Protégez vos données, renforcez Votre Cybersécurité

CVE-2026-2855 - HIGH
20/02/2026

A vulnerability has been found in D-Link DWR-M960 1.01.07. Affected is the function sub_4648F0 of the file /boafrm/formDdns of the component DDNS Settings Handler. The manipulation of the argument submit-url leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

overflow

Plus d'informations avec CVE Find

CVE-2026-2854 - HIGH
20/02/2026

A flaw has been found in D-Link DWR-M960 1.01.07. This impacts the function sub_4611CC of the file /boafrm/formNtp of the component NTP Configuration Endpoint. Executing a manipulation of the argument submit-url can lead to stack-based buffer overflow. The attack can be launched remotely. The exploit has been published and may be used.

overflow

Plus d'informations avec CVE Find

CVE-2026-2853 - HIGH
20/02/2026

A vulnerability was detected in D-Link DWR-M960 1.01.07. This affects the function sub_462E14 of the file /boafrm/formSysLog of the component System Log Configuration Endpoint. Performing a manipulation of the argument submit-url results in stack-based buffer overflow. The attack can be initiated remotely. The exploit is now public and may be used.

overflow

Plus d'informations avec CVE Find

CVE-2021-35402 - CRITICAL
20/02/2026

PROLiNK PRC2402M 20190909 before 2021-06-13 allows live_api.cgi?page=satellite_list OS command injection via shell metacharacters in the ip parameter (for satellite_status).

oscommandinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2019-25444 - HIGH
20/02/2026

Fiverr Clone Script 1.2.2 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the page parameter. Attackers can supply malicious SQL syntax in the page parameter to extract sensitive database information or modify database contents.

sqlinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-2848 - CRITICAL
20/02/2026

A flaw has been found in SourceCodester Simple Responsive Tourism Website 1.0. Affected by this vulnerability is an unknown functionality of the file /classes/Master.php?f=register of the component Registration. This manipulation of the argument Username causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used.

sqlinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-2818 - HIGH
20/02/2026

A zip-slip path traversal vulnerability in Spring Data Geode's import snapshot functionality allows attackers to write files outside the intended extraction directory. This vulnerability appears to be susceptible on Windows OS only.

OWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-25715 - CRITICAL
20/02/2026

The web management interface of the device allows the administrator username and password to be set to blank values. Once applied, the device permits authentication with empty credentials over the web management interface and Telnet service. This effectively disables authentication across all critical management channels, allowing any network-adjacent attacker to gain full administrative cont...

OWSAP: A07

Plus d'informations avec CVE Find

CVE-2026-24790 - HIGH
20/02/2026

The underlying PLC of the device can be remotely influenced, without proper safeguards or authentication.

authorisationproblemOWSAP: A07

Plus d'informations avec CVE Find

CVE-2026-24959 - HIGH
20/02/2026

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JoomSky JS Help Desk js-support-ticket allows Blind SQL Injection.This issue affects JS Help Desk: from n/a through <= 3.0.1.

sqlinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2025-10970 - CRITICAL
20/02/2026

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kolay Software Inc. Talentics allows Blind SQL Injection.This issue affects Talentics: through 20022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

sqlinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-26050 - HIGH
20/02/2026

The installer for ジョブログ集計/分析ソフトウェア RICOHジョブログ集計ツール versions prior to Ver.1.3.7 contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. As a result, arbitrary code may be executed with administrative privileges.

Plus d'informations avec CVE Find

CVE-2026-2823 - HIGH
20/02/2026

A vulnerability was detected in Comfast CF-E7 2.6.0.9. The impacted element is the function sub_41ACCC of the file /cgi-bin/mbox-config?method=SET§ion=ntp_timezone of the component webmggnt. Performing a manipulation of the argument timestr results in command injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early ...

commandinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-26990 - HIGH
20/02/2026

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below have a Time-Based Blind SQL Injection vulnerability in address-search.inc.php via the address parameter. When a crafted subnet prefix is supplied, the prefix value is concatenated directly into an SQL query without proper parameter binding, allowing an attacker to manipulate query logic and inf...

sqlinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-26980 - CRITICAL
20/02/2026

Ghost is a Node.js content management system. Versions 3.24.0 through 6.19.0 allow unauthenticated attackers to perform arbitrary reads from the database. This issue has been fixed in version 6.19.1.

sqlinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2026-26065 - HIGH
20/02/2026

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below are vulnerable to Path Traversal through PDB readers (both 132-byte and 202-byte header variants) that allow arbitrary file writes with arbitrary extension and arbitrary content anywhere the user has write permissions. Files are written in 'wb' mode, silently overwriting ex...

directorytraversalOWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-26064 - HIGH
20/02/2026

calibre is a cross-platform e-book manager for viewing, converting, editing, and cataloging e-books. Versions 9.2.1 and below contain a Path Traversal vulnerability that allows arbitrary file writes anywhere the user has write permissions. On Windows, this leads to Remote Code Execution by writing a payload to the Startup folder, which executes on next login. Function extract_pictures only checks ...

directorytraversalOWSAP: A01

Plus d'informations avec CVE Find

CVE-2026-26988 - CRITICAL
20/02/2026

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Versions 25.12.0 and below contain an SQL Injection vulnerability in the ajax_table.php endpoint. The application fails to properly sanitize or parameterize user input when processing IPv6 address searches. Specifically, the address parameter is split into an address and a prefix, and the prefix portion is directly conca...

sqlinjectionOWSAP: A03

Plus d'informations avec CVE Find

CVE-2025-30416 - CRITICAL
20/02/2026

Sensitive data disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before build 41800.

authorisationproblemOWSAP: A01

Plus d'informations avec CVE Find

CVE-2025-30412 - CRITICAL
20/02/2026

Sensitive data disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before build 41800.

Plus d'informations avec CVE Find