EUVD-2025-211252

vtenext before 25.02.2 contains a cross-site request forgery protection bypass because csrfcheck in include/utils/VteCsrf.php skips csrftoken validation for non-POST requests. Attackers can induce a logged-in user to open a crafted link sending state-changing GET requests, which handlers read fro...

CVE-2026-61671 WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classes

WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the /controle/control.php dispatch endpoint accepts attacker-controlled nomeClasse, metodo, and record identifier parameters through extract$REQUEST, including id, idatendido, idInterno, and...

CVE-2026-61671 WeGIA: Systemic IDOR + Missing CSRF — extract($_REQUEST) in All Controle Classes

WeGIA is a web manager for charitable institutions. Prior to the advisory's stated patched version 3.8.7, the /controle/control.php dispatch endpoint accepts attacker-controlled nomeClasse, metodo, and record identifier parameters through extract$REQUEST, including id, idatendido, idInterno, and...

CVE-2026-116823 YesWiki before 4.7.0 Reflected XSS via BazarField $_REQUEST Fallback

YesWiki before 4.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject JavaScript by supplying query parameters matching missing Bazar field names. Attackers can craft links where BazarField::getValue falls back to unsanitized $REQUEST values...

CVE-2026-116823 YesWiki before 4.7.0 Reflected XSS via BazarField $_REQUEST Fallback

YesWiki before 4.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject JavaScript by supplying query parameters matching missing Bazar field names. Attackers can craft links where BazarField::getValue falls back to unsanitized $REQUEST values...

CVE-2026-116823

Versions of YesWiki prior to 4.7.0 are vulnerable to a reflected cross-site scripting (XSS) vulnerability. The flaw exists because the BazarField::getValue() function falls back to unsanitized $_REQUEST values when Bazar field names are missing. These values are then rendered via Twig |raw templa...

CVE-2026-55684 WeGIA: SQL Injection in html/socio/sistema/cadastro_cobrancas_geracao.php

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastrocobrancasgeracao.php endpoint accepts form-encoded POST data through extract$REQUEST and interpolates codigo, descricao, dataemissao, datavencimento, datapagamento, valor,...

CVE-2026-55684

The WeGIA web manager for charitable institutions is vulnerable to SQL Injection in the web/html/socio/sistema/cadastro_cobrancas_geracao.php endpoint prior to version 3.8.6 . The application improperly handles form-encoded POST data via extract($_REQUEST), interpolating multiple parameters—inclu...

CVE-2026-55684 WeGIA: SQL Injection in html/socio/sistema/cadastro_cobrancas_geracao.php

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastrocobrancasgeracao.php endpoint accepts form-encoded POST data through extract$REQUEST and interpolates codigo, descricao, dataemissao, datavencimento, datapagamento, valor,...

CVE-2026-55681

The web manager WeGIA for charitable institutions is vulnerable to SQL Injection in versions prior to 3.8.6 . An authenticated user with access to the Material & Patrimônio module can exploit the id_produto parameter in web/html/matPat/restaurar_produto_desocultar.php. The root cause is a second ...

CVE-2026-55684: Improper Neutralization of Special Elements used in an SQL Command

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastrocobrancasgeracao.php endpoint accepts form-encoded POST data through extract$REQUEST and interpolates codigo, descricao, dataemissao, datavencimento, datapagamento, valor,...

UBUNTU-CVE-2026-97588

In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Map EBUSY to EIO when key conversion fails repeatedly When hardware persistently returns -EBUSY after exhausting retries, the error propagates to cryptofinalizerequest. The crypto API's completion wrapper treats -EBU...

CVE-2026-76579 LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVE-2026-89247

WWBN AVideo at commit c3edcc274c389816d434acadac07ee78eaf330c1 and earlier contains an XML injection vulnerability in plugin/ADServer/VMAP.php, which is reachable without authentication when the ADServer plugin is enabled. The script emits Content-Type: application/xml and writes the timeOffset a...

CVE-2026-31939

Chamilo LMS is a learning management system. Prior to 1.11.38, there is a path traversal in main/exercise/savescores.php leading to arbitrary file feletion. User input from $REQUEST'test' is concatenated directly into filesystem path without canonicalization or traversal checks. This vulnerabilit...

CVE-2026-31939: Improper Limitation of a Pathname to a Restricted Directory

Chamilo LMS is a learning management system. Prior to 1.11.38, there is a path traversal in main/exercise/savescores.php leading to arbitrary file feletion. User input from $REQUEST'test' is concatenated directly into filesystem path without canonicalization or traversal checks. This vulnerabilit...

CVE-2026-33991

WeGIA is a web manager for charitable institutions. Prior to version 3.6.7, the file "html/socio/sistema/deletartag.php" uses "extract$REQUEST" on line 14 and directly concatenates the "$idtag" variable into SQL queries on lines 16-17 without prepared statements or sanitization. Version 3.6.7...

CVE-2026-33764

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the AI plugin's "save.json.php" endpoint loads AI response objects using an attacker-controlled "$REQUEST'id'" parameter without validating that the AI response belongs to the specified video. An authenticated use...

CVE-2026-34375: Improper Neutralization of Input During Web Page Generation

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the YPTWallet Stripe payment confirmation page directly echoes the $REQUEST'plugin' parameter into a JavaScript block without any encoding or sanitization. The plugin parameter is not included in any of the...

CVE-2026-33991: Improper Neutralization of Special Elements used in an SQL Command

WeGIA is a web manager for charitable institutions. Prior to version 3.6.7, the file html/socio/sistema/deletartag.php uses extract$REQUEST on line 14 and directly concatenates the $idtag variable into SQL queries on lines 16-17 without prepared statements or sanitization. Version 3.6.7 patches t...