rootpwn

high · CVSS v3 7.3 · CVSS v4 6.9

CVE-2026-94110

A security vulnerability has been detected in QCMS up to 6.0.6. This issue affects the function self_Tmp in the library …

Description

A security vulnerability has been detected in QCMS up to 6.0.6. This issue affects the function self_Tmp in the library Lib/Config/Controllers.php of the component Content Detail Page. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Router uses raw REQUEST_URI without URL decoding, so payloads must contain literal spaces - %20 never decodes before route parsing. The support team of the vendor was contacted early about this disclosure. Unfortunately, they responded just with profanity.

Scores

Severity
high
CVSS v2
7.5
CVSS v3
7.3
CVSS v4
6.9
EPSS
—

← All CVEs

Related CVEs

high

CVE-2026-93974

CVE-2026-93974 details a SQL injection vulnerability in SourceCodester Online Reviewer Management System 1.0. The vulnerability exists within the `/reviewer_0/admins/assessments/databank/btn_functions.php` file, specifically affecting the `ID` argument. Publicly available exploit code increases the risk of remote compromise.

View analysis

high

CVE-2026-88855

The OrdaSoft Joomla Gallery extension (v<6.2.7) contains an authenticated, privileged SQL injection that allows a core.manage user to read and write the database, including extracting user password hashes. This flaw arises from unsanitized form data being concatenated into SQL queries. It enables attackers with gallery‑management rights to compromise the entire site’s data integrity and confidentiality.

View analysis

high

CVE-2026-94090

JusticeRage Manalyze 1.0.0 contains a remote integer underflow in the PE::_parse_debug function that can corrupt memory or crash the parser. The flaw allows attackers to manipulate the misc.Length argument, potentially leading to denial of service or unintended data exposure. Prompt patching is essential to mitigate these risks.

View analysis

high

CVE-2026-94093

A security vulnerability has been detected in DLR-RM stable-baselines3 up to 2.9.0. This affects the function PPO.load/load_replay_buffer/VecNormalize.load of the file save_util.py. Such manipulation leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. In v2.9.0 the PyTorch tensor load path is hardened (weights_only=True), but that hardening was later reverted on master via PR #1913 "Hotfix: revert loading with weights_only=True" [blocked] to fix PyTorch 1.13 compat - so even the one "safe" path is inconsistent across versions. #2281 was closed as a duplicate of #1831 since both are unsafe pickle deserialization - but #1831's fix (PR #41) only gated the Hugging Face Hub loader in the separate huggingface_sb3 package. This finding covers the core stable_baselines3 load APIs (PPO.load, load_replay_buffer, VecNormalize.load), which have no safe mode or gate and remained exploitable in v2.9.0 until the outstanding hardening (PR #2264) ships.

View analysis