CVE-2026-100739: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file viewresult.php. Performing a manipulation of the argument seno results in sql injection. Remote exploitation of the attack is...

CVE-2026-97160: Improper Control of Generation of Code

Joomla Extension - lomart.fr - Authenticated, privileged PHP command injection in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29...

CVE-2026-94132: Unrestricted Upload of File with Dangerous Type

Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension 11.1.0 - MIME parts of incoming emails were saved to media/comacym/upload/ with no extension check, so anyone who could email the monitored mailbox could write a PH...

CVE-2026-100311: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The affected element is an unknown function of the file managevideos2.php of the component Faculty Video Management. Such manipulation of the argument VTitle/VUrl/VRemarks lea...

CVE-2026-18143: Unrestricted Upload of File with Dangerous Type

The Request a Quote for WooCommerce plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.9.2 via the afrfqsubmitquoteviapopup function. This is due to missing file extension and MIME type validation in the popup upload handler, which uses the raw...

CVE-2026-100315: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file mydetailsfaculty.php. The manipulation of the argument myfid results in sql injection. The attack can be launched remotely. The explo...

PT-2026-99255

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote cross site scripting issue exists within the Faculty Video Management component in the managevideos2.php file. The flaw allows an attacker ...

PT-2026-99435

Name of the Vulnerable Software and Affected Versions mathurvishal CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A SQL injection issue exists in the viewresult.php file. This occurs when the seno argument is manipulated, allowing for remote...

PT-2026-99394

Name of the Vulnerable Software and Affected Versions AcyMailing Enterprise versions prior to 11.1.0 Description A remote code execution issue exists in the mailbox action feature. The system saves MIME parts of incoming emails to the media/com acym/upload/ directory without performing extension...

PT-2026-99256

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote SQL injection is possible through the manipulation of the gname or editassid arguments within an unknown function of the /updateguest.php...

CVE-2026-100314: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatedetailsfromstudent.php. The manipulation of the argument eno leads to sql injection. The attack can be initiated...

PT-2026-99270

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote SQL injection exists in the file mydetailsfaculty.php. The issue occurs when the myfid argument is manipulated, allowing an attacker to...

PT-2026-99269

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote SQL injection is possible due to the improper handling of the eno argument within the updatedetailsfromstudent.php file. SQL injection is a...

PT-2026-99268

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A weakness in the file updatequery.php allows remote attackers to perform cross site scripting XSS, which is a technique used to inject malicious...

CVE-2026-100313: Improper Neutralization of Input During Web Page Generation

A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of the file updatequery.php. Executing a manipulation of the argument queryx can lead to cross site scripting. It is possible to launch the...

AZL-104895 CVE-2026-91768 affecting package php 8.3.33-1

The IPv6 branch of the FastCGI client access check compares only the first 12 bytes of a 16-byte IPv6 address, so listen.allowedclients matches on a /96 prefix instead of the exact address. An attacker who can source an address sharing the first 96 bits with an allowed one passes the check and...

AZL-104898 CVE-2026-92842 affecting package php 8.3.33-1

The convert.base64-encode, convert.quoted-printable-encode and convert.quoted-printable-decode stream filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value with pestrdup, which stops at the first NUL byte,...

CVE-2026-92842

A flaw was found in PHP. When processing certain conversion stream filters with line-break settings containing a null byte, the filter duplicates the string but retains the original length rather than the truncated size. An attacker who can influence filter options could exploit this out-of-bound...

CVE-2026-91768

A flaw was found in PHP. The access control check for Internet Protocol version 6 IPv6 addresses in the FastCGI implementation compares only the first 12 bytes of a 16-byte address instead of the complete address. An attacker on an adjacent network with an address sharing the first 96 bits with a...

AZL-104919 CVE-2026-91765 affecting package php 8.3.33-1

cleanupxmlnode in the SOAP XML parser recurses once per XML nesting level with no depth limit. An unauthenticated attacker can post a SOAP request containing tens of thousands of nested elements to any SoapServer endpoint, exhaust the stack and crash the process. The same unbounded recursion exis...