https://vulnogram.org/ Most recent CVEs assigned by TWCERT/CC (twcert). https://vulnogram.org/seaview/icons/twcert.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-113407 https://vulnogram.org/CVE-2026-113407 BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents. High Tue, 20 Oct 2026 07:21:47 GMT https://vulnogram.org/CVE-2026-113406 https://vulnogram.org/CVE-2026-113406 BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents. High Tue, 20 Oct 2026 07:20:14 GMT https://vulnogram.org/CVE-2026-113405 https://vulnogram.org/CVE-2026-113405 BA-Workflow developed by YS-infoware has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL statements to read, modify, and delete database contents. High Tue, 20 Oct 2026 07:17:45 GMT https://vulnogram.org/CVE-2026-113403 https://vulnogram.org/CVE-2026-113403 ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability. Authenticated remote attackers can inject crafted commands into a specific parameter, thereby uploading malicious code to the server. High Tue, 20 Oct 2026 07:04:25 GMT https://vulnogram.org/CVE-2026-113402 https://vulnogram.org/CVE-2026-113402 ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability. Authenticated remote attackers can exploit path traversal to cause the application to include PHP files outside the intended directory. High Tue, 20 Oct 2026 06:28:45 GMT https://vulnogram.org/CVE-2026-113404 https://vulnogram.org/CVE-2026-113404 WebITR developed by Uniong has a Insecure Deserialization vulnerability. Authenticated remote attackers can use the hard-coded cryptographic key to craft and submit malicious serialized data, thereby executing arbitrary code on the server. High Tue, 20 Oct 2026 06:24:08 GMT https://vulnogram.org/CVE-2026-110467 https://vulnogram.org/CVE-2026-110467 Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to view the peer review scores of any student. Medium Wed, 14 Oct 2026 06:31:24 GMT https://vulnogram.org/CVE-2026-110466 https://vulnogram.org/CVE-2026-110466 Tronclass developed by WisdomGarden has a Sensitive Data Exposure vulnerability. Authenticated remote attackers can bypass anonymous grading restrictions and obtain anonymous student information. Medium Wed, 14 Oct 2026 06:29:52 GMT https://vulnogram.org/CVE-2026-110465 https://vulnogram.org/CVE-2026-110465 Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability. Authenticated remote attackers can modify a specific parameter to alter the peer review scores of any student. Medium Wed, 14 Oct 2026 06:28:22 GMT https://vulnogram.org/CVE-2026-110445 https://vulnogram.org/CVE-2026-110445 TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into interacting with crafted content to inject and execute arbitrary JavaScript. After the user confirms a Windo… High Network Exploitable Wed, 14 Oct 2026 02:57:49 GMT https://vulnogram.org/CVE-2026-110444 https://vulnogram.org/CVE-2026-110444 TeamPlus Messenger developed by Teamplus Technology has a Code Injection vulnerability. Unauthenticated remote attackers can trick users into opening a crafted link to inject and execute arbitrary JavaScript. After the user confirms a Windows securit… High Network Exploitable Wed, 14 Oct 2026 02:56:55 GMT https://vulnogram.org/CVE-2026-107459 https://vulnogram.org/CVE-2026-107459 The SecuShare Pro developed by Openfind has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on the server. Critical Network Exploitable Thu, 08 Oct 2026 05:53:46 GMT https://vulnogram.org/CVE-2026-102459 https://vulnogram.org/CVE-2026-102459 EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability. Unauthenticated remote attackers can execute arbitrary JavaScript codes in user's browser through phishing attacks. Medium Network Exploitable Wed, 30 Sep 2026 08:35:41 GMT https://vulnogram.org/CVE-2026-102458 https://vulnogram.org/CVE-2026-102458 EasyFlow .NET developed by Digiwin has a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain other users' plaintext passwords through a specific API. Critical Network Exploitable Wed, 30 Sep 2026 08:34:09 GMT https://vulnogram.org/CVE-2026-102457 https://vulnogram.org/CVE-2026-102457 EasyFlow .NET developed by Digiwin has an Arbitrary File Read vulnerability. Authenticated remote attackers can exploit this vulnerability to download arbitrary system files. High Wed, 30 Sep 2026 08:32:38 GMT https://vulnogram.org/CVE-2026-102456 https://vulnogram.org/CVE-2026-102456 EasyFlow .NET developed by Digiwin has an SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read database contents. High Wed, 30 Sep 2026 08:30:47 GMT https://vulnogram.org/CVE-2026-102455 https://vulnogram.org/CVE-2026-102455 EasyFlow .NET developed by Digiwin has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content. Critical Network Exploitable Wed, 30 Sep 2026 08:29:29 GMT https://vulnogram.org/CVE-2026-102454 https://vulnogram.org/CVE-2026-102454 EasyFlow .NET developed by Digiwin has an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server. High Wed, 30 Sep 2026 08:26:06 GMT https://vulnogram.org/CVE-2026-97181 https://vulnogram.org/CVE-2026-97181 GPM LIGHT developed by ezGlobal has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can directly access system logs. Medium Network Exploitable Thu, 24 Sep 2026 07:07:49 GMT https://vulnogram.org/CVE-2026-15027 https://vulnogram.org/CVE-2026-15027 CGServiSign developed by Changing has a OS Command Injection vulnerability. Unauthenticated remote attackers can induce victims to visit a malicious web page and inject arbitrary OS commands through the local service interface, resulting in command e… High Network Exploitable Wed, 23 Sep 2026 08:18:49 GMT https://vulnogram.org/CVE-2026-93468 https://vulnogram.org/CVE-2026-93468 The OAKlouds developed by HGiga has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit Relative Path Traversal to read arbitrary system files. High Network Exploitable Fri, 18 Sep 2026 02:19:04 GMT https://vulnogram.org/CVE-2026-93467 https://vulnogram.org/CVE-2026-93467 The OAKlouds developed by HGiga has a Insecure Deserialization vulnerability. Unauthenticated remote attackers can execute arbitrary code on the server by sending maliciously crafted serialized content. Critical Network Exploitable Fri, 18 Sep 2026 02:17:26 GMT https://vulnogram.org/CVE-2026-90891 https://vulnogram.org/CVE-2026-90891 ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Improper Access Control vulnerability. Authenticated local attackers can send a specially crafted IOCTL request to cause the driver to write to improperly restricted I/O port… Medium Mon, 14 Sep 2026 10:37:57 GMT https://vulnogram.org/CVE-2026-90890 https://vulnogram.org/CVE-2026-90890 ASRock Polychrome SYNC/RGB software utility developed by ASRock Inc. has an Untrusted Pointer Dereference vulnerability. Authenticated local attackers can send a specially crafted IOCTL request to cause the driver to dereference an unvalidated pointe… Medium Mon, 14 Sep 2026 10:35:49 GMT https://vulnogram.org/CVE-2026-89180 https://vulnogram.org/CVE-2026-89180 EFence developed by Thinking Software Technology has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents. High Network Exploitable Mon, 14 Sep 2026 10:27:26 GMT https://vulnogram.org/CVE-2026-89179 https://vulnogram.org/CVE-2026-89179 WeenyGenius, a computer lab management system by Howyar Technologies, has a Missing Support for Integrity Check vulnerability. Unauthenticated attackers on the same network can intercept a student's connection packet and replay it, thereby forging th… Medium Fri, 11 Sep 2026 07:37:21 GMT https://vulnogram.org/CVE-2026-89178 https://vulnogram.org/CVE-2026-89178 WeenyGenius, a computer lab management system by Howyar Technologies, has an Origin Validation Error vulnerability. Unauthenticated attackers on the same network can spoof the teacher workstation and send broadcast packets, causing student computers… High Fri, 11 Sep 2026 07:36:25 GMT https://vulnogram.org/CVE-2026-89177 https://vulnogram.org/CVE-2026-89177 WeenyGenius, a computer lab management system by Howyar Technologies, has a Use of Insecure Protocol vulnerability. Due to the reliance on ZMTP Null mode, unauthenticated attackers on the same network can capture packets to leak transmitted data, or… High Fri, 11 Sep 2026 07:35:40 GMT https://vulnogram.org/CVE-2026-89176 https://vulnogram.org/CVE-2026-89176 WeenyGenius, a computer lab management system developed by Howyar Technologies, has a Missing Authentication vulnerability. Unauthenticated attackers on the same network can easily spoof student or teacher endpoints. Impersonating a student can disru… High Fri, 11 Sep 2026 07:34:56 GMT https://vulnogram.org/CVE-2026-89175 https://vulnogram.org/CVE-2026-89175 Smart Video Intercom System developed by Kingdom Communication Associated has a Client-Side Authentication vulnerability. Unauthenticated remote attackers can bypass authentication to access specific pages and obtain partial system configuration valu… Medium Network Exploitable Fri, 11 Sep 2026 07:34:04 GMT https://vulnogram.org/CVE-2026-89174 https://vulnogram.org/CVE-2026-89174 Smart Video Intercom System developed by Kingdom Communication Associated has a Missing Brute-force Protection vulnerability. Unauthenticated remote attackers can gain access to valid accounts through a large number of login attempts. High Network Exploitable Fri, 11 Sep 2026 07:31:15 GMT https://vulnogram.org/CVE-2026-89173 https://vulnogram.org/CVE-2026-89173 Smart Video Intercom System developed by Kingdom Communication Associated has a Sensitive Data Exposure vulnerability. Unauthenticated remote attackers can enumerate valid user accounts by exploiting differences in system responses. Medium Network Exploitable Fri, 11 Sep 2026 07:27:52 GMT https://vulnogram.org/CVE-2026-87747 https://vulnogram.org/CVE-2026-87747 The Enterprise Cloud Database developed by Ragic has an Arbitrary File Read vulnerability. Privileged remote attackers can exploit Relative Path Traversal to download arbitrary system files. Medium Wed, 09 Sep 2026 06:30:36 GMT https://vulnogram.org/CVE-2026-85541 https://vulnogram.org/CVE-2026-85541 DreamMaker developed by Interinfo has a Reflected Cross-site Scripting vulnerability. Authenticated remote attackers can execute arbitrary JavaScript codes in user's browser via a malicious website. Medium Fri, 04 Sep 2026 09:35:26 GMT https://vulnogram.org/CVE-2026-85540 https://vulnogram.org/CVE-2026-85540 DreamMaker developed by Interinfo has a SQL Injection vulnerability. Authenticated remote attackers can inject arbitrary SQL commands to read, modify, and delete database contents. High Fri, 04 Sep 2026 09:34:46 GMT https://vulnogram.org/CVE-2026-85149 https://vulnogram.org/CVE-2026-85149 SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SFTP service credentials of the SmartIT Agent application from the source code, thereby browsing the fil… Medium Network Exploitable Fri, 04 Sep 2026 02:35:59 GMT https://vulnogram.org/CVE-2026-85148 https://vulnogram.org/CVE-2026-85148 SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed password to remotely access user hosts. Critical Network Exploitable Fri, 04 Sep 2026 02:34:45 GMT https://vulnogram.org/CVE-2026-85147 https://vulnogram.org/CVE-2026-85147 SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain a specific password from the source code, which can be used to retrieve the AES encryption key used for comm… High Network Exploitable Fri, 04 Sep 2026 02:32:40 GMT https://vulnogram.org/CVE-2026-85146 https://vulnogram.org/CVE-2026-85146 SmartIT Desktop Manager developed by Lightstar has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can obtain the SSH service account credentials and passwords for the SmartIT Agent directly from the application source… Critical Network Exploitable Fri, 04 Sep 2026 02:31:41 GMT https://vulnogram.org/CVE-2026-82181 https://vulnogram.org/CVE-2026-82181 Medical Practice Management System developed by Le-yan has a Sensitive Data in URL vulnerability. Unauthenticated remote attackers can obtain sensitive information via victim's browser history or log files. Medium Fri, 28 Aug 2026 11:52:48 GMT https://vulnogram.org/CVE-2026-82082 https://vulnogram.org/CVE-2026-82082 NUMail developed by Green-Computing has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject arbitrary OS commands and execute them on the server. Critical Network Exploitable Fri, 28 Aug 2026 03:12:09 GMT https://vulnogram.org/CVE-2026-80237 https://vulnogram.org/CVE-2026-80237 EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Authenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server. High Wed, 26 Aug 2026 08:28:14 GMT https://vulnogram.org/CVE-2026-80236 https://vulnogram.org/CVE-2026-80236 Efence developed by Thinking Software Technology has a SQL Injection vulnerability. Unauthenticated remote attackers can access file upload functionality and read database contents. High Network Exploitable Wed, 26 Aug 2026 08:27:12 GMT https://vulnogram.org/CVE-2026-80235 https://vulnogram.org/CVE-2026-80235 EFence developed by Thinking Software Technology has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload and execute web shell backdoors, thereby enabling arbitrary code execution on the server. Critical Network Exploitable Wed, 26 Aug 2026 08:26:12 GMT https://vulnogram.org/CVE-2026-80234 https://vulnogram.org/CVE-2026-80234 CAYIN CMS-WS and CMS-SE developed by CAYIN Technology have a Missing Authentication vulnerability. Unauthenticated remote attackers can obtain media file lists via specific functionality, resulting in partial information disclosure. Medium Network Exploitable Wed, 26 Aug 2026 08:22:13 GMT https://vulnogram.org/CVE-2026-80233 https://vulnogram.org/CVE-2026-80233 CAYIN CMS-WS, CMS-SE, and SMP series products developed by CAYIN Technology have an Arbitrary File Upload vulnerability. Privileged remote attackers can upload and execute web shells backdoors, thereby enabling arbitrary code execution on the server. High Wed, 26 Aug 2026 08:19:40 GMT https://vulnogram.org/CVE-2026-78685 https://vulnogram.org/CVE-2026-78685 Medical Practice Management System developed by Le-yan has a Remote Code Execution vulnerability. Unauthenticated remote attackers can execute arbitrary OS commamnds via a crafted HTML page. High Network Exploitable Tue, 25 Aug 2026 02:05:09 GMT https://vulnogram.org/CVE-2026-78213 https://vulnogram.org/CVE-2026-78213 Heptabase developed by Hepta Platforms, Inc. has a Stored Cross-Site Scripting vulnerability. Authenticated remote attackers can inject persistent malicious content into specific pages, causing arbitrary JavaScript code to execute when other users cl… High Mon, 24 Aug 2026 03:50:19 GMT https://vulnogram.org/CVE-2026-78212 https://vulnogram.org/CVE-2026-78212 4MOSAn developed by 4MOSAn Security Technology Co., Ltd. has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit a Relative Path Traversal flaw to download arbitrary system files. High Network Exploitable Mon, 24 Aug 2026 03:36:28 GMT https://vulnogram.org/CVE-2026-19852 https://vulnogram.org/CVE-2026-19852 NewSiteServer (NSS) developed by CyberTutor has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload arbitrary files, including malicious HTML files, thereby achieving effects similar to cross-site scripting. Medium Network Exploitable Mon, 24 Aug 2026 03:35:01 GMT