rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-11491 CodeAstro Human Resource Management System Notice Board Management All_notice cross site scripting
A vulnerability was identified in CodeAstro Human Resource Management System 1.0. Impacted is an unknown function of the file /notice/All_notice of the component Notice Board Management. Such manipulation of the argument Notice Title with the input <svg onload="alert('Stored XSS Triggered by Ashik Mohamed')"> as part of POST leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
cwe_id: CWE-94
description: Code Injection
Affected products: vendor: CodeAstro
product: Human Resource Management System
cpes: cpe:2.3:a:codeastro:human_resource_management_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 2.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: Ashik Mohamed
lang: en
value: ashikmd7 (VulDB User)
lang: en
value: ashikmd7 (VulDB User)
Published: 2026-06-08T05:15:08.023Z
CVE-2026-11492 D-Link DIR-823G vsftpd vsftpd.conf least privilege violation
A security flaw has been discovered in D-Link DIR-823G 1.0.2B05. The affected element is an unknown function of the file /etc/vsftpd.conf of the component vsftpd. Performing a manipulation results in least privilege violation. The attack can be initiated remotely. The exploit has been released to the public and may be used for attacks.
Problem types: cwe_id: CWE-272
description: Least Privilege Violation
cwe_id: CWE-266
description: Incorrect Privilege Assignment
Affected products: vendor: D-Link
product: DIR-823G
cpes: cpe:2.3:h:d-link:dir-823g:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: L-14 (VulDB User)
Published: 2026-06-08T05:30:09.936Z
CVE-2026-11493 Tenda AC15 Samba smb.conf weak password
A weakness has been identified in Tenda AC15 15.03.05.19. The impacted element is an unknown function of the file /etc_ro/smb.conf of the component Samba. Executing a manipulation can lead to weak password requirements. The attack is only possible within the local network. A high complexity level is associated with this attack. The exploitability is regarded as difficult. The exploit has been made available to the public and could be used for attacks.
Problem types: cwe_id: CWE-521
description: Weak Password Requirements
Affected products: vendor: Tenda
product: AC15
cpes: cpe:2.3:o:tenda:ac15_firmware:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 5
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: L-14 (VulDB User)
Published: 2026-06-08T05:45:09.868Z
CVE-2026-11494 TOTOLINK AC1200 T8 vsftpd vsftpd.conf least privilege violation
A security vulnerability has been detected in TOTOLINK AC1200 T8 4.1.5cu.8611. This affects an unknown function of the file /etc/vsftpd.conf of the component vsftpd. The manipulation leads to least privilege violation. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.
Problem types: cwe_id: CWE-272
description: Least Privilege Violation
cwe_id: CWE-266
description: Incorrect Privilege Assignment
Affected products: vendor: TOTOLINK
product: AC1200 T8
cpes: cpe:2.3:a:totolink:ac1200_t8:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: L-14 (VulDB User)
Published: 2026-06-08T06:00:12.914Z
CVE-2026-11495 CodeAstro Ingredients Stock Management System add_stock.php sql injection
A vulnerability was detected in CodeAstro Ingredients Stock Management System 1.0. This impacts an unknown function of the file /Ingredients-Stock/add_stock.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit is now public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: CodeAstro
product: Ingredients Stock Management System
cpes: cpe:2.3:a:codeastro:ingredients_stock_management_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: Yangqiangfeng (VulDB User)
Published: 2026-06-08T06:15:13.214Z
CVE-2026-11497 D-Link DCS-5615 Boa Webserver boa.conf least privilege violation
A vulnerability has been found in D-Link DCS-5615 1.01.00. Affected by this vulnerability is an unknown functionality of the file /etc/conf.d/boa/boa.conf of the component Boa Webserver. Such manipulation leads to least privilege violation. The attack can be executed remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-272
description: Least Privilege Violation
cwe_id: CWE-266
description: Incorrect Privilege Assignment
Affected products: vendor: D-Link
product: DCS-5615
cpes: cpe:2.3:h:d-link:dcs-5615:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: yinfantasy (VulDB User)
Published: 2026-06-08T06:30:10.399Z
CVE-2026-11498 Tenda HG7HG9/HG10 Web Management voip_other_set asp_voip_OtherSet stack-based overflow
A vulnerability was found in Tenda HG7HG9 and HG10 300001138_en_xpon. Affected by this issue is the function asp_voip_OtherSet of the file /boaform/voip_other_set of the component Web Management Interface. Performing a manipulation of the argument funckey_transfer results in stack-based buffer overflow. The attack is possible to be carried out remotely.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: Tenda
product: HG7HG9
cpes: cpe:2.3:h:tenda:hg7hg9:*:*:*:*:*:*:*:*
vendor: Tenda
product: HG10
cpes: cpe:2.3:h:tenda:hg10:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: moist (VulDB User)
Published: 2026-06-08T06:45:21.289Z
CVE-2026-11499 Tenda HG7HG9/HG10 formDOMAINBLK stack-based overflow
A vulnerability was determined in Tenda HG7HG9 and HG10 300001138_en_xpon. This affects the function formDOMAINBLK of the file /boaform/formDOMAINBLK. Executing a manipulation of the argument blkDomain can lead to stack-based buffer overflow. The attack may be performed from remote.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: Tenda
product: HG7HG9
cpes: cpe:2.3:h:tenda:hg7hg9:*:*:*:*:*:*:*:*
vendor: Tenda
product: HG10
cpes: cpe:2.3:h:tenda:hg10:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:X/RL:X/RC:R
baseSeverity: CRITICAL
Credits: lang: en
value: moist (VulDB User)
Published: 2026-06-08T07:00:23.672Z
CVE-2026-11500 Weaviate Static API Key client.go validateConfig authorization
A vulnerability was identified in Weaviate up to 1.37.7. This vulnerability affects the function validateConfig of the file usecases/auth/authentication/apikey/client.go of the component Static API Key Handler. The manipulation of the argument StaticApiKey leads to authorization bypass. It is possible to initiate the attack remotely. The complexity of an attack is rather high. It is stated that the exploitability is difficult. The exploit is publicly available and might be used. Upgrading to version 1.38.0-rc.0 is able to resolve this issue. The identifier of the patch is 40f2cc32279f0f8a51016c3c6870a2c0c808e6c0. You should upgrade the affected component.
Problem types: cwe_id: CWE-639
description: Authorization Bypass
cwe_id: CWE-285
description: Improper Authorization
Affected products: vendor: n/a
product: Weaviate
cpes: cpe:2.3:a:weaviate:weaviate:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 5
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: Dem000 (VulDB User)
Published: 2026-06-08T09:00:12.155Z
CVE-2026-11501 SourceCodester Hospitals Patient Records Management System Master.php save_patient sql injection
A security flaw has been discovered in SourceCodester Hospitals Patient Records Management System 1.0. This issue affects some unknown processing of the file /classes/Master.php?f=save_patient. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: SourceCodester
product: Hospitals Patient Records Management System
cpes: cpe:2.3:a:sourcecodester:hospitals_patient_records_management_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: outjinmswa (VulDB User)
Published: 2026-06-08T09:15:09.323Z
CVE-2026-11502 JeecgBoot Third-Party Login ThirdLoginController.java HttpServletResponse.sendRedirect redirect
A weakness has been identified in JeecgBoot up to 3.9.2. Impacted is the function HttpServletResponse.sendRedirect of the file jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/ThirdLoginController.java of the component Third-Party Login. This manipulation of the argument state causes open redirect. The attack can be initiated remotely. A high degree of complexity is needed for the attack. The exploitability is considered difficult. The exploit has been made available to the public and could be used for attacks. The project replied: "After evaluation, this vulnerability has low exploitability in real-world scenarios: 1) Exploiting this vulnerability requires attackers to use social engineering techniques to induce victims to actively click on an OAuth login link constructed by the attacker; it cannot be triggered passively. 2) Third-party login (DingTalk/WeChat, etc.) is an optional feature and may not be enabled in most projects."
Problem types: cwe_id: CWE-601
description: Open Redirect
Affected products: vendor: n/a
product: JeecgBoot
cpes: cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:C
baseSeverity: LOW
Credits: lang: en
value: mukyuuhate (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-06-08T09:30:10.474Z
CVE-2026-11503 Tenda CX12L Wi-Fi Configuration Endpoint fast_setting_wifi_set form_fast_setting_wifi_set stack-based overflow
A security vulnerability has been detected in Tenda CX12L 16.03.53.12. The affected element is the function form_fast_setting_wifi_set of the file /goform/fast_setting_wifi_set of the component Wi-Fi Configuration Endpoint. Such manipulation of the argument ssid leads to stack-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: Tenda
product: CX12L
cpes: cpe:2.3:o:tenda:cx12l_firmware:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: moist (VulDB User)
Published: 2026-06-08T09:45:12.620Z
CVE-2026-11504 Tenda CX12L Wi-Fi Schedule Configuration Endpoint openSchedWifi setSchedWifi stack-based overflow
A vulnerability was detected in Tenda CX12L 16.03.53.12. The impacted element is the function setSchedWifi of the file /goform/openSchedWifi of the component Wi-Fi Schedule Configuration Endpoint. Performing a manipulation of the argument schedStartTime/schedEndTime results in stack-based buffer overflow. The attack may be initiated remotely. The exploit is now public and may be used.
Problem types: cwe_id: CWE-121
description: Stack-based Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: Tenda
product: CX12L
cpes: cpe:2.3:o:tenda:cx12l_firmware:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 8.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R
baseSeverity: HIGH
Credits: lang: en
value: moist (VulDB User)
Published: 2026-06-08T10:00:13.594Z
CVE-2026-11505 GL.iNet XE3000 glnassys hard-coded key
A flaw has been found in GL.iNet A1300, AX1800, AXT1800, MT2500, MT3000, MT6000, X3000 and XE3000 4.8.x. This affects an unknown function of the component glnassys. Executing a manipulation can lead to use of hard-coded cryptographic key . The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is reported as difficult. Upgrading to version 4.9.0 mitigates this issue. Upgrading the affected component is advised.
Problem types: cwe_id: CWE-321
description: Use of Hard-coded Cryptographic Key
cwe_id: CWE-320
description: Key Management Error
Affected products: vendor: GL.iNet
product: A1300
cpes: cpe:2.3:a:gl.inet:a1300:*:*:*:*:*:*:*:*
vendor: GL.iNet
product: AX1800
cpes: cpe:2.3:a:gl.inet:ax1800:*:*:*:*:*:*:*:*
vendor: GL.iNet
product: AXT1800
cpes: cpe:2.3:a:gl.inet:axt1800:*:*:*:*:*:*:*:*
vendor: GL.iNet
product: MT2500
cpes: cpe:2.3:a:gl.inet:mt2500:*:*:*:*:*:*:*:*
vendor: GL.iNet
product: MT3000
cpes: cpe:2.3:a:gl.inet:mt3000:*:*:*:*:*:*:*:*
vendor: GL.iNet
product: MT6000
cpes: cpe:2.3:a:gl.inet:mt6000:*:*:*:*:*:*:*:*
vendor: GL.iNet
product: X3000
cpes: cpe:2.3:a:gl.inet:x3000:*:*:*:*:*:*:*:*
vendor: GL.iNet
product: XE3000
cpes: cpe:2.3:a:gl.inet:xe3000:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 5
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C
baseSeverity: MEDIUM
Credits: lang: en
value: GLiNet (VulDB User)
Published: 2026-06-08T10:15:09.229Z
CVE-2026-11506 CodeAstro Leave Management System search_staff_for_deletion.php sql injection
A vulnerability has been found in CodeAstro Leave Management System 1.0. This impacts an unknown function of the file /admin/search_staff_for_deletion.php. The manipulation of the argument Name leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: CodeAstro
product: Leave Management System
cpes: cpe:2.3:a:codeastro:leave_management_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: jimages123 (VulDB User)
Published: 2026-06-08T10:30:11.488Z
CVE-2026-11507 CodeAstro Leave Management System delete_leave_type.php sql injection
A vulnerability was found in CodeAstro Leave Management System 1.0. Affected is an unknown function of the file /admin/delete_leave_type.php. The manipulation of the argument leave_type results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: CodeAstro
product: Leave Management System
cpes: cpe:2.3:a:codeastro:leave_management_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: jimages123 (VulDB User)
Published: 2026-06-08T10:45:09.207Z
CVE-2026-11508 CodeAstro Leave Management System search_staff_to_assign_pc.php sql injection
A vulnerability was determined in CodeAstro Leave Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/search_staff_to_assign_pc.php. This manipulation of the argument Name causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may be utilized.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: CodeAstro
product: Leave Management System
cpes: cpe:2.3:a:codeastro:leave_management_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: SchneiderGrace (VulDB User)
Published: 2026-06-08T11:00:14.109Z
CVE-2026-11509 CodeAstro Leave Management System search_staff_for_updation.php sql injection
A vulnerability was identified in CodeAstro Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/search_staff_for_updation.php. Such manipulation of the argument Name leads to sql injection. The attack may be performed from remote.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: CodeAstro
product: Leave Management System
cpes: cpe:2.3:a:codeastro:leave_management_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:X/RL:X/RC:X
baseSeverity: MEDIUM
Credits: lang: en
value: SchneiderGrace (VulDB User)
lang: en
value: VulDB Vulnerability Moderation Team
Published: 2026-06-08T11:15:08.163Z
CVE-2026-11510 CodeAstro Leave Management System add_leave.php sql injection
A security flaw has been discovered in CodeAstro Leave Management System 1.0. This affects an unknown part of the file /admin/add_leave.php. Performing a manipulation of the argument type_of_leave results in sql injection. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: CodeAstro
product: Leave Management System
cpes: cpe:2.3:a:codeastro:leave_management_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: SchneiderGrace (VulDB User)
Published: 2026-06-08T11:30:10.281Z
CVE-2026-11511 Bolt CMS HTML Attribute TextType.php HTML injection
A weakness has been identified in Bolt CMS up to 3.7.5. This vulnerability affects unknown code of the file src/Storage/Field/Type/TextType.php of the component HTML Attribute Handler. Executing a manipulation of the argument style can lead to HTML injection. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The GitHub repository was archived by the owner and is now read-only. This vulnerability only affects products that are no longer supported by the maintainer.
Problem types: cwe_id: CWE-80
description: Basic Cross Site Scripting
cwe_id: CWE-74
description: Injection
Affected products: vendor: Bolt
product: CMS
cpes: cpe:2.3:a:bolt:cms:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 3.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: LOW
Credits: lang: en
value: geochen (VulDB User)
lang: en
value: VulDB CNA Team
Published: 2026-06-08T11:45:08.499Z
CVE-2026-11512 itsourcecode Hospital Management System billing.php cross site scripting
A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. This issue affects some unknown processing of the file /billing.php. The manipulation of the argument patientid leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used.
Problem types: cwe_id: CWE-79
description: Cross Site Scripting
cwe_id: CWE-94
description: Code Injection
Affected products: vendor: itsourcecode
product: Hospital Management System
cpes: cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: Aki123 (VulDB User)
Published: 2026-06-08T12:00:14.168Z
CVE-2026-11513 itsourcecode Hospital Management System adminaccount.php sql injection
A vulnerability was detected in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /adminaccount.php. The manipulation of the argument Date results in sql injection. The attack can be launched remotely. The exploit is now public and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: itsourcecode
product: Hospital Management System
cpes: cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: Aki123 (VulDB User)
Published: 2026-06-08T12:15:10.233Z
CVE-2026-11514 itsourcecode Hospital Management System addpatient.php sql injection
A flaw has been found in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /addpatient.php. This manipulation of the argument admissiontme causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.
Problem types: cwe_id: CWE-89
description: SQL Injection
cwe_id: CWE-74
description: Injection
Affected products: vendor: itsourcecode
product: Hospital Management System
cpes: cpe:2.3:a:itsourcecode:hospital_management_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 6.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: Aki123 (VulDB User)
Published: 2026-06-08T12:30:11.825Z
CVE-2026-11515 SourceCodester Barangay Resident Profiling and Information Management System Password Reset passsword_reset.php hard-coded password
A vulnerability has been found in SourceCodester Barangay Resident Profiling and Information Management System 1.0. The impacted element is an unknown function of the file passsword_reset.php of the component Password Reset Handler. Such manipulation of the argument new_password with the input password123 leads to use of hard-coded password. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-259
description: Use of Hard-coded Password
cwe_id: CWE-255
description: Credentials Management
Affected products: vendor: SourceCodester
product: Barangay Resident Profiling and Information Management System
cpes: cpe:2.3:a:sourcecodester:barangay_resident_profiling_and_information_management_system:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 5.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: Kamran Saifullah (VulDB User)
lang: en
value: VulDB Vulnerability Moderation Team
Published: 2026-06-08T12:45:09.359Z
CVE-2026-11516 UTT HiPER 2610G formNatStaticMap strcpy buffer overflow
A vulnerability was found in UTT HiPER 2610G up to 3.0.0-171107. This affects the function strcpy of the file /goform/formNatStaticMap. Performing a manipulation of the argument NatBinds results in buffer overflow. The exploit has been made public and could be used.
Problem types: cwe_id: CWE-120
description: Buffer Overflow
cwe_id: CWE-119
description: Memory Corruption
Affected products: vendor: UTT
product: HiPER 2610G
cpes: cpe:2.3:a:utt:hiper_2610g:*:*:*:*:*:*:*:*
CVSS v3.1: version: 3.1
baseScore: 5.5
vectorString: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R
baseSeverity: MEDIUM
Credits: lang: en
value: liwenqing (VulDB User)
Published: 2026-06-08T13:00:17.152Z