News & Sicurezza

CVE ID :CVE-2025-55277 Published : March 26, 2026, 1:16 p.m. | 36 minutes ago Description :HCL Aftermarket DPC is affected by Use of Vulnerable/Outdated Versions vulnerability using which an attacker may make use of the exploits available across the internet and craft attacks against the application. Severity: 2.6 | LOW Visit the link for more details, such as CVSS details, affected products, timeline, and more...

DHCP Down: High-Severity Stack Overflow Flaw Threatens to Paralyze Kea Networks The Internet Systems Consortium (ISC) has issued a high-severity security advisory regarding a critical vulnerability affecting the Kea DHCP suite. The flaw, tracked as CVE-2026-3608 (CVSS 7.5), could ... Read more Published Date: Mar 26, 2026 (1 day, 5 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-3608 CVE-2026-4681 CVE-2025-40779 CVE-2025-29969 CVE-2022-1183

Critical RCE Flaw in PTC Windchill and FlexPLM Puts Product Data at Risk PTC has issued a high-priority security advisory regarding a critical vulnerability affecting its Windchill and FlexPLM product lifecycle management suites. The flaw, tracked as CVE-2026-4681 (CVSS 10 ... Read more Published Date: Mar 26, 2026 (1 day, 2 hours ago) Vulnerabilities has been mentioned in this article. CVE-2026-3608 CVE-2026-4681 CVE-2025-29969

WebOfisi E-Ticaret 4.0 contains an SQL injection vulnerability in the 'urun' GET parameter of the endpoint that allows unauthenticated attackers to manipulate database queries. Attackers can inject SQL payloads through the 'urun' parameter to execute boolean-based blind, error-based, time-based blind, and stacked query attacks against the backend database.

OpenBiz Cubi Lite 3.0.8 contains a SQL injection vulnerability in the login form that allows unauthenticated attackers to manipulate database queries through the username parameter. Attackers can submit POST requests to /bin/controller.php with malicious SQL code in the username field to extract sensitive database information or bypass authentication.

qdPM 9.1 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through filter_by parameters. Attackers can submit malicious POST requests to the timeReport endpoint with crafted filter_by[CommentCreatedFrom] and filter_by[CommentCreatedTo] parameters to execute arbitrary SQL queries and retrieve sensitive data.

Online Quiz Maker 1.0 contains SQL injection vulnerabilities in the catid and usern parameters that allow authenticated attackers to execute arbitrary SQL commands. Attackers can submit malicious POST requests to quiz-system.php or add-category.php with crafted SQL payloads in POST parameters to extract sensitive database information or bypass authentication.

KomSeo Cart 1.3 contains an SQL injection vulnerability that allows attackers to inject SQL commands through the 'my_item_search' parameter in edit.php. Attackers can submit POST requests with malicious SQL payloads to extract sensitive database information using boolean-based blind or error-based injection techniques.

ASP.NET jVideo Kit 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the 'query' parameter in the search functionality. Attackers can submit malicious SQL payloads via GET or POST requests to the /search endpoint to extract sensitive database information using boolean-based blind or error-based techniques.

Library CMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to bypass authentication by injecting SQL code through the username parameter. Attackers can send POST requests to the admin login endpoint with boolean-based blind SQL injection payloads in the username field to manipulate database queries and gain unauthorized access.

Online Store System CMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the email parameter. Attackers can send POST requests to index.php with the action=clientaccess parameter using boolean-based blind or time-based blind SQL injection payloads in the email field to extract sensitive database information.

SAT CFDI 3.3 contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting SQL code through the 'id' parameter in the signIn endpoint. Attackers can submit POST requests with boolean-based blind, stacked queries, or time-based blind SQL injection payloads to extract sensitive data or compromise the application.