PT-2026-99113

Name of the Vulnerable Software and Affected Versions PHP affected versions not specified Description The phar tar number function parses the octal size field of a TAR header into a uint32 t without an overflow check. Because the field is 11 octal digits wide and can hold values up to 0x1FFFFFFFF...

CVE-2026-91769: Improper Validation of Certificate with Host Mismatch

PHP's OpenSSL stream peer verification checks the certificate's subjectAltName entries first and, whenever no entry matches, falls back to the Common Name. RFC 6125 requires the CN to be ignored once the certificate presents any service identity, so a certificate carrying a non-matching DNS SAN w...

CVE-2026-91767: Heap-based Buffer Overflow

phpopensslmatcheswildcardname in ext/openssl/xpssl.c underflows the length argument passed to memchr when a TLS server certificate presents a wildcard name whose literal characters are together longer than the hostname being verified. A malicious server presenting such a certificate makes the PHP...

The vulnerability of the PHP-phpseclib interpreter, related to manipulating an unknown input, leads to a time mismatch vulnerability. This allows attackers to gain unauthorized access to protected information.

The vulnerability of the PHP-phpseclib interpreter lies in manipulating an unknown input, which leads to a time mismatch vulnerability. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the PHP-phpseclib interpreter, related to uncontrolled resource consumption, allows attackers to trigger a service failure.

The vulnerability of the PHP-phpseclib interpreter is related to an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...

CVE-2026-97886: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected by this vulnerability is an unknown functionality of the file managevideos2.php. Such manipulation of the argument editassid leads to sql injection. The attack may be...

CVE-2026-97882: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function of the file loginlinkfaculty.php of the component Faculty Authentication. Executing a manipulation of the argument fid/pass can lea...

CVE-2026-44642: Improper Neutralization of Special Elements used in an SQL Command

Piwigo is a full featured open source photo gallery application for the web. Prior to 16.4.0, checkupgradeaccessrights in admin/include/functionsupgrade.php conditionally escapes the submitted username only when the removed getmagicquotesgpc function exists, so PHP 8 and later concatenate an...

PT-2026-99048

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote SQL injection exists in the managevideos2.php file. This issue occurs when the editassid argument is manipulated, allowing an attacker to...

PT-2026-98880

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2 Description The Invoices::generate xml function appends a database-derived xml id to the XMLconfigs helper directory and includes the resulting PHP path without proper validation of the identifier. A...

CVE-2026-92799: Improper Authorization

The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Authorization Bypass via PHP Type Juggling in all versions up to, and including, 28.2. This is due to the postValidateCustomer function using a loose PHP inequality operator != to compare the...

PT-2026-98370

Name of the Vulnerable Software and Affected Versions Online Scheduling and Appointment Booking System – Bookly versions prior to 28.3 Description An authorization bypass exists due to PHP Type Juggling, a condition where PHP converts a variable from one data type to another during a comparison...

CVE-2026-97883: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This affects an unknown function of the file updatequery.php. The manipulation of the argument gid leads to sql injection. The attack can be initiated remotely. Th...

PT-2026-98956

Name of the Vulnerable Software and Affected Versions mathurvishal CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote SQL injection is possible due to the improper handling of the gid argument within an unknown function in the updatequery.php...

PT-2026-98955

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A SQL injection flaw exists in the Faculty Authentication component within the loginlinkfaculty.php file. A remote attacker can exploit this by...

PT-2026-98961

Name of the Vulnerable Software and Affected Versions CloudClassroom-PHP-Project versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be Description A remote SQL injection exists in the updatefaculty.php file. The issue occurs when the fid argument is manipulated, allowing an attacker to execute...

CVE-2026-97885: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected is an unknown function of the file updatefaculty.php. This manipulation of the argument fid causes sql injection. The attack may be initiated remotely. The exploit has been...

PT-2026-98876

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2-rc-1 Description InvoicePlane builds its permitted template list by scanning a PHP template directory that can be written through an administrator-controlled file-write capability. A malicious PHP file plac...

Linux Distros Unpatched Vulnerability : CVE-2026-92692

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have...

PT-2026-99112

Name of the Vulnerable Software and Affected Versions PHP affected versions not specified Description On Windows, filesystem and stream APIs fail to reject reserved device names when they are part of a path. These reserved names include CON, PRN, AUX, NUL, COM1 through COM9, LPT1 through LPT9,...