rainbutterfly/cve_corpus huggingface dataset:
CVE-2026-26362 
Dell Unisphere for PowerMax, version(s) 10.2, contain(s) a Relative Path Traversal vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized modification of critical system files.
Problem types: cwe_id: CWE-23
description: CWE-23: Relative Path Traversal
Affected products: vendor: Dell
product: Unisphere for PowerMax
default_status: unaffected
vendor: Dell
product: PowerMax
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Published: 2026-02-19T08:25:14.267Z
CVE-2026-26365 
Akamai Ghost on Akamai CDN edge servers before 2026-02-06 mishandles processing of custom hop-by-hop HTTP headers, where an incoming request containing the header "Connection: Transfer-Encoding" could result in a forward request with invalid message framing, depending on the Akamai processing path. This could result in the origin server parsing the request body incorrectly, leading to HTTP request smuggling.
Problem types: cwe_id: CWE-444
description: CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Affected products: vendor: Akamai
product: Ghost
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N
Published: 2026-02-23T00:00:00.000Z
CVE-2026-26366 JUNG eNet SMART HOME server 2.2.1/2.3.1 Use of Default Credentials
eNet SMART HOME server 2.2.1 and 2.3.1 ships with default credentials (user:user, admin:admin) that remain active after installation and commissioning without enforcing a mandatory password change. Unauthenticated attackers can use these default credentials to gain administrative access to sensitive smart home configuration and control functions.
Problem types: cwe_id: CWE-1392
description: Use of Default Credentials
Affected products: vendor: JUNG
product: eNet SMART HOME server
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: LiquidWorm as Gjoko Krstic of Zero Science Lab
Published: 2026-02-15T15:29:53.866Z
CVE-2026-26367 JUNG eNet SMART HOME server 2.2.1/2.3.1 Arbitrary User Deletion via deleteUserAccount
eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the deleteUserAccount JSON-RPC method that permits any authenticated low-privileged user (UG_USER) to delete arbitrary user accounts, except for the built-in admin account. The application does not enforce role-based access control on this function, allowing a standard user to submit a crafted POST request to /jsonrpc/management specifying another username to have that account removed without elevated permissions or additional confirmation.
Problem types: cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: JUNG
product: eNet SMART HOME server
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Credits: lang: en
value: LiquidWorm as Gjoko Krstic of Zero Science Lab
Published: 2026-02-15T15:29:54.646Z
CVE-2026-26368 JUNG eNet SMART HOME server 2.2.1/2.3.1 Account Takeover via resetUserPassword
eNet SMART HOME server 2.2.1 and 2.3.1 contains a missing authorization vulnerability in the resetUserPassword JSON-RPC method that allows any authenticated low-privileged user (UG_USER) to reset the password of arbitrary accounts, including those in the UG_ADMIN and UG_SUPER_ADMIN groups, without supplying the current password or having sufficient privileges. By sending a crafted JSON-RPC request to /jsonrpc/management, an attacker can overwrite existing credentials, resulting in direct account takeover with full administrative access and persistent privilege escalation.
Problem types: cwe_id: CWE-862
description: Missing Authorization
Affected products: vendor: JUNG
product: eNet SMART HOME server
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: LiquidWorm as Gjoko Krstic of Zero Science Lab
Published: 2026-02-15T15:29:55.403Z
CVE-2026-26369 JUNG eNet SMART HOME server 2.2.1/2.3.1 Privilege Escalation via setUserGroup
eNet SMART HOME server 2.2.1 and 2.3.1 contains a privilege escalation vulnerability due to insufficient authorization checks in the setUserGroup JSON-RPC method. A low-privileged user (UG_USER) can send a crafted POST request to /jsonrpc/management specifying their own username to elevate their account to the UG_ADMIN group, bypassing intended access controls and gaining administrative capabilities such as modifying device configurations, network settings, and other smart home system functions.
Problem types: cwe_id: CWE-269
description: Improper Privilege Management
Affected products: vendor: JUNG
product: eNet SMART HOME server
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: LiquidWorm as Gjoko Krstic of Zero Science Lab
Published: 2026-02-15T15:29:56.204Z
CVE-2026-26370 
WordPress Plugin "Survey Maker" versions 5.1.7.7 and prior contain a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser.
Problem types: cwe_id: CWE-79
description: Cross-site scripting (XSS)
Affected products: vendor: Ays Pro
product: Survey Maker
Published: 2026-02-20T07:42:15.263Z
CVE-2026-26377 
Cross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute arbitrary code via the News function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-05T00:00:00.000Z
CVE-2026-26378 
Cross Site Scripting vulnerability in Koha 25.11 and before allows a remote attacker to execute arbitrary code via file upload function in Invoice features
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-03T00:00:00.000Z
CVE-2026-26379 
Koha versions up to 25.11 contain a Server-Side Request Forgery (SSRF) vulnerability via the Z39.50/SRU server configuration. This allows authenticated attackers to perform internal network scanning and identify running services by analyzing server response times.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-06-03T00:00:00.000Z
CVE-2026-26399 
A stack-use-after-return issue exists in the Arduino_Core_STM32 library prior to version 1.7.0. The pwm_start() function allocates a TIM_HandleTypeDef structure on the stack and passes its address to HAL initialization routines, where it is stored in a global timer handle registry. After the function returns, interrupt service routines may dereference this dangling pointer, resulting in memory corruption.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-20T00:00:00.000Z
CVE-2026-26416 
An authorization bypass vulnerability in Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to escalate privileges across role boundaries via crafted requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-05T00:00:00.000Z
CVE-2026-26417 
A broken access control vulnerability in the password reset functionality of Tata Consultancy Services Cognix Recon Client v3.0 allows authenticated users to reset passwords of arbitrary user accounts via crafted requests.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-05T00:00:00.000Z
CVE-2026-26418 
Missing authentication and authorization in the web API of Tata Consultancy Services Cognix Recon Client v3.0 allows remote attackers to access application functionality without restriction via the network.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-05T00:00:00.000Z
CVE-2026-26422 
clash-verge-service-ipc before 2.3.0 has a world-reachable IPC endpoint, leading to local privilege escalation.
Problem types: cwe_id: CWE-732
description: CWE-732 Incorrect Permission Assignment for Critical Resource
Affected products: vendor: Clash Verge Rev
product: clash-verge-service-ipc
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 8.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2026-06-06T00:00:00.000Z
CVE-2026-26460 
A HTML Injection vulnerability exists in the Dashboard module of Vtiger CRM 8.4.0. The application fails to properly neutralize user-supplied input in the tabid parameter of the DashBoardTab view (getTabContents action), allowing an attacker to inject arbitrary HTML content into the dashboard interface. The injected content is rendered in the victim's browser
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-04-13T00:00:00.000Z
CVE-2026-26461 
A Command Injection vulnerability in the web management interface in Aver PTC320UV2 0.1.0000.65 allows an unauthenticated attacker to execute arbitrary commands via a crafted web request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-01T00:00:00.000Z
CVE-2026-26462 
Offline Hospital Management System 5.3.0 allows remote code execution due to an improper Electron renderer configuration. The application enables Node.js integration while disabling context isolation, allowing JavaScript executed in the renderer process to access Node.js APIs and execute arbitrary operating system commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-05-18T00:00:00.000Z
CVE-2026-26464 
Stored Cross-Site Scripting (XSS) was found in the /admin/edit_user.php page of Society Management System Portal V1.0, which allows remote attackers to inject and store arbitrary JavaScript code that is executed in users' browsers. This vulnerability can be exploited via the name parameter in a POST HTTP request, leading to execution of malicious scripts when the affected content is viewed by other users, including administrators.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-23T00:00:00.000Z
CVE-2026-26477 
An issue in Dokuwiki v.2025-05-14b "Librarian" [56.2] allows a remote attacker to cause a denial of service via the media_upload_xhr() function in the media.php file
Problem types: cwe_id: CWE-770
description: CWE-770 Allocation of Resources Without Limits or Throttling
Affected products: vendor: DokuWiki
product: DokuWiki
default_status: unknown
CVSS v3.1: version: 3.1
baseScore: 4.3
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Published: 2026-04-03T00:00:00.000Z
CVE-2026-26478 
A shell command injection vulnerability in Mobvoi Tichome Mini smart speaker 012-18853 and 027-58389 allows remote attackers to send a specially crafted UDP datagram and execute arbitrary shell code as the root account.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-04T00:00:00.000Z
CVE-2026-26514 
An Argument Injection vulnerability exists in bird-lg-go before commit 6187a4e. The traceroute module uses shlex.Split to parse user input without validation, allowing remote attackers to inject arbitrary flags (e.g., -w, -q) via the q parameter. This can be exploited to cause a Denial of Service (DoS) by exhausting system resources.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-04T00:00:00.000Z
CVE-2026-26673 
An issue in DJI Mavic Mini, Spark, Mavic Air, Mini, Mini SE 0.1.00.0500 and below allows a remote attacker to cause a denial of service via the DJI Enhanced-WiFi transmission subsystem
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-04T00:00:00.000Z
CVE-2026-26682 
An issue in fastCMS before v.0.1.6 allows a local attacker to execute arbitrary code via the PluginController.java component
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-26T00:00:00.000Z
CVE-2026-26694 
code-projects Simple Student Alumni System v1.0 is vulnerale to SQL Injection in /TracerStudy/modal_view.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-02T00:00:00.000Z
CVE-2026-26695 
code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/recordstudent_edit.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-02T00:00:00.000Z
CVE-2026-26696 
code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/recordteacher_edit.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-02T00:00:00.000Z
CVE-2026-26697 
code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/recordteacher_view.php?teacherID=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-02T00:00:00.000Z
CVE-2026-26698 
code-projects Simple Student Alumni System v1.0 is vulnerable to SQL Injection in /TracerStudy/modal_edit.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-02T00:00:00.000Z
CVE-2026-26699 
sourcecodester Personnel Property Equipment System v1.0 is vulnerable to arbitrary code execution in ip/ppes/admin/admin_change_picture.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-02T00:00:00.000Z
CVE-2026-26700 
sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_employee.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-02T00:00:00.000Z
CVE-2026-26701 
sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/edit_tecnical_user.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-02T00:00:00.000Z
CVE-2026-26702 
sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/myitem_reuse.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-02T00:00:00.000Z
CVE-2026-26703 
sourcecodester Personnel Property Equipment System v1.0 is vulnerable to SQL Injection in /ppes/admin/advance_search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-02T00:00:00.000Z
CVE-2026-26704 
sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_category.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-02T00:00:00.000Z
CVE-2026-26705 
sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_product.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-02T00:00:00.000Z
CVE-2026-26706 
sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_receipt.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-02T00:00:00.000Z
CVE-2026-26707 
sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/view_supplier.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-02T00:00:00.000Z
CVE-2026-26708 
sourcecodester Pharmacy Point of Sale System v1.0 is vulnerable to SQL Injection in /pharmacy/manage_user.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-02T00:00:00.000Z
CVE-2026-26709 
code-projects Simple Gym Management System v1.0 is vulnerable to SQL Injection in /gym/trainer_search.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-02T00:00:00.000Z
CVE-2026-26710 
code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/routers/edit-orders.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-02T00:00:00.000Z
CVE-2026-26711 
code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/view-ticket.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-02T00:00:00.000Z
CVE-2026-26712 
code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/view-ticket-admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-02T00:00:00.000Z
CVE-2026-26713 
code-projects Simple Food Order System v1.0 is vulnerable to SQL Injection in /food/routers/cancel-order.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-02T00:00:00.000Z
CVE-2026-26717 
An issue in OpenFUN Richie (LMS) in src/richie/apps/courses/api.py. The application used the non-constant time == operator for HMAC signature verification in the sync_course_run_from_request function. This allows remote attackers to forge valid signatures and bypass authentication by measuring response time discrepancies
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-25T00:00:00.000Z
CVE-2026-26720 
An issue in Twenty CRM v1.15.0 and before allows a remote attacker to execute arbitrary code via the local.driver.ts module.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-02T00:00:00.000Z
CVE-2026-26721 
An issue in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote attacker to obtain sensitive information via the sid query parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-20T00:00:00.000Z
CVE-2026-26722 
An issue in Key Systems Inc Global Facilities Management Software v.20230721a allows a remote attacker to escalate privileges via PIN component of the login functionality.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-20T00:00:00.000Z
CVE-2026-26723 
Cross Site Scripting vulnerability in Key Systems Inc Global Facilities Management Software v. 20230721a allows a remote attacker to execute arbitrary code via the function parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-20T00:00:00.000Z
CVE-2026-26724 
Cross Site Scripting vulnerability in Key Systems Inc Global Facilities Management Software v. 20230721a allows a remote attacker to execute arbitrary code via the selectgroup and gn parameters on the /?Function=Groups endpoint.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-20T00:00:00.000Z
CVE-2026-26725 
An issue in edu Business Solutions Print Shop Pro WebDesk v.18.34 (fixed in 19.76) allows a remote attacker to escalate privileges via the AccessID parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-20T00:00:00.000Z
CVE-2026-26731 
TOTOLINK A3002RU V2.1.1-B20211108.1455 was discovered to contain a stack-based buffer overflow via the routernamer`parameter in the formDnsv6 function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-17T00:00:00.000Z
CVE-2026-26732 
TOTOLINK A3002RU V2.1.1-B20211108.1455 was discovered to contain a stack-based buffer overflow via the vpnUser or vpnPassword` parameters in the formFilter function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-17T00:00:00.000Z
CVE-2026-26736 
TOTOLINK A3002RU_V3 V3.0.0-B20220304.1804 was discovered to contain a stack-based buffer overflow via the static_ipv6 parameter in the formIpv6Setup function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-17T00:00:00.000Z
CVE-2026-26738 
Buffer Overflow vulnerability in Uderzo Software SpaceSniffer v.2.0.5.18 allows a remote attacker to execute arbitrary code via a crafted .sns snapshot file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-10T00:00:00.000Z
CVE-2026-26740 
Buffer Overflow vulnerability in giflib v.5.2.2 allows a remote attacker to cause a denial of service via the EGifGCBToExtension overwriting an existing Graphic Control Extension block without validating its allocated size.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-18T00:00:00.000Z
CVE-2026-26741 
PX4 Autopilot versions 1.12.x through 1.15.x contain a logic flaw in the mode switching mechanism. When switching from Auto mode to Manual mode while the drone is in the "ARMED" state (after landing and before the automatic disarm triggered by the COM_DISARM_LAND parameter), the system lacks a throttle threshold safety check for the physical throttle stick. This flaw can directly cause the drone to lose control, experience rapid uncontrolled ascent (flyaway), and result in property damage
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-10T00:00:00.000Z
CVE-2026-26742 
PX4 Autopilot versions 1.12.x through 1.15.x contain a protection mechanism failure in the "Re-arm Grace Period" logic. The system incorrectly applies the in-air emergency re-arm logic to ground scenarios. If a pilot switches to Manual mode and re-arms within 5 seconds (default configuration) of an automatic landing, the system bypasses all pre-flight safety checks, including the throttle threshold check. This allows for an immediate high-thrust takeoff if the throttle stick is raised, leading to loss of control.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-10T00:00:00.000Z
CVE-2026-26744 
A user enumeration vulnerability exists in FormaLMS 4.1.18 and below in the password recovery functionality accessible via the /lostpwd endpoint. The application returns different error messages for valid and invalid usernames allowing an unauthenticated attacker to determine which usernames are registered in the system through observable response discrepancy.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-19T00:00:00.000Z
CVE-2026-26745 
OpenSourcePOS 3.4.1 has a second order SQL Injection vulnerability in the handling of the currency_symbol configuration field. Although the input is initially stored without immediate execution, it is later concatenated into a dynamically constructed SQL query without proper sanitization or parameter binding. This allows an attacker with access to modify the currency_symbol value to inject arbitrary SQL expressions, which are executed when the affected query is subsequently processed.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-02-20T00:00:00.000Z