CVE-2026-19196

CVE-2026-19196 affects SourceCodester Photo Share Website 1.0. The vulnerable element is the unknown function in the file /social/ajax.php?action=login , where manipulation of the email parameter leads to a SQL injection . The attack can be launched remotely and the exploit has been publicly disc...

CVE-2026-19196 SourceCodester Photo Share Website ajax.php login sql injection

A vulnerability was found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=login. The manipulation of the argument email results in sql injection. The attack can be launched remotely. The exploit has been made public and...

CVE-2026-19196 SourceCodester Photo Share Website ajax.php login sql injection

A vulnerability was found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=login. The manipulation of the argument email results in sql injection. The attack can be launched remotely. The exploit has been made public and...

EUVD-2026-54369

A vulnerability was found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=login. The manipulation of the argument email results in sql injection. The attack can be launched remotely. The exploit has been made public and...

EUVD-2026-54204

The miniOrange 2FA WordPress plugin before 6.2.8 does not correctly limit the number of second-factor verification attempts, tracking them against a client-supplied identifier that is reissued on every login, allowing an attacker who already knows a user's password to guess the one-time code...

EUVD-2026-54199

The Security Optimizer WordPress plugin from 1.5.8 to 1.6.4 does not correctly validate requests to its optional IP-based login restriction feature, allowing the restriction to be bypassed so that unauthenticated requests from non-allowlisted IP addresses can reach and use the login form, defeati...

PT-2026-76008

Craft CMS passkey login accepts WebAuthn requestOptions from the unauthenticated login request body and does not persist the updated credential counter returned by the WebAuthn assertion validator. A captured passkey login request body can therefore be replayed because the old challenge is accept...

CVE-2026-64638: Improper Neutralization of Input During Web Page Generation

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires...

PT-2026-68866

Name of the Vulnerable Software and Affected Versions MStore API versions prior to 4.21.0 Description The MStore API WordPress plugin fails to properly verify the cryptographic signature of the token used during phone-based login authentication. This flaw allows an unauthenticated attacker who...

PT-2026-69148

Name of the Vulnerable Software and Affected Versions HKUDS nanobot versions prior to 0.3.0 Description A flaw in the Login-shell Environment Handler allows local attackers to cause information disclosure. The issue exists in the ExecTool. prepare command function within the...

PT-2026-68855

Name of the Vulnerable Software and Affected Versions SourceCodester Photo Share Website version 1.0 Description A remote SQL injection is possible due to improper handling of the email variable within an unknown function of the '/social/ajax.php?action=login' endpoint. SQL injection is a techniq...

CVE-2026-19196: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=login. The manipulation of the argument email results in sql injection. The attack can be launched remotely. The exploit has been made public and...

Linux Distros Unpatched Vulnerability : CVE-2026-64638

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an...

CVE-2026-16262: Cross-Site Request Forgery (CSRF)

The Estatik Real Estate Plugin WordPress plugin before 4.3.3 does not bind its OAuth social login flow to the initiating user session, allowing an unauthenticated attacker to log a victim into an attacker-controlled account login CSRF, so that the victim's subsequent activity is stored under and...

CVE-2026-54338: Uncontrolled Resource Consumption

JupyterHub is software that allows users to create a multi-user server for Jupyter notebooks. Prior to 5.5.0, invalid input to form-based login authenticators can place an unbounded attacker-controlled username in failed-login logs, allowing an unauthenticated attacker to consume logging and...

PT-2026-68871

Name of the Vulnerable Software and Affected Versions Estatik Real Estate Plugin WordPress plugin versions prior to 4.3.3 Description The plugin fails to bind its OAuth social login flow to the initiating user session. This allows an unauthenticated attacker to perform a login CSRF Cross-Site...

CVE-2026-19245: Exposure of Sensitive Information to an Unauthorized Actor

A flaw has been found in HKUDS nanobot up to 0.2.1. The impacted element is the function ExecTool.preparecommand of the file nanobot/agent/tools/shell.py of the component Login-shell Environment Handler. Executing a manipulation can lead to information disclosure. The attack requires local access...

CVE-2026-64665

Statamic is a Laravel and Git powered content management system CMS. Prior to 5.74.1 and 6.24.0, when OAuth login was enabled with a provider that does not guarantee verified email addresses, an unauthenticated attacker could sign in as an existing user, potentially including a super admin, witho...

CVE-2026-48084

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Versions prior to 1.0.2 don't throttle failed passphrase login attempts. An attacker can submit unlimited wrong passphrase guesses against any known email address, capped only by the Argon2...

CVE-2026-47194

Frappe is a full-stack web application framework. Prior to 15.108.0 and 16.18.3, temporary magic login link generation can use an attacker-controlled request Host header, allowing a remote attacker to cause emailed login links to point to an attacker-controlled domain and capture the login token...