Vulnerability intelligence

CVE-2026-84147 is a vulnerability identified within an Enterprise Resource Planning (ERP) system. This flaw stems from improper authentication controls and insufficient file type validation at an API endpoint. An unauthenticated remote attacker could exploit this vulnerability. Successful exploitation could potentially allow the attacker to execute arbitrary code and compromise the target system.

CVE-2026-84148 is a vulnerability found within an ERP system, stemming from inadequate authentication and authorization controls present in its API endpoint. This flaw could allow an unauthenticated remote attacker to exploit the system through manipulation.

CVE-2026-84149 is an information disclosure vulnerability found in the Manacle Technologies Multi-tenant ERP System. This flaw stems from a publicly accessible `.git` directory located on the application's web server. An unauthenticated, remote attacker can exploit this vulnerability by accessing the exposed `.git` directory. This allows them to browse or download the repository metadata, which can then be used to reconstruct parts of the application's source code. Such an exposure could potentially reveal sensitive data, including embedded credentials, API keys, and internal application logic. The vulnerability is categorized under CWE-527, which refers to the exposure of a version-control repository to an unauthorized control sphere.

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 (104997). The /pa endpoint processes XML content beginning with <PolycomIPPhone> and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated remote attacker can execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution.

CVE-2026-83549 is a post-authentication operating system command injection vulnerability found in the Appliance Management Console (AMC) of SonicWall SMA 1000 series appliances. This flaw, categorized as an improper neutralization of special elements used in an OS command (CWE-78), could allow a remote authenticated attacker with administrator privileges to execute arbitrary operating system commands under specific conditions. The vulnerability affects SonicWall SMA 1000 models 6210, 7210, and 8200v, specifically in versions 12.4.3-03453 (platform-hotfix) and older, and 12.5.0-02835 (platform-hotfix) and older. It has been observed in active exploitation, often chained with CVE-2026-83548, a pre-authentication server-side request forgery vulnerability, to achieve remote code execution.

CVE-2026-83548 is identified as a pre-authentication Server-Side Request Forgery (SSRF) vulnerability present in the SonicWall SMA1000 Appliance WorkPlace interface. This flaw stems from an unintended alternate access path, which causes the appliance to function as an unintended forward proxy. Exploitation of this vulnerability allows a remote and unauthenticated attacker to gain unauthorized access to sensitive functionalities and execute unauthorized operations. This vulnerability is often discussed alongside CVE-2026-83549, a post-authentication operating system command injection vulnerability, as threat actors have been observed chaining these two flaws in attacks.