CVE-2026-90597

A SQL injection vulnerability exists in itsourcecode Sales and Inventory System 1.0 , specifically in an unknown function of the file /pages/sup_edit1.php via the ID argument. The flaw allows remote attackers with low privileges to manipulate the parameter and inject SQL, resulting in low impact ...

CVE-2026-90597 itsourcecode Sales and Inventory System sup_edit1.php sql injection

A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/supedit1.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been...

CVE-2026-82222-PoC

CVE-2026-82222 — GiveWP Unauthenticated PHP Object Injection → RCE Lab + proof-of-concept for CVE-2026-82222 : unauthenticated PHP object injection leading to remote code execution in the GiveWP WordPress donation plugin = 4.16.7.1 patched in 4.16.7.2...

CVE-2017-9841

CVE-2017-9841 Laravel-RCE: CVE-2017-9841 CVE-2017-9841 is a critical remote code execution RCE vulnerability that affects the PHPUnit library, widely used for automated testing in PHP. This flaw allows an attacker to execute arbitrary commands on the server if they can access a specific PHPUnit...

CVE-2026-90517 PHPGurukul Bank Locker Management System view-assign-locker.php authorization

A vulnerability was identified in PHPGurukul Bank Locker Management System 1.0. This affects an unknown function of the file /blms/view-assign-locker.php. The manipulation of the argument ltid leads to authorization bypass. The attack may be initiated remotely. The exploit is publicly available a...

Exploit for CVE-2026-71294

Cotonti CommentsWidget PHP Object Injection PoC Safe local pr...

[SECURITY] Fedora 45 Update: php-pecl-mongodb2-2.5.2-1.fc45

The purpose of this driver is to provide exceptionally thin glue between MongoDB and PHP, implementing only fundemental and performance-critical components necessary to build a fully-functional MongoDB driver...

CVE-2026-90597: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/supedit1.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been...

CVE-2026-90600: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/invedit1.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may b...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: php (UTSA-2023-002404)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002404 advisory. In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, excessive number of parts in HTTP form upload can cause high resource consumption and excessi...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: php (UTSA-2023-002405)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002405 advisory. In PHP 8.0.X before 8.0.28, 8.1.X before 8.1.16 and 8.2.X before 8.2.3, passwordverify function may accept some invalid Blowfish hashes as valid. If such invalid has...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: php (UTSA-2026-090433)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-090433 advisory. In PHP versions 7.2.x below 7.2.9, 7.3.x below 7.3.16 and 7.4.x below 7.4.4, while parsing EXIF data with exifreaddata function, it is possible for malicious data to...

PT-2026-90978

A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/sup edit1.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been...

CVE-2026-36989

A SQL Injection vulnerability affects LuxSoft LuxCal through version 5.3.4L , present in the files rssfeed.php and common/retrieve.php . The vulnerability is exploitable over the network with no authentication or user interaction required (CVSS 3.1: 5.8 MEDIUM , vector AV:N/AC:L/PR:N/UI:N/S:C/C:L...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: httpd (UTSA-2024-004029)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2024-004029 advisory. A regression in the core of Apache HTTP Server 2.4.60 ignores some use of the legacy content-type based configuration of handlers. AddType and similar configuration,...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: php (UTSA-2023-002402)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002402 advisory. In PHP versions 8.0. before 8.0.30, 8.1. before 8.1.22, and 8.2. before 8.2.8 various XML functions rely on libxml global state to track configuration variables, lik...

Exploit for CVE-2026-78006

CVE-2026-78006-POC POC for CVE-2026-78006 The Events Calendar...

CVE-2026-85200

The GEO my WP plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.5.5.3 via the gmwpostslocatorajaxinfowindowloader function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the...

CVE-2026-78175

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the withdrawmethodfield parameter of the tutorsavewithdrawaccount AJAX handler. This is due to the handler lacking any capability or role...

EUVD-2026-76834

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.0.7 via the withdrawmethodfield parameter of the tutorsavewithdrawaccount AJAX handler. This is due to the handler lacking any capability or role...