rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-9560 
Privilege escalation via background service of OpenVPN Connect 3.5.1 through 3.8.1 on macOS allows attackers to execute arbitrary commands with elevated privileges via local IPC channel
Problem types: cwe_id: CWE-78
description: CWE-78
cwe_id: CWE-267
description: CWE-267 Privilege defined with unsafe actions
cwe_id: CWE-270
description: CWE-270 Privilege context switching error
cwe_id: CWE-648
description: CWE-648 Incorrect use of privileged APIs
Affected products: vendor: OpenVPN Inc
product: OpenVPN Connect
default_status: unaffected
Published: 2026-05-26T17:39:57.378Z
CVE-2026-9562 sambitraj STUDENT-MANAGEMENT-SYSTEM Dashboard access control
A vulnerability has been found in sambitraj STUDENT-MANAGEMENT-SYSTEM up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. The affected element is an unknown function of the component Dashboard. Such manipulation leads to improper access controls. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. Multiple endpoints are affected. The project was informed of the problem early through an issue report but has not responded yet.
Problem types: cwe_id: CWE-284
description: Improper Access Controls
cwe_id: CWE-266
description: Incorrect Privilege Assignment
Affected products: vendor: sambitraj
product: STUDENT-MANAGEMENT-SYSTEM
cpes: cpe:2.3:a:sambitraj:student-management-system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: Harry_You (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-05-26T15:45:09.914Z
CVE-2026-9564 SourceCodester/oretnom23 Hospitals Patient Records Management System view_patient cross site scripting
A vulnerability was found in SourceCodester/oretnom23 Hospitals Patient Records Management System 1.0. The impacted element is an unknown function of the file /admin/?page=patients/view_patient. Performing a manipulation of the argument Remarks results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been made public and could be used.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
cwe_id: CWE-94
description: Code Injection
Affected products: vendor: SourceCodester
product: Hospitals Patient Records Management System
cpes: cpe:2.3:a:sourcecodester:hospitals_patient_records_management_system:*:*:*:*:*:*:*:*
vendor: oretnom23
product: Hospitals Patient Records Management System
cpes: cpe:2.3:a:oretnom23:hospitals_patient_records_management_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 2.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: alaner (VulDB User)
Published: 2026-05-26T16:30:12.596Z
CVE-2026-9565 haojing8312 WorkClaw Blacklist bash.rs is_dangerous os command injection
A vulnerability was determined in haojing8312 WorkClaw up to 0.6.4. This affects the function is_dangerous of the file apps/runtime/src-tauri/src/agent/tools/bash.rs of the component Blacklist Handler. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Problem types: cwe_id: CWE-78
description: OS Command Injection
cwe_id: CWE-77
description: Command Injection
Affected products: vendor: haojing8312
product: WorkClaw
cpes: cpe:2.3:a:haojing8312:workclaw:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: ybdesire (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-05-26T16:45:10.781Z
CVE-2026-9566 teableio teable Sign-up LoginPage.tsx cross site scripting
A vulnerability was identified in teableio teable up to 1.9.x. This impacts an unknown function of the file apps/nextjs-app/src/features/auth/pages/LoginPage.tsx of the component Sign-up. The manipulation of the argument redirect leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. Upgrading to version release.2026-04-21T08-57-20Z.1513 will fix this issue. The affected component should be upgraded. The vendor confirms: "The default branch of teableio/teable is develop, and the reported login redirect issue has already been fixed there. The login redirect flow now validates the redirect parameter with isValidRedirectPath() before navigation, which blocks javascript:, data:, and cross-origin redirects."
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
cwe_id: CWE-94
description: Code Injection
Affected products: vendor: teableio
product: teable
cpes: cpe:2.3:a:teableio:teable:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: trebledj (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-05-26T17:00:13.928Z
CVE-2026-9567 GPAC MP4Box isom_intern.c MergeFragment null pointer dereference
A security flaw has been discovered in GPAC up to 2.4.0. Affected is the function MergeFragment of the file src/isomedia/isom_intern.c of the component MP4Box. The manipulation results in null pointer dereference. The attack needs to be approached locally. The exploit has been released to the public and may be used for attacks. The patch is identified as 525bf1af642c30af04e4df5345e6d798c0a4d8a1. It is advisable to implement a patch to correct this issue.
Problem types: cwe_id: CWE-476
description: NULL Pointer Dereference
cwe_id: CWE-404
description: Denial of Service
Affected products: vendor: n/a
product: GPAC
cpes: cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 3.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
baseSeverity: LOW
Credits: lang: en
value: fczhang (VulDB User)
Published: 2026-05-26T17:45:10.365Z
CVE-2026-9568 ThingsBoard YAML provision getGatewayDockerComposeFile code injection
A weakness has been identified in ThingsBoard up to 4.3.1.1. Affected by this vulnerability is the function getGatewayDockerComposeFile of the file /api/v1/provision of the component YAML Handler. This manipulation causes code injection. It is possible to initiate the attack remotely. The attack's complexity is rated as high. The exploitation appears to be difficult. The project was informed of the problem early through a pull request but has not reacted yet.
Problem types: cwe_id: CWE-94
description: Code Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: n/a
product: ThingsBoard
cpes: cpe:2.3:a:thingsboard:thingsboard:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 5
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L/E:X/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: sunshinetoyou (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-05-26T18:00:13.406Z
CVE-2026-9572 GPAC MP4Box media.c Media_GetSample memory leak
A security vulnerability has been detected in GPAC up to 2.4.0. Affected by this issue is the function Media_GetSample of the file src/isomedia/media.c of the component MP4Box. Such manipulation of the argument cat leads to memory leak. The attack can only be performed from a local environment. The exploit has been disclosed publicly and may be used. The name of the patch is e79c5cbe8b3fed27f4854ec229457d30c96206f1. It is best practice to apply a patch to resolve this issue.
Problem types: cwe_id: CWE-401
description: Memory Leak
cwe_id: CWE-404
description: Denial of Service
Affected products: vendor: n/a
product: GPAC
cpes: cpe:2.3:a:gpac:gpac:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 3.3
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C
baseSeverity: LOW
Credits: lang: en
value: fczhang (VulDB User)
Published: 2026-05-26T18:30:10.504Z
CVE-2026-9573 itsourcecode Student Transcript Processing System index.php sql injection
A vulnerability was detected in itsourcecode Student Transcript Processing System 1.0. This affects an unknown part of the file /admin/modules/student/index.php?view=view. Performing a manipulation of the argument studentId results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: itsourcecode
product: Student Transcript Processing System
cpes: cpe:2.3:a:itsourcecode:student_transcript_processing_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: baiqiuran (VulDB User)
Published: 2026-05-26T19:00:13.477Z
CVE-2026-9574 itsourcecode Student Transcript Processing System trans.php sql injection
A flaw has been found in itsourcecode Student Transcript Processing System 1.0. This vulnerability affects unknown code of the file /admin/modules/student/trans.php. Executing a manipulation of the argument studentId/cid can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: itsourcecode
product: Student Transcript Processing System
cpes: cpe:2.3:a:itsourcecode:student_transcript_processing_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: baiqiuran (VulDB User)
Published: 2026-05-26T19:15:11.700Z
CVE-2026-9575 itsourcecode Student Transcript Processing System index.php sql injection
A vulnerability has been found in itsourcecode Student Transcript Processing System 1.0. This issue affects some unknown processing of the file /admin/modules/class/index.php?view=view. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: itsourcecode
product: Student Transcript Processing System
cpes: cpe:2.3:a:itsourcecode:student_transcript_processing_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: baiqiuran (VulDB User)
Published: 2026-05-26T19:30:12.092Z
CVE-2026-9579 JeecgBoot SysUser userEdit user.getUsername access control
A vulnerability was found in JeecgBoot up to 3.9.1. Impacted is the function user.getUsername of the file /sys/user/login/setting/userEdit of the component SysUser. The manipulation of the argument userIdentity results in improper access controls. The attack may be launched remotely. The exploit has been made public and could be used. Upgrading to version 3.9.2 is recommended to address this issue. The affected component should be upgraded.
Problem types: cwe_id: CWE-284
description: Improper Access Controls
cwe_id: CWE-266
description: Incorrect Privilege Assignment
Affected products: vendor: n/a
product: JeecgBoot
cpes: cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: AliceS614 (VulDB User)
Published: 2026-05-26T19:45:09.078Z
CVE-2026-9580 JeecgBoot selectDepart LoginController.selectDepart access control
A vulnerability was determined in JeecgBoot up to 3.9.1. The affected element is the function LoginController.selectDepart of the file /sys/selectDepart. This manipulation causes improper access controls. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.9.2 is sufficient to fix this issue. It is suggested to upgrade the affected component.
Problem types: cwe_id: CWE-284
description: Improper Access Controls
cwe_id: CWE-266
description: Incorrect Privilege Assignment
Affected products: vendor: n/a
product: JeecgBoot
cpes: cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
baseSeverity: HIGH
Credits: lang: en
value: AliceS614 (VulDB User)
Published: 2026-05-26T20:15:14.623Z
CVE-2026-9581 JeecgBoot add access control
A vulnerability was identified in JeecgBoot up to 3.9.1. The impacted element is an unknown function of the file /sys/comment/add. Such manipulation leads to improper access controls. The attack can be executed remotely. The exploit is publicly available and might be used. Upgrading to version 3.9.2 is sufficient to resolve this issue. Upgrading the affected component is recommended.
Problem types: cwe_id: CWE-284
description: Improper Access Controls
cwe_id: CWE-266
description: Incorrect Privilege Assignment
Affected products: vendor: n/a
product: JeecgBoot
cpes: cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: AliceS614 (VulDB User)
Published: 2026-05-26T20:30:13.981Z
CVE-2026-9582 SourceCodester CET Automated Grading System with AI Predictive Analytics cross-site request forgery
A security flaw has been discovered in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects an unknown function. Performing a manipulation results in cross-site request forgery. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.
Problem types: cwe_id: CWE-352
description: Cross-Site Request Forgery
cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: SourceCodester
product: CET Automated Grading System with AI Predictive Analytics
cpes: cpe:2.3:a:sourcecodester:cet_automated_grading_system_with_ai_predictive_analytics:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: vaibhavnarkhede (VulDB User)
lang: en
value: vaibhavnarkhede (VulDB User)
Published: 2026-05-26T20:45:11.049Z
CVE-2026-9583 SourceCodester CET Automated Grading System with AI Predictive Analytics SQL index.php information exposure
A weakness has been identified in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This impacts an unknown function of the file /index.php of the component SQL Handler. Executing a manipulation can lead to information exposure through error message. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
Problem types: cwe_id: CWE-209
description: Information Exposure Through Error Message
cwe_id: CWE-200
description: Information Disclosure
Affected products: vendor: SourceCodester
product: CET Automated Grading System with AI Predictive Analytics
cpes: cpe:2.3:a:sourcecodester:cet_automated_grading_system_with_ai_predictive_analytics:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: vaibhavnarkhede (VulDB User)
lang: en
value: vaibhavnarkhede (VulDB User)
Published: 2026-05-26T21:00:14.669Z
CVE-2026-9584 code-projects Project Management System Login chk.php sql injection
A security vulnerability has been detected in code-projects Project Management System 1.0. Affected is an unknown function of the file chk.php of the component Login. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: code-projects
product: Project Management System
cpes: cpe:2.3:a:code-projects:project_management_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: MyMy (VulDB User)
Published: 2026-05-26T21:15:09.692Z
CVE-2026-9590 
Improper access control in the permission validation component in Devolutions Server 2026.1.19 and earlier allows an authenticated user with entry edit privileges to modify asset information without the required permission.
Affected products: vendor: Devolutions
product: Server
default_status: unaffected
Published: 2026-06-02T14:07:08.599Z
CVE-2026-9594 WP Maps <= 4.9.4 - Authenticated (Admin+) Stored Cross-Site Scripting via 'location_messages' Parameter
The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'location_messages' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the attacker to hold the custom wpgmp_manage_location capability, which is granted to administrators by default but can be assigned to lower-privileged roles via the plugin's Permissions screen.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: flippercode
product: WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
baseScore: 4.4
baseSeverity: MEDIUM
Credits: lang: en
value: Yousef Alraddadi
Published: 2026-06-06T03:28:25.853Z
CVE-2026-9599 Tectite Forms <= 1.3 - Cross-Site Request Forgery to Settings Update
The Tectite Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.3. This is due to missing or incorrect nonce validation on the admin_init function. This makes it possible for unauthenticated attackers to modify the plugin's settings, including the tectite_forms_button option, via a forged request via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: russellr
product: Tectite Forms
default_status: unaffected
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
baseScore: 4.3
baseSeverity: MEDIUM
Credits: lang: en
value: Muhammad Afnaan
Published: 2026-06-02T07:48:31.284Z
CVE-2026-9603 SourceCodester eDoc Doctor Appointment System delete-session.php authorization
A security vulnerability has been detected in SourceCodester eDoc Doctor Appointment System 1.0. This affects an unknown part of the file /admin/delete-session.php. The manipulation of the argument ID leads to missing authorization. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
Problem types: cwe_id: CWE-862
description: Missing Authorization
cwe_id: CWE-863
description: Incorrect Authorization
Affected products: vendor: SourceCodester
product: eDoc Doctor Appointment System
cpes: cpe:2.3:a:sourcecodester:edoc_doctor_appointment_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: vaibhavnarkhede (VulDB User)
lang: en
value: vaibhavnarkhede (VulDB User)
Published: 2026-05-26T22:00:14.230Z
CVE-2026-9604 JeecgBoot AiragModelController access control
A vulnerability was detected in JeecgBoot up to 3.9.1. This vulnerability affects unknown code of the component AiragModelController. The manipulation of the argument list/queryById results in improper access controls. The attack can be executed remotely. The exploit is now public and may be used. Upgrading to version 3.9.2 is able to resolve this issue. The affected component should be upgraded.
Problem types: cwe_id: CWE-284
description: Improper Access Controls
cwe_id: CWE-266
description: Incorrect Privilege Assignment
Affected products: vendor: n/a
product: JeecgBoot
cpes: cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: AliceS614 (VulDB User)
Published: 2026-05-26T22:15:15.467Z
CVE-2026-9605 GNU libredwg Dwgbmp Utility bits.c bit_read_RC heap-based overflow
A flaw has been found in GNU libredwg up to 0.13.4.8160. This issue affects the function bit_read_RC of the file bits.c of the component Dwgbmp Utility. This manipulation causes heap-based buffer overflow. The attack is possible to be carried out remotely. The exploit has been published and may be used. Patch name: 8f03865f37f5d4ffd616fef802acc980be54d300. Applying a patch is the recommended action to fix this issue.
Problem types: cwe_id: CWE-122
description: Heap-based Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: GNU
product: libredwg
cpes: cpe:2.3:a:gnu:libredwg:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
baseSeverity: HIGH
Credits: lang: en
value: r1ck9 (VulDB User)
Published: 2026-05-26T23:15:20.385Z
CVE-2026-9606 itsourcecode Courier Management System manage_user.php sql injection
A vulnerability has been found in itsourcecode Courier Management System 1.0. Impacted is an unknown function of the file /manage_user.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: itsourcecode
product: Courier Management System
cpes: cpe:2.3:a:itsourcecode:courier_management_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: zzl08 (VulDB User)
Published: 2026-05-26T23:30:11.592Z
CVE-2026-9607 itsourcecode Courier Management System parcel_list.php sql injection
A vulnerability was found in itsourcecode Courier Management System 1.0. The affected element is an unknown function of the file /parcel_list.php. Performing a manipulation of the argument s results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: itsourcecode
product: Courier Management System
cpes: cpe:2.3:a:itsourcecode:courier_management_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: ziran (VulDB User)
Published: 2026-05-27T00:00:12.715Z