CVE Watch9 jul 2026

CVE-2024-37858

SQL Injection vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the id parameter to

CVSS

9.8

Crítico

EPSS

0.8%

p52

KEV

—

Exploit Today

0-100

Publicado: 29 jul 2024 · Última mod.: 9 jul 2026 · CWE-89 · CWE-269

EPSS · 30d

0.8%EPSS · 30 días0.9%

2026-06-302026-07-16

Descripción técnica

SQL Injection vulnerability in Lost and Found Information System 1.0 allows a remote attacker to escalate privileges via the id parameter to php-lfis/admin/categories/manage_category.php.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-422089.8 CRÍ

99.7%

KEV—80BerriAI LiteLLM SQL Injection Vulnerability3d CVE-2026-468179.8 CRÍ

60.3%

KEV—68Oracle E-Business Suite Improper Privilege Management Vulnerability2d CVE-2020-249139.8 CRÍ

98.5%

——30A SQL injection vulnerability in qcubed (all versions including 3.1.1) in profile.php via the strQuery parameter allows an unauthenticated attacker to access the database by injecting SQL code via a crafted POST request.9d CVE-2026-479927.2 ALT

97.1%

——29Adobe Commerce is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could exploit this vulnerability to execute malicious SQL commands, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue does not require user interaction.2d CVE-2022-250899.8 CRÍ

96.9%

——29Printix Secure Cloud Print Management through 1.3.1106.0 incorrectly uses Privileged APIs to modify values in HKEY_LOCAL_MACHINE via UITasks.PersistentRegistryData.9d CVE-2022-366358.8 ALT

96.7%

——29ZKteco ZKBioSecurity V5000 4.1.3 was discovered to contain a SQL injection vulnerability via the component /baseOpLog.do.9d