CVE WatchJul 9, 2026

CVE-2024-37858

SQL Injection vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the id parameter to

CVSS

9.8

Critical

EPSS

0.8%

p52

KEV

—

Exploit Today

0-100

Published: Jul 29, 2024 · Last modified: Jul 9, 2026 · CWE-89 · CWE-269

EPSS · 30d

0.8%EPSS · 30 days0.9%

2026-06-302026-07-16

Technical description

SQL Injection vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the id parameter to php-lfis/admin/categories/manage_category.php.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-422089.8 CRI

99.7%

KEV—80BerriAI LiteLLM SQL Injection Vulnerability3d CVE-2026-468179.8 CRI

60.3%

KEV—68Oracle E-Business Suite Improper Privilege Management Vulnerability1d CVE-2020-249139.8 CRI

98.5%

——30A SQL injection vulnerability in qcubed (all versions including 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request.9d CVE-2026-479927.2 HIG

97.1%

——29Adobe Commerce is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could exploit this vulnerability to execute malicious SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction.2d CVE-2022-250899.8 CRI

96.9%

——29Printix Secure Cloud Print Management through 1.3.1106.0 incorrectly uses Privileged APIs to modify values in HKEY_LOCAL_MACHINE via UITasks.PersistentRegistryData.9d CVE-2022-366358.8 HIG

96.7%

——29ZKteco ZKBioSecurity V5000 4.1.3 was discovered to contain a SQL injection vulnerability via the component /baseOpLog.do.9d