CVE-2026-92799

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in all versions up to, and including, 28.2. This is due to the postValidateCustomer function using a loose PHP inequality operator != to compare the...

CVE-2026-92799

The Bookly plugin for WordPress is vulnerable to an Authorization Bypass in all versions up to and including 28.2 . The root cause is PHP Type Juggling within the postValidateCustomer() function, which uses a loose inequality operator (!=) to compare a session-stored one-time verification code ag...

CVE-2026-92799 Online Scheduling and Appointment Booking System <= 28.2 - Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in all versions up to, and including, 28.2. This is due to the postValidateCustomer function using a loose PHP inequality operator != to compare the...

EUVD-2026-86543

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in all versions up to, and including, 28.2. This is due to the postValidateCustomer function using a loose PHP inequality operator != to compare the...

CVE-2026-92799 Online Scheduling and Appointment Booking System <= 28.2 - Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in all versions up to, and including, 28.2. This is due to the postValidateCustomer function using a loose PHP inequality operator != to compare the...

CVE-2026-62993

A flaw was found in Smarty, a PHP template engine. The fetch function, when a security policy was active, only validated the initial remote URL against a trusteduri allowlist. However, PHP's filegetcontents function, used for resources including HTTPS URLs, followed HTTP redirects by default. Thi...

CVE-2026-97730

A Local File Inclusion (LFI) vulnerability exists in Netgate pfSense Plus before version 26.07 and pfSense CE before version 2.9.0. The flaw resides in the Dashboard (index.php) widget sequence data handling. An authenticated attacker with permissions to modify Dashboard settings and write files ...

EUVD-2026-86509

In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion LFI vulnerability in the Dashboard index.php widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard...

CVE-2026-97730

In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion LFI vulnerability in the Dashboard index.php widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard...

CVE-2026-97730

In Netgate pfSense Plus before 26.07 and pfSense CE before 2.9.0, a Local File Inclusion LFI vulnerability in the Dashboard index.php widget sequence data handling allows an authenticated attacker to execute arbitrary PHP code. To exploit this, an attacker with privileges to modify Dashboard...

CVE-2026-92799: Improper Authorization

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in all versions up to, and including, 28.2. This is due to the postValidateCustomer function using a loose PHP inequality operator != to compare the...

CVE-2026-44642: Improper Neutralization of Special Elements used in an SQL Command

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, checkupgradeaccessrights in admin/include/functionsupgrade.php conditionally escapes the submitted username only when the removed getmagicquotesgpc function exists, so PHP 8 and later concatenate an...

PT-2026-99109

Name of the Vulnerable Software and Affected Versions GestSup versions prior to 3.2.61 Description An issue exists in the basic IMAP connector's attachment handling that fails to skip blocked file extensions. Unauthenticated attackers can send emails containing PHP attachments to monitored...

PT-2026-98961

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote SQL injection exists in the updatefaculty.php file. The issue occurs when the fid argument is manipulated, allowing an attacker to execute...

CVE-2026-17545: Improper Handling of Windows Device Names

On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW and opens a device instead of the...

CVE-2026-100389: Unrestricted Upload of File with Dangerous Type

GestSup versions before 3.2.62 contain a remote code execution vulnerability in the basic IMAP connector's attachment handling that fails to skip blocked file extensions. Unauthenticated attackers can send emails with PHP attachments to monitored mailboxes, which are written to the web-accessible...

PT-2026-98370

Name of the Vulnerable Software and Affected Versions Online Scheduling and Appointment Booking System – Bookly versions prior to 28.3 Description An authorization bypass exists due to PHP Type Juggling, a condition where PHP converts a variable from one data type to another during a comparison...

PT-2026-98956

Name of the Vulnerable Software and Affected Versions mathurvishal CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote SQL injection is possible due to the improper handling of the gid argument within an unknown function in the updatequery.php...

PT-2026-99048

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote SQL injection exists in the managevideos2.php file. This issue occurs when the editassid argument is manipulated, allowing an attacker to...

CVE-2026-97886: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected by this vulnerability is an unknown functionality of the file managevideos2.php. Such manipulation of the argument editassid leads to sql injection. The attack may be...