CVE-2026-9420

MediumCVSS 6.3/10Last modified Jul 23, 2026

Description

A vulnerability was found in KLiK SocialMediaWebsite 1.0. This affects an unknown part of the component HTTP GET Request Parameter Handler. The manipulation results in injection. It is possible to launch the attack remotely. The exploit has been made public and could be used.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74 CWE-707

Affected software

No affected versions have been published.

Timeline

Published: May 25, 2026
Last modified: Jul 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-942008.2Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and tls_client_ticket_stor CVE-2026-942018.2Ash stores :atom-typed attributes as strings and compares them as strings. When such an attribute is referenced in a filter, the comparison CVE-2026-942024.8The Module Manager's block-pool create dispatcher proved that two `ALIGN_TYPE` words of the extra-parameter array a memory-protected module CVE-2026-942047.5The central cloud storage backend for the entire dashcam platform is misconfigured with public-read permissions, allowing unrestricted acces CVE-2026-942059.8Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request CVE-2026-942066.3Use of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an CVE-2026-94217.3A vulnerability was determined in KLiK SocialMediaWebsite 1.0. This vulnerability affects the function uniqid of the file upload.inc.php of CVE-2026-942103.5A flaw has been found in Hyve5 Leantime up to 3.9.8. Affected by this vulnerability is the function getAllGrouped of the file app/Domain/Tic CVE-2026-942112.4A vulnerability has been found in Hyve5 Leantime up to 3.9.8. Affected by this issue is some unknown functionality of the file /app/Domain/D CVE-2026-942126.4Improper verification of cryptographic signature vulnerability in Apache APISIX. Any unauthenticated attacker could impersonate any user CVE-2026-942134.9A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occu CVE-2026-942144.3A vulnerability was found in ST Engineering iDirect iDX and Evo iDX. This affects an unknown part of the component Location Header Handler.