CVE-2026-94041: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Affected by this issue is some unknown functionality of the file admin/addmenu.php. The manipulation of the argument item/price/image/type leads to sql injection. It is...

PT-2026-95953

Name of the Vulnerable Software and Affected Versions code-projects Internship Management System version 1.0 Description A SQL injection flaw exists in the Admin Login Form component within the /admin/login.php endpoint. A remote attacker can exploit this by manipulating the Password variable,...

PT-2026-95965

Name of the Vulnerable Software and Affected Versions SourceCodester Drug Recommendation System version 1.0 Description An issue exists in the file /drug recommender/Admin/edit user.php where improper handling of the ID argument allows for remote SQL injection. SQL injection is a technique where ...

CVE-2026-93975: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in code-projects Assessment Management 1.0. This impacts an unknown function of the file admin/edit-user.php of the component User Editing. The manipulation of the argument name/sname/email/username/password/id leads to cross site scripting. The attack may be...

CVE-2026-93980: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in code-projects Internship Management System 1.0. This vulnerability affects unknown code of the file /admin/login.php of the component Admin Login Form. Executing a manipulation of the argument Password can lead to sql injection. The attack may be performed from...

PT-2026-95956

Name of the Vulnerable Software and Affected Versions NivoCart versions prior to 2.4.1 Description A destructive configuration write issue exists in the admin password reset controller. Unauthenticated attackers can disable self-service password recovery by sending a GET request to the password...

PT-2026-95983

Name of the Vulnerable Software and Affected Versions AdithyaYelloju Restaurant-Management-System versions up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c Description Remote SQL injection is possible through the manipulation of the item, price, image, or type arguments within the 'admin/add...

PT-2026-95949

Name of the Vulnerable Software and Affected Versions code-projects Assessment Management version 1.0 Description Cross site scripting occurs in the file admin/add-user.php due to the manipulation of the level argument. This issue allows a remote attack to be launched. Recommendations Avoid using...

PT-2026-95948

Name of the Vulnerable Software and Affected Versions code-projects Assessment Management version 1.0 Description Cross site scripting occurs in the User Editing component within the admin/edit-user.php file. A remote attacker can trigger this issue by manipulating the name, sname, email, usernam...

PT-2026-95997

Name of the Vulnerable Software and Affected Versions AdithyaYelloju Restaurant Management System versions up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c Description Remote SQL injection is possible through the manipulation of the table/members/price argument. This issue occurs within the mysqli...

CVE-2026-93976: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in code-projects Assessment Management 1.0. Affected is an unknown function of the file admin/add-user.php. The manipulation of the argument level results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used...

CVE-2026-94105: Improper Check for Unusual or Exceptional Conditions

NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to...

CVE-2026-93997: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected by this issue is some unknown functionality of the file /Admin/editsymptom.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has...

CVE-2026-94042: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in AdithyaYelloju Restaurant Management System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This affects the function mysqliquery of the file admin/addtable.php. The manipulation of the argument table/members/price results in sql injection. It is possible to launch th...

PT-2026-95966

Name of the Vulnerable Software and Affected Versions SourceCodester Drug Recommendation System version 1.0 Description A security flaw allows remote exploitation via cross site scripting XSS, a technique where malicious scripts are injected into trusted websites. The issue exists in the file /dr...

PT-2026-95954

Name of the Vulnerable Software and Affected Versions SourceCodester Drug Recommendation System version 1.0 Description A SQL injection flaw exists in the /Admin/edit symptom.php endpoint. This issue occurs when the ID argument is manipulated, allowing a remote attacker to execute arbitrary SQL...

CVE-2026-93988

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...

CVE-2026-93988 QloApps through 1.7.0 Arbitrary File Read via getEmailHTML

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...

CVE-2026-93988 QloApps through 1.7.0 Arbitrary File Read via getEmailHTML

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...

CVE-2026-93988

QloApps versions through 1.7.0 contain a path traversal vulnerability in the getEmailHTML action of admin/ajax.php. An authenticated back-office user can supply relative path sequences in the email parameter to bypass directory restrictions and read arbitrary files , including database credential...