rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-4734 Heap Buffer Overflow in yoyofr/modizer
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in yoyofr modizer (libs/libopenmpt/openmpt-trunk/include/premake/contrib/curl/lib modules). This vulnerability is associated with program files imap.C‎.

This issue affects modizer: before v4.3.
Problem types: cwe_id: CWE-119
description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: yoyofr
product: modizer
default_status: affected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-03-24T03:05:39.360Z
CVE-2026-4735 A stack overflow and DoS vulnerability in DTStack/chunjun
Deserialization of Untrusted Data vulnerability in DTStack chunjun (‎chunjun-core/src/main/java/com/dtstack/chunjun/util modules). This vulnerability is associated with program files GsonUtil.Java.

This issue affects chunjun: before 1.16.1.
Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: DTStack
product: chunjun
default_status: affected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-03-24T03:08:18.156Z
CVE-2026-4736 Math Issue in No-Chicken/Echo-Mate
Improper Handling of Values vulnerability in No-Chicken Echo-Mate (SDK/rv1106-sdk/sysdrv/source/kernel/include/net/netfilter modules). This vulnerability is associated with program files nf_tables.H‎, nft_byteorder.C‎, nft_meta.C‎.

This issue affects Echo-Mate: before V250329.
Problem types: cwe_id: CWE-229
description: CWE-229 Improper Handling of Values
Affected products: vendor: No-Chicken
product: Echo-Mate
default_status: affected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-03-24T03:11:16.951Z
CVE-2026-4737 Use-After-Free Vulnerability in No-Chicken/Echo-Mate
Use After Free vulnerability in No-Chicken Echo-Mate (‎SDK/rv1106-sdk/sysdrv/source/kernel/mm modules). This vulnerability is associated with program files rmap.C‎.

This issue affects Echo-Mate: before V250329.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: No-Chicken
product: Echo-Mate
default_status: affected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-03-24T03:16:22.292Z
CVE-2026-4738 GDAL Bundled zlib (inftree9.c) Pointer Offset Optimization Undefined Behavior Allows Heap Corruption or Remote Code Execution
Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in OSGeo gdal (frmts/zlib/contrib/infback9 modules). This vulnerability is associated with program files inftree9.C‎.

This issue affects gdal: before 3.11.0.
Problem types: cwe_id: CWE-119
description: CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
Affected products: vendor: OSGeo
product: gdal
default_status: affected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-03-24T03:18:10.245Z
CVE-2026-4739 Integer overflow vulnerabilities in InsightSoftwareConsortium/ITK
Integer Overflow or Wraparound vulnerability in InsightSoftwareConsortium ITK (‎Modules/ThirdParty/Expat/src/expat modules).This issue affects ITK: before 2.7.1.
Problem types: cwe_id: CWE-190
description: CWE-190 Integer Overflow or Wraparound
Affected products: vendor: InsightSoftwareConsortium
product: ITK
default_status: affected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-03-24T03:19:28.818Z
CVE-2026-4740 Rhacm: open cluster management (ocm): cross-cluster privilege escalation via improper kubernetes client certificate renewal validation
A flaw was found in Open Cluster Management (OCM), the technology underlying Red Hat Advanced Cluster Management (ACM). Improper validation of Kubernetes client certificate renewal allows a managed cluster administrator to forge a client certificate that can be approved by the OCM controller. This enables cross-cluster privilege escalation and may allow an attacker to gain control over other managed clusters, including the hub cluster.
Problem types: cwe_id: CWE-295
description: Improper Certificate Validation
Affected products: vendor: Red Hat
product: Multicluster Engine for Kubernetes
cpes: cpe:/a:redhat:multicluster_engine
default_status: unknown
vendor: Red Hat
product: Multicluster Engine for Kubernetes
cpes: cpe:/a:redhat:multicluster_engine
default_status: unknown
vendor: Red Hat
product: Multicluster Engine for Kubernetes
cpes: cpe:/a:redhat:multicluster_engine
default_status: unknown
vendor: Red Hat
product: Multicluster Engine for Kubernetes
cpes: cpe:/a:redhat:multicluster_engine
default_status: unknown
vendor: Red Hat
product: Multicluster Engine for Kubernetes
cpes: cpe:/a:redhat:multicluster_engine
default_status: unknown
vendor: Red Hat
product: Multicluster Engine for Kubernetes
cpes: cpe:/a:redhat:multicluster_engine
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Red Hat would like to thank Arnaud FEVRIER (Orange) for reporting this issue.
Published: 2026-04-07T14:30:36.396Z
CVE-2026-4741 Path Traversal Vulnerability in TeamJCD/JoyConDroid
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TeamJCD JoyConDroid (app/src/main/java/com/rdapps/gamepad/util modules). This vulnerability is associated with program files UnzipUtil.Java‎.

This issue affects JoyConDroid: through 1.0.93.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: TeamJCD
product: JoyConDroid
default_status: affected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-03-24T03:22:36.755Z
CVE-2026-4742 HTTP Request Smuggling in visualfc/liteide
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in visualfc liteide (liteidex/src/3rdparty/qjsonrpc/src/http-parser modules). This vulnerability is associated with program files http_parser.C.

This issue affects liteide: before x38.4.
Problem types: cwe_id: CWE-444
description: CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products: vendor: visualfc
product: liteide
default_status: affected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-03-24T03:24:06.460Z
CVE-2026-4743 Null-Pointer Dereference Vulnerability in taurusxin/ncmdump
NULL Pointer Dereference vulnerability in taurusxin ncmdump (‎src/utils‎ modules). This vulnerability is associated with program files cJSON.Cpp‎.

This issue affects ncmdump: before 1.4.0.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: taurusxin
product: ncmdump
default_status: affected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-03-24T03:25:07.207Z
CVE-2026-4744 Notepad3 Bundled Oniguruma compile_string_node() Heap Buffer Overflow via Crafted Regex Pattern Allows Arbitrary Code Execution
Out-of-bounds Read vulnerability in rizonesoft Notepad3 (‎scintilla/oniguruma/src modules). This vulnerability is associated with program files regcomp.C‎.

This issue affects Notepad3: before 6.25.714.1.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: rizonesoft
product: Notepad3
default_status: affected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-03-24T03:26:11.751Z
CVE-2026-4745 Arbitrary Code Execution via Crafted Bytecode in dendibakh/perf-ninja
Improper Control of Generation of Code ('Code Injection') vulnerability in dendibakh perf-ninja (labs/misc/pgo/lua modules). This vulnerability is associated with program files ldo.C.

This issue affects perf-ninja.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: dendibakh
product: perf-ninja
default_status: affected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-03-24T03:27:30.756Z
CVE-2026-4746 Heap Buffer Over-Write Vulenrabilty in timeplus-io/proton
Out-of-bounds Write vulnerability in timeplus-io proton (base/poco/Foundation/src‎ modules). This vulnerability is associated with program files inflate.C.

This issue affects proton: before 1.6.16.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: timeplus-io
product: proton
default_status: affected
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-03-24T03:28:20.753Z
CVE-2026-4747 Remote code execution via RPCSEC_GSS packet validation
Each RPCSEC_GSS data packet is validated by a routine which checks a signature in the packet.  This routine copies a portion of the packet into a stack buffer, but fails to ensure that the buffer is sufficiently large, and a malicious client can trigger a stack overflow.  Notably, this does not require the client to authenticate itself first.

As kgssapi.ko's RPCSEC_GSS implementation is vulnerable, remote code execution in the kernel is possible by an authenticated user that is able to send packets to the kernel's NFS server while kgssapi.ko is loaded into the kernel.

In userspace, applications which have librpcgss_sec loaded and run an RPC server are vulnerable to remote code execution from any client able to send it packets.  We are not aware of any such applications in the FreeBSD base system.
Problem types: cwe_id: CWE-121
description: CWE-121: Stack-based Buffer Overflow
Affected products: vendor: FreeBSD
product: FreeBSD
default_status: unknown
Credits: lang: en
value: Nicholas Carlini using Claude, Anthropic
Published: 2026-03-26T06:21:12.735Z
CVE-2026-4748 pf silently ignores certain rules
A regression in the way hashes were calculated caused rules containing the address range syntax (x.x.x.x - y.y.y.y) that only differ in the address range(s) involved to be silently dropped as duplicates.  Only the first of such rules is actually loaded into pf.  Ranges expressed using the address[/mask-bits] syntax were not affected.

Some keywords representing actions taken on a packet-matching rule, such as 'log', 'return tll', or 'dnpipe', may suffer from the same issue.  It is unlikely that users have such configurations, as these rules would always be redundant.

Affected rules are silently ignored, which can lead to unexpected behaviour including over- and underblocking.
Problem types: cwe_id: CWE-480
description: CWE-480: Use of Incorrect Operator
cwe_id: CWE-754
description: CWE-754: Improper Check for Unusual or Exceptional Conditions
cwe_id: CWE-1023
description: CWE-1023: Incomplete Comparison with Missing Factors
Affected products: vendor: FreeBSD
product: FreeBSD
default_status: unknown
Credits: lang: en
value: Michael Gmelin
Published: 2026-04-01T06:18:52.097Z
CVE-2026-4749 NVD-CWE-noinfo in albfan miraclecast
NVD-CWE-noinfo vulnerability in albfan miraclecast.This issue affects miraclecast: before v1.0.
Problem types: description: NVD-CWE-noinfo NVD-CWE-noinfo
Affected products: vendor: albfan
product: miraclecast
default_status: affected
CVSS v3.1: version: 3.1
attackVector: ADJACENT_NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-03-24T05:35:36.711Z
CVE-2026-4750 Out-of-bounds Read in fabiangreffrath woof
Out-of-bounds Read vulnerability in fabiangreffrath woof.This issue affects woof: before woof_15.3.0.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: fabiangreffrath
product: woof
default_status: affected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-03-24T05:36:44.407Z
CVE-2026-4751 NULL Pointer Dereference in tmate-io tmate
NULL Pointer Dereference vulnerability in tmate-io tmate.This issue affects tmate: before 2.4.0.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: tmate-io
product: tmate
default_status: affected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: LOW
baseSeverity: MEDIUM
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-03-24T05:37:44.416Z
CVE-2026-4752 Use After Free in No-Chicken Echo-Mate
Use After Free vulnerability in No-Chicken Echo-Mate.This issue affects Echo-Mate: before V250329.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: No-Chicken
product: Echo-Mate
default_status: affected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: MEDIUM
baseScore: 6.4
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-03-24T05:40:01.007Z
CVE-2026-4753 Out-of-bounds Read in slajerek RetroDebugger
Out-of-bounds Read vulnerability in slajerek RetroDebugger.This issue affects RetroDebugger: before v0.64.72.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: slajerek
product: RetroDebugger
default_status: affected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-03-24T05:41:10.541Z
CVE-2026-4754 CWE-79 in MolotovCherry Android-ImageMagick7
CWE-79 vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-11.
Problem types: cwe_id: CWE-79
description: CWE-79 CWE-79
Affected products: vendor: MolotovCherry
product: Android-ImageMagick7
default_status: affected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-03-24T06:03:01.090Z
CVE-2026-4755 CWE-20 in MolotovCherry Android-ImageMagick7
CWE-20 vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-11.
Problem types: cwe_id: CWE-20
description: CWE-20 CWE-20
Affected products: vendor: MolotovCherry
product: Android-ImageMagick7
default_status: affected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-03-24T06:04:08.904Z
CVE-2026-4756 Out-of-bounds Write in MolotovCherry Android-ImageMagick7
Out-of-bounds Write vulnerability in MolotovCherry Android-ImageMagick7.This issue affects Android-ImageMagick7: before 7.1.2-11.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: MolotovCherry
product: Android-ImageMagick7
default_status: affected
CVSS v3.1: version: 3.1
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
baseSeverity: HIGH
baseScore: 7.8
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Credits: lang: en
value: TITAN Team (titancaproject@gmail.com)
Published: 2026-03-24T06:05:21.161Z
CVE-2026-4758 WP Job Portal <= 2.4.9 - Authenticated (Subscriber+) Arbitrary File Deletion via Resume Custom File Field
The WP Job Portal plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'WPJOBPORTALcustomfields::removeFileCustom' function in all versions up to, and including, 2.4.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php).
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: wpjobportal
product: WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
baseScore: 8.8
baseSeverity: HIGH
Credits: lang: en
value: daroo
Published: 2026-03-25T23:26:02.312Z
CVE-2026-4760 Potential unauthorized access to files on the Web HMI server host
From Panorama Web HMI, an attacker can gain read access to certain Web HMI server files, if he knows their paths and if these files are accessible to the Servin process execution account.
  *  Installations based on Panorama Suite 2022-SP1 (22.50.005) are vulnerable unless update PS-2210-02-4079 (or higher) is installed
  *  Installations based on Panorama Suite 2023 (23.00.004) are vulnerable unless updates PS-2300-03-3078 (or higher) and PS-2300-04-3078 (or higher) and PS-2300-82-3078 (or higher) are installed
  *  Installations based on Panorama Suite 2025 (25.00.016) are vulnerable unless updates PS-2500-02-1078 (or higher) and PS-2500-04-1078 (or higher) are installed 
  *  Installations based on Panorama Suite 2025 Updated Dec. 25 (25.10.007) are vulnerable unless updates PS-2510-02-1077 (or higher) and PS-2510-04-1077 (or higher) are installed 


Please refer to security bulletin BS-035, available on the Panorama CSIRT website:  https://my.codra.net/en-gb/csirt .
Problem types: cwe_id: CWE-552
description: CWE-552 Files or directories accessible to external parties
Affected products: vendor: CODRA
product: Panorama Suite
default_status: unaffected
Published: 2026-03-25T12:29:13.631Z
CVE-2026-4761 Unnecessary permissions on private keys of certificates installed by Network and Security Wizard
When a certificate and its private key are installed in the Windows machine certificate store using Network and Security tool, access rights to the private key are unnecessarily granted to the operator group.
  *  Installations based on Panorama Suite 2025 (25.00.004) are vulnerable unless update PS-2500-00-0357 (or higher) is installed
  *  Installations based on Panorama Suite 2025 Updated Dec. 25 (25.10.007) are not vulnerable


Please refer to security bulletin BS-036, available on the Panorama CSIRT website: https://my.codra.net/en-gb/csirt.
Problem types: cwe_id: CWE-732
description: CWE-732: Incorrect Permission Assignment for Critical Resource
Affected products: vendor: CODRA
product: Panorama Suite
default_status: unaffected
Published: 2026-03-25T12:45:27.361Z
CVE-2026-4766 Easy Image Gallery <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Gallery Shortcode Post Meta
The Easy Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Gallery shortcode post meta field in all versions up to, and including, 1.5.3. This is due to insufficient input sanitization and output escaping on user-supplied gallery shortcode values. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: devrix
product: Easy Image Gallery
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
baseScore: 6.4
baseSeverity: MEDIUM
Credits: lang: en
value: Athiwat Tiprasaharn
lang: en
value: Itthidej Aramsri
lang: en
value: Waris Damkham
Published: 2026-03-25T01:25:06.425Z
CVE-2026-4776 
An SQL injection vulnerability exists in Mautic's API contact filtering mechanism. Due to insufficient recursive sanitization of nested query parameters, an authenticated API user can bypass input filtering and inject arbitrary SQL commands.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper neutralization of special elements used in an SQL command ('SQL injection')
Affected products: default_status: unaffected
CVSS v3.1: version: 3.1
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: LOW
baseSeverity: HIGH
baseScore: 7.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Credits: lang: en
value: Vignesh P (@Senku01)
lang: en
value: Harish P (@Harish4948)
lang: en
value: Patryk Gruszka (@patrykgruszka)
lang: en
value: Leuchtfeuer Digital Marketing (@Leuchtfeuer)
Published: 2026-05-29T06:58:24.087Z
CVE-2026-4777 SourceCodester Sales and Inventory System POST Parameter view_supplier.php sql injection
A security flaw has been discovered in SourceCodester Sales and Inventory System 1.0. This affects an unknown part of the file view_supplier.php of the component POST Parameter Handler. The manipulation of the argument searchtxt results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: SourceCodester
product: Sales and Inventory System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: FuKun (VulDB User)
Published: 2026-03-24T21:42:33.950Z
CVE-2026-4778 SourceCodester Sales and Inventory System HTTP GET Parameter update_category.php sql injection
A weakness has been identified in SourceCodester Sales and Inventory System 1.0. This vulnerability affects unknown code of the file update_category.php of the component HTTP GET Parameter Handler. This manipulation of the argument sid causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: SourceCodester
product: Sales and Inventory System
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: FuKun (VulDB User)
Published: 2026-03-24T22:22:09.628Z