Vulnerability Research
2026
- CVE-2026-82802: Unauthenticated Response-Reflecting SSRF in NASA Earthdata Search (OpenSearch granule endpoint) Aug 31
- CVE-2026-82801: Unauthenticated SSRF and Internal Host Discovery in NASA Earthdata Search Aug 31
- CVE-2026-12188: grit42 — SQL Injection in CSV Export Endpoint Jun 14
- CVE-2026-7681: COCO Annotator — Unauthenticated Dataset Modification via Missing Authentication May 3
- CVE-2026-7680: COCO Annotator — Path Traversal via Dataset Folder Parameter May 3
- CVE-2026-2109: COCO Annotator — Broken Function Level Authorization in Undo Endpoint Feb 7
- CVE-2026-2108: COCO Annotator — Unauthenticated Denial of Service via Task Queue Flood Feb 7
- CVE-2026-2064: i-Educar — Stored XSS via Profile Picture Upload Feb 6
2025
- CVE-2025-9823: Reflected XSS in lead:addLeadTags - Quick Add Sep 3
- CVE-2025-9404: Storage Cross-Site Scripting (XSS) in endpoint pointHIerarchySLTS parameter title Aug 25
- CVE-2025-9139: Sensitive User Information Disclosure via WatchListDwr.init.dwr Endpoint Aug 19
- CVE-2025-8790: Broken Object Level Authorization (BOLA) in pessoa API Endpoint Allows Unauthorized Access to Other Users Data Aug 10
- CVE-2025-8789: Broken Function Level Authorization (BFLA) allows unauthorized users to alter student grades Aug 10
- CVE-2025-8510: Reflected Cross-Site Scripting (XSS) in educar_matricula_lst.php via ref_cod_aluno Parameter Aug 3
- CVE-2025-8365: Multiples Cross-Site Scripting (XSS) Stored in endpoint atendidos_cad.php Jul 31
- CVE-2025-8346: Cross-Site Scripting (XSS) Reflected endpoint educar_aluno_lst.php via ref_cod_matricula parameter Jul 31
- CVE-2025-7871: Cross-Site Scripting (XSS) Reflected endpoint conteudos parameter filter[by_description] Jul 20
- CVE-2025-7870: Cross-Site Scripting (XSS) Storage Injection via SVG Upload Jul 20
- CVE-2025-7729: Cross-Site Scripting (XSS) Stored endpoint usersProfiles.shtm parameter userprofilename Jul 17
- CVE-2025-7728: Cross-Site Scripting (XSS) Stored endpoint users.shtm parameter username Jul 17
- CVE-2025-53527: SQL Injection Vulnerability in tipo and responsavel Parameters on relatorio_geracao.php Endpoint Jul 7
- CVE-2025-53091: Unauthenticated Time-Based SQL Injection Vulnerability in almox Parameter Jun 27
- CVE-2025-52474: SQL Injection Vulnerability in id Parameter on control.php Endpoint Jun 19
- CVE-2025-30367: SQL Injection endpoint control.php parameter nextPage Mar 27
- CVE-2025-30366: Multiples Stored XSS in personalizacao.php Mar 27
- CVE-2024-57035: SQL Injection Vulnerability in nextPage Parameter on control.php Endpoint Jan 17
- CVE-2024-57034: SQL Injection in query_geracao_auto.php Jan 17
- CVE-2024-57033: Cross-Site Scripting (XSS) Stored in documentos_funcionario.php parameter dados_addInfo Jan 17
- CVE-2024-57032: Broken Authentication - Old Password Jan 17
- CVE-2024-57031: SQL Injection (Blind Time-Based) in remuneracao.php parameter id_funcionario Jan 17
- CVE-2024-57030: Cross-Site Scripting (XSS) Stored in documentos_funcionario.php parameter id Jan 17
- CVE-2025-22600: Cross-Site Scripting (XSS) Reflected endpoint configuracao_doacao.php parameter avulso Jan 10
- CVE-2025-22599: Cross-Site Scripting (XSS) Reflected endpoint home.php parameter msg_c Jan 10
- CVE-2025-22139: Cross-Site Scripting (XSS) Reflected endpoint configuracao_geral.php parameter msg Jan 8
- CVE-2025-22133: Arbitrary File Upload with Remote Code Execution (RCE) Jan 7
- CVE-2025-22132: Cross-Site Scripting (XSS) in File Upload Field Jan 7
2024