Skip to content

Commit c10895b

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3grf-qxvr-p8vp GHSA-c9jx-x7v4-4qjv GHSA-cp9m-vc98-h8c6 GHSA-hgh5-fxqq-8cf2 GHSA-hjhh-36m7-qvw6 GHSA-jc7h-xwvq-gmqx GHSA-q54x-333x-p582
1 parent 11026fd commit c10895b

7 files changed

Lines changed: 392 additions & 0 deletions

File tree

‎advisories/unreviewed/2026/02/GHSA-3grf-qxvr-p8vp/GHSA-3grf-qxvr-p8vp.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-3grf-qxvr-p8vp",
4+
"modified": "2026-02-08T06:31:44Z",
5+
"published": "2026-02-08T06:31:44Z",
6+
"aliases": [
7+
"CVE-2026-2136"
8+
],
9+
"details": "A flaw has been found in projectworlds Online Food Ordering System 1.0. This affects an unknown function of the file /view-ticket.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2136"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/hater-us/CVE/issues/4"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.344771"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.344771"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.747230"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-02-08T06:16:16Z"
51+
}
52+
}

‎advisories/unreviewed/2026/02/GHSA-c9jx-x7v4-4qjv/GHSA-c9jx-x7v4-4qjv.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-c9jx-x7v4-4qjv",
4+
"modified": "2026-02-08T06:31:43Z",
5+
"published": "2026-02-08T06:31:43Z",
6+
"aliases": [
7+
"CVE-2026-2132"
8+
],
9+
"details": "A security flaw has been discovered in code-projects Online Music Site 1.0. This issue affects some unknown processing of the file /Administrator/PHP/AdminUpdateCategory.php. The manipulation of the argument txtcat results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2132"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Volije/AdminUpdateCategory/issues/1"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://code-projects.org"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.344767"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.344767"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.747210"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-08T04:15:53Z"
55+
}
56+
}

‎advisories/unreviewed/2026/02/GHSA-cp9m-vc98-h8c6/GHSA-cp9m-vc98-h8c6.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-cp9m-vc98-h8c6",
4+
"modified": "2026-02-08T06:31:44Z",
5+
"published": "2026-02-08T06:31:44Z",
6+
"aliases": [
7+
"CVE-2026-2137"
8+
],
9+
"details": "A vulnerability has been found in Tenda TX3 up to 16.03.13.11_multi. This impacts an unknown function of the file /goform/SetIpMacBind. The manipulation of the argument list leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2137"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/MRAdera/IoT-Vuls/blob/main/tenda/tx3/fromSetIpMacBind.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://github.com/MRAdera/IoT-Vuls/blob/main/tenda/tx3/fromSetIpMacBind.md#poc"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.344772"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.344772"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.747239"
45+
},
46+
{
47+
"type": "WEB",
48+
"url": "https://www.tenda.com.cn"
49+
}
50+
],
51+
"database_specific": {
52+
"cwe_ids": [
53+
"CWE-119"
54+
],
55+
"severity": "HIGH",
56+
"github_reviewed": false,
57+
"github_reviewed_at": null,
58+
"nvd_published_at": "2026-02-08T06:16:17Z"
59+
}
60+
}

‎advisories/unreviewed/2026/02/GHSA-hgh5-fxqq-8cf2/GHSA-hgh5-fxqq-8cf2.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hgh5-fxqq-8cf2",
4+
"modified": "2026-02-08T06:31:43Z",
5+
"published": "2026-02-08T06:31:43Z",
6+
"aliases": [
7+
"CVE-2026-2134"
8+
],
9+
"details": "A security vulnerability has been detected in PHPGurukul Hospital Management System 4.0. The affected element is an unknown function of the file /hms/admin/manage-doctors.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2134"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Shaon-Xis/PHPGurukul-HMS-SQL-Injection"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://phpgurukul.com"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.344769"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.344769"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.747214"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-74"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-08T05:16:04Z"
55+
}
56+
}

‎advisories/unreviewed/2026/02/GHSA-hjhh-36m7-qvw6/GHSA-hjhh-36m7-qvw6.json‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-hjhh-36m7-qvw6",
4+
"modified": "2026-02-08T06:31:43Z",
5+
"published": "2026-02-08T06:31:43Z",
6+
"aliases": [
7+
"CVE-2026-2133"
8+
],
9+
"details": "A weakness has been identified in code-projects Online Music Site 1.0. Impacted is an unknown function of the file /Administrator/PHP/AdminUpdateCategory.php. This manipulation of the argument txtimage causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be used for attacks.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2133"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/Volije/cve2/issues/1"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://code-projects.org"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?ctiid.344768"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?id.344768"
41+
},
42+
{
43+
"type": "WEB",
44+
"url": "https://vuldb.com/?submit.747213"
45+
}
46+
],
47+
"database_specific": {
48+
"cwe_ids": [
49+
"CWE-284"
50+
],
51+
"severity": "MODERATE",
52+
"github_reviewed": false,
53+
"github_reviewed_at": null,
54+
"nvd_published_at": "2026-02-08T04:15:55Z"
55+
}
56+
}

‎advisories/unreviewed/2026/02/GHSA-jc7h-xwvq-gmqx/GHSA-jc7h-xwvq-gmqx.json‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-jc7h-xwvq-gmqx",
4+
"modified": "2026-02-08T06:31:44Z",
5+
"published": "2026-02-08T06:31:44Z",
6+
"aliases": [
7+
"CVE-2026-2135"
8+
],
9+
"details": "A vulnerability was detected in UTT HiPER 810 1.7.4-141218. The impacted element is the function sub_43F020 of the file /goform/formPdbUpConfig. Performing a manipulation of the argument policyNames results in command injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.",
10+
"severity": [
11+
{
12+
"type": "CVSS_V3",
13+
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L"
14+
},
15+
{
16+
"type": "CVSS_V4",
17+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
18+
}
19+
],
20+
"affected": [],
21+
"references": [
22+
{
23+
"type": "ADVISORY",
24+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2135"
25+
},
26+
{
27+
"type": "WEB",
28+
"url": "https://github.com/cha0yang1/UTT810CVE/blob/main/CVEreadme2.md"
29+
},
30+
{
31+
"type": "WEB",
32+
"url": "https://vuldb.com/?ctiid.344770"
33+
},
34+
{
35+
"type": "WEB",
36+
"url": "https://vuldb.com/?id.344770"
37+
},
38+
{
39+
"type": "WEB",
40+
"url": "https://vuldb.com/?submit.747222"
41+
}
42+
],
43+
"database_specific": {
44+
"cwe_ids": [
45+
"CWE-74"
46+
],
47+
"severity": "MODERATE",
48+
"github_reviewed": false,
49+
"github_reviewed_at": null,
50+
"nvd_published_at": "2026-02-08T05:16:07Z"
51+
}
52+
}

0 commit comments

Comments
 (0)