CVE-2026-104613

The CodeAstro Simple Pharmacy Management System 1.0 is vulnerable to an SQL injection vulnerability within the /SimplePharmacy-PHP/product/view.php file. The root cause is the improper manipulation of the ID argument , which allows for remote execution of the attack. The exploit has been publicly...

CVE-2026-104473

YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure authenticated or unauthenticated users into opening crafted...

CVE-2026-104469

YesWiki before 4.6.7 contains a session fixation vulnerability that allows attackers to hijack authenticated sessions because login does not regenerate the PHP session ID. Attackers who set or learn a victim's pre-authentication YesWiki- session cookie can reuse it after login to access private...

EUVD-2026-91396

YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure authenticated or unauthenticated users into opening crafted...

CVE-2026-104473

Versions of YesWiki before 4.5.3 are susceptible to multiple reflected cross-site scripting (XSS) vulnerabilities. The root cause is the failure to sanitize several input parameters, specifically incomingurl , id , file , tags , and template . A remote attacker can leverage these flaws by luring ...

EUVD-2026-91480

YesWiki before 4.6.7 contains a session fixation vulnerability that allows attackers to hijack authenticated sessions because login does not regenerate the PHP session ID. Attackers who set or learn a victim's pre-authentication YesWiki- session cookie can reuse it after login to access private...

CVE-2026-104606

A security flaw exists in the itsourcecode Online Admission System Project 1.0 . An unknown function within the confirm.php file is vulnerable to SQL injection due to the improper handling of the ID argument. This vulnerability can be exploited remotely. The documents indicate that an exploit has...

CVE-2026-93925 Apache Thrift: C++ `THeaderTransport::writeVarint32()` stack buffer overflow on a negative protocol id

Stack-based buffer overflow, Incorrect bitwise shift of integer vulnerability in Apache Thrift C++ THeaderProtocol. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

CVE-2026-93925 Apache Thrift: C++ `THeaderTransport::writeVarint32()` stack buffer overflow on a negative protocol id

Stack-based buffer overflow, Incorrect bitwise shift of integer vulnerability in Apache Thrift C++ THeaderProtocol. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue...

Exploit for CVE-2026-103752

CVE-2026-103752: Unauthenticated Privilege Escalation in WordP...

PT-2026-104371

TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete user knowledge in superagi/controllers/knowledges.py. In affected source snapshots, POST /knowledges/delete/knowledge id deletes the selected knowledge object without requiring authentication in the...

PT-2026-104194

A security flaw has been discovered in itsourcecode Online Admission System Project 1.0. The impacted element is an unknown function of the file confirm.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the...

CVE-2026-104614: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in CodeAstro Simple Pharmacy Management System 1.0. This issue affects some unknown processing of the file /SimplePharmacy-PHP/product/delete.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit is public...

PT-2026-104356

A security vulnerability has been detected in onetwothreeneth HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. The impacted element is an unknown function of the file php/sessions.php. The manipulation of the argument ID leads to improper authentication. Remote exploitatio...

PT-2026-104339

A vulnerability was identified in CodeAstro Simple Pharmacy Management System 1.0. This issue affects some unknown processing of the file /SimplePharmacy-PHP/product/delete.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit is public...

PT-2026-104367

In TaskingAI v0.3.0 in the QR Code Generator plugin save base64 image function, a path traversal vulnerability allows attackers to write image files to arbitrary locations on the server filesystem by manipulating the project id parameter...

PT-2026-104365

SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller. In affected source snapshots, create agent execution and create agent run in superagi/controllers/agent execution.py accept a caller-supplied agent id and fail to verify that the referenced...

PT-2026-104119

Name of the Vulnerable Software and Affected Versions CMB2 versions prior to 2.13.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. By exploiting the parameter such as kl code or kl post code, an attacker can...

CVE-2026-104901: Improper Neutralization of Input During Web Page Generation

MISP contains a cross-site scripting XSS vulnerability in the ID Translator feature. When a user views the ID Translator page, the application queries linked remote MISP servers for corresponding event identifiers. The event ID returned by the remote server was rendered in the HTML output without...

PT-2026-104073

Name of the Vulnerable Software and Affected Versions DevKit Pro versions prior to 3.0.0 Description An authentication bypass exists in the DevKit Pro plugin for WordPress. The issue occurs because the revert switch handler trusts the original user id cookie, which is controlled by the attacker, ...