2026-02-27 Daily Vulns

NEW:

CVE	vendor-product	description	metric	Referenceurl	title	GithubURL
CVE-2019-25450	Dolibarr - Dolibarr ERP/CRM	Dolibarr ERP/CRM 10.0.1 contains multiple SQL injection vulnerabilities that allow authenticated attackers to manipulate database queries by injecting SQL code through POST parameters. Attackers can inject malicious SQL through parameters like actioncode, demand_reason_id, and availability_id in card.php endpoints to extract sensitive database information using boolean-based blind, error-based, and time-based blind techniques.	CVSS4.0: 7.1 - HIGH CVSS3.1: 7.1 - HIGH	0 1	Exploitation: pocAutomatable: noTechnical Impact: partial	Dolibarr ERP/CRM 10.0.1 SQL Injection via card.php	github
CVE-2019-25443	edlangley - inventory-webapp	Inventory Webapp contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through GET parameters. Attackers can supply malicious SQL payloads in the name, description, quantity, or cat_id parameters to add-item.php to execute arbitrary database commands.	CVSS4.0: 8.8 - HIGH CVSS3.1: 8.2 - HIGH	0 1	Exploitation: pocAutomatable: yesTechnical Impact: partial	Inventory Webapp SQL Injection via add-item.php	github
CVE-2021-1452	Cisco - Cisco IOS XE ROMMON Software	A vulnerability in the ROM Monitor (ROMMON) of Cisco IOS XE Software for Cisco Catalyst IE3200, IE3300, and IE3400 Rugged Series Switches, Cisco Catalyst IE3400 Heavy Duty Series Switches, and Cisco Embedded Services 3300 Series Switches could allow an unauthenticated, physical attacker to execute unsigned code at system boot time. This vulnerability is due to incorrect validations of specific function arguments passed to a boot script when specific ROMMON variables are set. An attacker could exploit this vulnerability by setting malicious values for a specific ROMMON variable. A successful exploit could allow the attacker to execute unsigned code and bypass the image verification check during the secure boot process of an affected device. To exploit this vulnerability, the attacker would need to have unauthenticated, physical access to the device or obtain privileged access to the root shell on the device.	CVSS3.1: 6.8 - MEDIUM	0	Exploitation: noneAutomatable: noTechnical Impact: total	Cisco IOS XE ROM Monitor Software for Cisco Industrial Switches OS Command Injection Vulnerability	github