CVE-2026-73185

CriticalCVSS 9.3/10Last modified Aug 20, 2026

Description

Unauthenticated SQL Injection in NGG Smart Image Search < 4.0.0 versions.

Metrics

CVSS 3.1 9.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Weakness enumeration

CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Aug 19, 2026
Last modified
Aug 20, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-731879.3Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions.CVE-2026-73197.3A flaw has been found in elinsky execution-system-mcp 0.1.0. The impacted element is the function _get_context_file_path of the file src/exeCVE-2026-731907.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in W3 Eden WPDM – Premium Packages wpdm-pCVE-2026-731916.1URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Syncope. When the Syncope SRA is configured for CAS authentCVE-2026-731926.1An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getValiCVE-2026-731939.8DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size compuCVE-2026-731949.1DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in pCVE-2026-731957.3Improper Encoding or Escaping of Output vulnerability in Apache Syncope. Authenticated users can store a spreadsheet formula payload in oCVE-2026-731966.5A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password CVE-2026-731977.5A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to thCVE-2026-731987.5A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending CVE-2026-731996.5A flaw was found in the `ipa-enrollment` SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by
CVE-2026-73185: Critical severity, CVSS 9.3 | Vulnix