper authorization checks. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary WordPress action hooks via the Dynamic Data feature, potentially leading to privilege escalation, file inclusion, denial of service, or other security impacts depending on which action hooks are available in the WordPress installation.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: themefusion
product: Avada (Fusion) Builder
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
baseScore: 5.4
baseSeverity: MEDIUM
Credits: lang: en
value: Craig Smith
Published: 2026-04-15T01:25:18.275Z
CVE-2026-1512 Essential Addons for Elementor <= 6.5.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Info Box Widget
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Info Box widget in all versions up to, and including, 6.5.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: wpdevteam
product: Essential Addons for Elementor – Popular Elementor Templates & Widgets
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: knani alaaeddine
Published: 2026-02-14T09:49:39.256Z
CVE-2026-1513 
billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart option binding.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: NAVER
product: billboard.js
default_status: affected
Credits: lang: en
value: Jesper den Boer
Published: 2026-01-28T01:28:23.567Z
CVE-2026-1514 2100 Technology｜Official Document Management System - Incorrect Authorization
Official Document Management System developed by 2100 Technology has a Incorrect Authorization vulnerability, allowing authenticated remote attackers to modify front-end code to read all official documents.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: 2100 Technology
product: Official Document Management System
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2026-01-28T03:39:56.271Z
CVE-2026-1516 Improper Control of Generation of Code ('Code Injection') in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 18.0.0 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that in Code Quality reports could have allowed an authenticated user to leak IP addresses of users viewing the report via specially crafted content.
Problem types: cwe_id: CWE-94
description: CWE-94: Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: GitLab
product: GitLab
cpes: cpe:2.3:a:gitlab:gitlab:*:*:*:*:*:*:*:*
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
Credits: lang: en
value: Thanks [maksyche](https://hackerone.com/maksyche) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2026-04-08T22:25:57.848Z
CVE-2026-1517 iomad Company Admin Block sql injection
A vulnerability was identified in iomad up to 5.0. Affected is an unknown function of the component Company Admin Block. Such manipulation leads to sql injection. The attack can be executed remotely. It is best practice to apply a patch to resolve this issue.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: n/a
product: iomad
CVSS v3.1: version: 3.1
baseScore: 4.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: Vaibhav Gupta (Appfend Technologies Limited)
lang: en
value: VulDB GitHub Analyzer
Published: 2026-02-05T12:02:06.834Z
CVE-2026-1518 Keycloak: blind server-side request forgery (ssrf) via ciba backchannel notification endpoint in keycloak
A flaw was found in Keycloak’s CIBA feature where insufficient validation of client-configured backchannel notification endpoints could allow blind server-side requests to internal services.
Problem types: cwe_id: CWE-918
description: Server-Side Request Forgery (SSRF)
Affected products: vendor: Red Hat
product: Red Hat Build of Keycloak
cpes: cpe:/a:redhat:build_keycloak:
default_status: affected
vendor: Red Hat
product: Red Hat Build of Keycloak
cpes: cpe:/a:redhat:build_keycloak:
default_status: affected
vendor: Red Hat
product: Red Hat Build of Keycloak
cpes: cpe:/a:redhat:build_keycloak:
default_status: affected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 2.7
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Patrick Smith for reporting this issue.
Published: 2026-02-02T07:17:46.557Z
CVE-2026-1519 Excessive NSEC3 iterations cause high CPU load during insecure delegation validation
If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive queries (see: https://kb.isc.org/docs/why-does-my-authoritative-server-make-recursive-queries).
This issue affects BIND 9 versions 9.11.0 through 9.16.50, 9.18.0 through 9.18.46, 9.20.0 through 9.20.20, 9.21.0 through 9.21.19, 9.11.3-S1 through 9.16.50-S1, 9.18.11-S1 through 9.18.46-S1, and 9.20.9-S1 through 9.20.20-S1.
Problem types: cwe_id: CWE-606
description: CWE-606 Unchecked Input for Loop Condition
Affected products: vendor: ISC
product: BIND 9
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
baseScore: 7.5
baseSeverity: HIGH
Credits: lang: en
value: ISC would like to thank Samy Medjahed/Ap4sh for bringing this vulnerability to our attention.
Published: 2026-03-25T13:25:19.802Z
CVE-2026-1520 rethinkdb Secondary Index cross site scripting
A vulnerability was identified in rethinkdb up to 2.4.3. Affected by this issue is some unknown functionality of the component Secondary Index Handler. Such manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
cwe_id: CWE-94
description: Code Injection
Affected products: vendor: n/a
product: rethinkdb
CVSS v3.1: version: 3.1
baseScore: 2.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: 59lab (VulDB User)
Published: 2026-01-28T14:32:06.745Z
CVE-2026-1521 Open5GS SGWC s5c-handler.c denial of service
A security flaw has been discovered in Open5GS up to 2.7.6. This affects the function sgwc_s5c_handle_bearer_resource_failure_indication of the file src/sgwc/s5c-handler.c of the component SGWC. Performing a manipulation results in denial of service. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks. The patch is named 69b53add90a9479d7960b822fc60601d659c328b. It is recommended to apply a patch to fix this issue.
Problem types: cwe_id: CWE-404
description: Denial of Service
Affected products: vendor: n/a
product: Open5GS
cpes: cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: LinZiyu (VulDB User)
Published: 2026-01-28T14:32:10.348Z
CVE-2026-1522 Open5GS SGWC s5c-handler.c sgwc_s5c_handle_modify_bearer_response denial of service
A weakness has been identified in Open5GS up to 2.7.6. This vulnerability affects the function sgwc_s5c_handle_modify_bearer_response of the file src/sgwc/s5c-handler.c of the component SGWC. Executing a manipulation can lead to denial of service. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. This patch is called b19cf6a. Applying a patch is advised to resolve this issue. The issue report is flagged as already-fixed.
Problem types: cwe_id: CWE-404
description: Denial of Service
Affected products: vendor: n/a
product: Open5GS
cpes: cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: FrankyLin (VulDB User)
Published: 2026-01-28T16:32:07.267Z
CVE-2026-1523 Path Traversal in Digitek from Grupo Azkoyen
Path Traversal vulnerability in Digitek ADT1100 and Digitek DT950 from PRIMION DIGITEK, S.L.U (Azkoyen Group). This vulnerability allows an attacker to access arbitrary files in the server's file system, thet is, 'http://<host>/..%2F..% 2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd'. By manipulating the input to include URL encoded directory traversal sequences (e.g., %2F representing /), an attacker can bypass the input validation mechanisms ans retrieve sensitive files outside the intended directory, which could lead to information disclosure or further system compromise.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: PRIMION DIGITEK
product: Digitek ADT1100
default_status: unaffected
vendor: PRIMION DIGITEK
product: Digitek DT950
default_status: unaffected
Credits: lang: en
value: Óscar Atienza Vendrell
Published: 2026-02-05T13:16:30.583Z
CVE-2026-1524 Auth misconfiguration when multiple providers enabled
An edgecase in SSO implementation in Neo4j Enterprise edition versions prior to version 2026.02 can lead to unauthorised access under the following conditions:


If a neo4j admin configures two or more OIDC providers AND configures one or more of them to be an authorization provider AND configures one or more of them to be authentication-only, then those that are authentication-only will also provide authorization. This edgecase becomes a security problem only if the authentication-only provider contains groups which have higher privileges than provided by the intended (configured) authorization provider.  

When using multiple plugins for authentication and authorisation, prior to the fix the issue could lead to a plugin configured to provide only authentication or authorisation capabilities erroneously providing both capabilities. 

We recommend upgrading to versions 2026.02 (or 5.26.22) where the issue is fixed.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: neo4j
product: Enterprise Edition
default_status: unaffected
Published: 2026-03-11T16:16:35.346Z
CVE-2026-1525 undici is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Undici allows duplicate HTTP Content-Length headers when they are provided in an array with case-variant names (e.g., Content-Length and content-length). This produces malformed HTTP/1.1 requests with multiple conflicting Content-Length values on the wire.

Who is impacted:

  *  Applications using undici.request(), undici.Client, or similar low-level APIs with headers passed as flat arrays
  *  Applications that accept user-controlled header names without case-normalization


Potential consequences:

  *  Denial of Service: Strict HTTP parsers (proxies, servers) will reject requests with duplicate Content-Length headers (400 Bad Request)
  *  HTTP Request Smuggling: In deployments where an intermediary and backend interpret duplicate headers inconsistently (e.g., one uses the first value, the other uses the last), this can enable request smuggling attacks leading to ACL bypass, cache poisoning, or credential hijacking
Problem types: cwe_id: CWE-444
description: CWE-444 Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling')
Affected products: vendor: undici
product: undici
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: LOW
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Credits: lang: en
value: Matteo Collina
lang: en
value: Ulises Gascón
Published: 2026-03-12T19:56:55.092Z
CVE-2026-1526 undici is vulnerable to Unbounded Memory Consumption in undici WebSocket permessage-deflate Decompression
The undici WebSocket client is vulnerable to a denial-of-service attack via unbounded memory consumption during permessage-deflate decompression. When a WebSocket connection negotiates the permessage-deflate extension, the client decompresses incoming compressed frames without enforcing any limit on the decompressed data size. A malicious WebSocket server can send a small compressed frame (a "decompression bomb") that expands to an extremely large size in memory, causing the Node.js process to exhaust available memory and crash or become unresponsive.

The vulnerability exists in the PerMessageDeflate.decompress() method, which accumulates all decompressed chunks in memory and concatenates them into a single Buffer without checking whether the total size exceeds a safe threshold.
Problem types: cwe_id: CWE-409
description: CWE-409 Improper handling of highly compressed data (data amplification)
Affected products: vendor: undici
product: undici
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Credits: lang: en
value: Matteo Collina
lang: en
value: Ulises Gascón
lang: en
value: HO9
Published: 2026-03-12T20:08:05.950Z
CVE-2026-1527 undici is vulnerable to CRLF Injection via upgrade option
ImpactWhen an application passes user-controlled input to the upgrade option of client.request(), an attacker can inject CRLF sequences (\r\n) to:

  *  Inject arbitrary HTTP headers
  *  Terminate the HTTP request prematurely and smuggle raw data to non-HTTP services (Redis, Memcached, Elasticsearch)
The vulnerability exists because undici writes the upgrade value directly to the socket without validating for invalid header characters:

// lib/dispatcher/client-h1.js:1121
if (upgrade) {
  header += `connection: upgrade\r\nupgrade: ${upgrade}\r\n`
}
Problem types: cwe_id: CWE-93
description: CWE-93 Improper neutralization of CRLF sequences ('CRLF injection')
Affected products: vendor: undici
product: undici
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 4.6
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Credits: lang: en
value: Matteo Collina
lang: en
value: Ulises Gascón
lang: en
value: Raul Vega del Valle
Published: 2026-03-12T20:17:18.984Z
CVE-2026-1528 undici is vulnerable to Malicious WebSocket 64-bit length overflows undici parser and crashes the client
ImpactA server can reply with a WebSocket frame using the 64-bit length form and an extremely large length. undici's ByteParser overflows internal math, ends up in an invalid state, and throws a fatal TypeError that terminates the process.

Patches

Patched in the undici version v7.24.0 and v6.24.0. Users should upgrade to this version or later.
Problem types: cwe_id: CWE-248
description: CWE-248 Uncaught exception
cwe_id: CWE-1284
description: CWE-1284 Improper validation of specified quantity in input
Affected products: vendor: undici
product: undici
default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Credits: lang: en
value: Matteo Collina
lang: en
value: Ulises Gascón
Published: 2026-03-12T20:21:57.775Z
CVE-2026-1529 Org.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validation
A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verification allows the attacker to successfully self-register into an unauthorized organization, leading to unauthorized access.
Problem types: cwe_id: CWE-347
description: Improper Verification of Cryptographic Signature
Affected products: vendor: Red Hat
product: Red Hat build of Keycloak 26.2
cpes: cpe:/a:redhat:build_keycloak:26.2::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 26.2
cpes: cpe:/a:redhat:build_keycloak:26.2::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 26.2
cpes: cpe:/a:redhat:build_keycloak:26.2::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 26.2.13
cpes: cpe:/a:redhat:build_keycloak:26.2::el9
default_status: unaffected
vendor: Red Hat
product: Red Hat build of Keycloak 26.4
cpes: cpe:/a:redhat:build_keycloak:26.4::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 26.4
cpes: cpe:/a:redhat:build_keycloak:26.4::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 26.4
cpes: cpe:/a:redhat:build_keycloak:26.4::el9
default_status: affected
vendor: Red Hat
product: Red Hat build of Keycloak 26.4.9
cpes: cpe:/a:redhat:build_keycloak:26.4::el9
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Joy Gilbert (gwthr) and Reynaldo Immanuel for reporting this issue.
Published: 2026-02-09T18:36:15.077Z
CVE-2026-1532 D-Link DCS-700L Music File Upload Service setUploadMusic uploadmusic path traversal
A vulnerability was identified in D-Link DCS-700L 1.03.09. The affected element is the function uploadmusic of the file /setUploadMusic of the component Music File Upload Service. The manipulation of the argument UploadMusic leads to path traversal. The attack can only be initiated within the local network. The exploit is publicly available and might be used. This vulnerability only affects products that are no longer supported by the maintainer.
Problem types: cwe_id: CWE-22
description: Path Traversal
Affected products: vendor: D-Link
product: DCS-700L
CVSS v3.1: version: 3.1
baseScore: 2.4
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: tian (VulDB User)
Published: 2026-01-28T20:32:09.118Z
CVE-2026-1533 code-projects Online Music Site AdminAddCategory.php sql injection
A security flaw has been discovered in code-projects Online Music Site 1.0. The impacted element is an unknown function of the file /Administrator/PHP/AdminAddCategory.php. The manipulation results in sql injection. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: code-projects
product: Online Music Site
CVSS v3.1: version: 3.1
baseScore: 4.7
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: yu_ji (VulDB User)
Published: 2026-01-28T20:32:10.974Z