CVE-2026-12987 Events Manager < 7.3.7 - Unauthenticated SQL Injection via PHP Object Injection in Booking Registration

The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection...

CVE-2026-64796: Improper Access Control

Joomla Extension - regularlabs.com - various code injection vectors in Sourcerer extension - Free did not require both the article creator and last modifier to be Super Users before executing article PHP. Pro did not consistently enforce configured CSS, JavaScript and PHP permissions across tags,...

CVE-2026-12987: Improper Neutralization of Special Elements used in an SQL Command

The Events Manager WordPress plugin before 7.3.7 does not safely handle booking-registration data on sites using No-User-Account Booking Mode: a booker-supplied registration field is stored as booking meta and later deserialized without restricting allowed classes, enabling PHP object injection...

PT-2026-63507

Name of the Vulnerable Software and Affected Versions Sourcerer extension affected versions not specified Description Multiple code injection vectors exist within the extension. The Free version fails to verify that both the article creator and the last modifier possess Super User privileges befo...

MiracleLinux 9 : php:8.2 (AXSA:2026-1328:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1328:01 advisory. PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions CVE-2026-7258 PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting...

SUSE SLES15: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (SUSE-SU-2026:3164-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3164-1 advisory. This update for php8 fixes the following issues - Update to version 8.3.32 - CVE-2026-12184: Failure to setup TLS with a remote...

SUSE SLES15: apache2-mod_php7 / php7 / php7-bcmath / php7-bz2 / php7-calendar / etc (SUSE-SU-2026:3165-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:3165-1 advisory. This update for php7 fixes the following issue - CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a...

CVE-2026-16485

A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /class.php. Such manipulation of the argument day leads to cross site scripting. The attack can be launched remotely. The exploit has been...

CVE-2026-16486

A vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSIS.php. Performing a manipulation of the argument day results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be...

CVE-2026-16486

SourceCodester Class and Exam Timetabling System 1.0 contains a cross-site scripting vulnerability in an unknown part of /BSIS.php as a result of manipulating the day parameter. The issue can be triggered remotely and has publicly available exploit code. Affected product is the SourceCodester Cla...

EUVD-2026-46401

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod' function through 'octdec' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root...

CVE-2026-16484 SourceCodester Class and Exam Timetabling System edit_subjecta.php sql injection

A flaw has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /editsubjecta.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published...

CVE-2026-63358 FileGator privilege escalation

FileGator accepts arbitrary Unix permission values via the '/chmoditems' API endpoint and passes the value directly to PHP's native 'chmod' function through 'octdec' conversion, with no validation. This allows an authenticated user with 'chmod' permission to upgrade their privileges to root...

cve-writeups

Security Research & CVE Write-ups Author: Yashkumar Keral...

Security update for php7

This update for php7 fixes the following issue CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw bsc1270351. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypp...

SUSE-SU-2026:3165-1 Security update for php7

This update for php7 fixes the following issue - CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw bsc1270351...

Security update for php8

This update for php8 fixes the following issues Update to version 8.3.32. CVE-2026-12184: Failure to setup TLS with a remote server can result in a remote DoS bsc1270712. CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw bsc1270351...

SUSE-SU-2026:3164-1 Security update for php8

This update for php8 fixes the following issues - Update to version 8.3.32 - CVE-2026-12184: Failure to setup TLS with a remote server can result in a remote DoS bsc1270712. - CVE-2026-14355: The AES-WRAP-PAD algorithm implementation in OpenSSL extension contains a buffer allocation flaw bsc12703...

CVE-2026-16334 itsourcecode Hospital Management System prescriptionorder.php sql injection

A vulnerability was identified in itsourcecode Hospital Management System 1.0. This vulnerability affects unknown code of the file /prescriptionorder.php. Such manipulation of the argument editid leads to sql injection. The attack can be launched remotely. The exploit is publicly available and...

CVE-2026-16332

A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file /mydlink/multiuploadify.php. Performing a manipulation of the argument Filedata results in unrestricted upload. The attack is possible to be carried out remotely. The exploit is now public and may b...