Yingxiujie

🚨 CVE-2026-86183 A vulnerability was identified in diem-project diem up to 5.1.3. This vulnerability affects unknown code of the file dmFrontPlugin/modules/dmWidget/lib/BasedmWidgetActions.class.php of the component dmWidget. Such manipulation of the argument widget id leads to authorization bypass. The attack may be launched remotely. The exploit is publicly available and might be used. The name of the patch is 116974edfb9a5b8bd69cb13586dc62bcdbb485ad. A patch should be applied to remediate this issue. The project was informed of the problem early through an issue report but has not responded yet. 🎖@cveNotify

🚨 CVE-2026-86182 A vulnerability was determined in diem-project diem up to 5.1.3. This affects the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/actions.class.php of the component dmConsole. This manipulation of the argument dm command causes cross-site request forgery. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet. 🎖@cveNotify

🚨 CVE-2026-86211 A flaw has been found in rabindralamsal inventory-management-system 1.0.0. This affects an unknown part of the file index.php of the component Login. Executing a manipulation of the argument username/password can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used. 🎖@cveNotify

**Name of the Vulnerable Software and Affected Versions** CodeAstro Simple Online Leave Management System version 1.0 **Description** Remote SQL injection is possible via the `/SimpleOnlineLeave/index.php` endpoint. By manipulating the `email` parameter, an attacker can execute unauthorized database queries, which could lead to the exposure of employee data within internal HR and leave-management systems. **Recommendations** Update CodeAstro Simple Online Leave Management System version 1.0 to a patched version. As a temporary mitigation, restrict access to the `/SimpleOnlineLeave/index.php` endpoint or sanitize the `email` parameter to prevent SQL injection.

**Name of the Vulnerable Software and Affected Versions** CodeAstro Apartment Visitor Management System version 1.0 **Description** A security flaw allows remote attackers to perform SQL injection, a technique used to manipulate database queries. The issue exists within an unknown function in the '/apartment-visitor/add-apartment.php' endpoint via the `apartmentno` variable. **Recommendations** As a temporary mitigation, restrict access to the '/apartment-visitor/add-apartment.php' endpoint or avoid using the `apartmentno` variable until a fix is applied. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Montodel House-Rental-Management versions prior to 90010017b81265eb1ef3810268909f7719a33863 **Description** A remote SQL injection exists in the '/index.php?page=houses' endpoint. The issue occurs due to the improper manipulation of the `ID` argument, allowing an attacker to execute arbitrary SQL commands. **Recommendations** Update to a version later than 90010017b81265eb1ef3810268909f7719a33863. As a temporary workaround, restrict access to the '/index.php?page=houses' endpoint or avoid using the `ID` parameter until the system is updated.

**Name of the Vulnerable Software and Affected Versions** Montodel House-Rental-Management versions prior to 90010017b81265eb1ef3810268909f7719a33863 **Description** A SQL injection issue exists in the '/login.php' endpoint. Remote attackers can exploit this by manipulating the `Username` parameter. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to the database. **Recommendations** Update to a version later than 90010017b81265eb1ef3810268909f7719a33863. As a temporary workaround, restrict access to the '/login.php' endpoint or sanitize the `Username` parameter to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** CodeAstro Online Catering Ordering System version 1.0 **Description** Remote SQL injection is possible via the manipulation of the `ID` argument in the '/deleteorder.php' endpoint. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to or modification of the database. **Recommendations** Avoid using the `ID` parameter in the '/deleteorder.php' endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** CodeAstro Leave Management System version 1.0 **Description** A weakness in the `/login.php` file allows for remote SQL injection. This occurs through the manipulation of the `txt username` argument. SQL injection is a type of flaw that allows an attacker to interfere with the queries that an application makes to its database. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the `/login.php` file or sanitize the `txt username` input to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** rawchen sims versions prior to 004f783b1db5ecdfad81c8fdc3b34171211112de **Description** A path traversal flaw exists in the 'deleteFileServlet' endpoint within the file `sims-master/src/web/servlet/file/DeleteFileServlet.java`. A remote attacker can exploit this by manipulating the `filename` argument. Path traversal is a technique that allows an attacker to access files and directories that are stored outside the web root folder by manipulating variables that reference files with dot-dot-slash (../) sequences. **Recommendations** Update to a version later than 004f783b1db5ecdfad81c8fdc3b34171211112de. As a temporary workaround, restrict access to the 'deleteFileServlet' endpoint or avoid using the `filename` parameter until a patch is applied.

Name of the Vulnerable Software and Affected Versions perfree go-fastdfs-web versions up to 1.3.7 Description A security issue exists in perfree go-fastdfs-web up to version 1.3.7, specifically within the `doInstall` interface of the file src/main/java/com/perfree/controller/InstallController.java. This results in improper authorization, and the attack can be initiated remotely. The exploit has been publicly disclosed. Recommendations Update to a version later than 1.3.7.