CVE-2026-76990 code-projects Simple Inventory System delete.php sql injection

A vulnerability has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file /delete.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public...

CVE-2026-76990

A proof-of-concept exploit exists for CVE-2026-76990, a SQL injection in the ID argument of /delete.php in code-projects Simple Inventory System 1.0, exploitable remotely without authentication (CVSS 7.3 HIGH). No patch or workaround is mentioned in the provided documents.

WordPress Integrate PhonePe with WooCommerce plugin <= 1.2.1 - Unauthenticated Payment Bypass via Transaction ID Reuse vulnerability

Unauthenticated Payment Bypass via Transaction ID Reuse vulnerability discovered by dangnosuy in WordPress Plugin Integrate PhonePe with WooCommerce versions = 1.2.1...

EUVD-2026-63219

A low privileged remote attacker can hijack an active administrative session without needing to know the administrator password by extracting live plaintext session identifiers for authenticated users from downloadable error log archives...

PT-2026-79048

A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects the function add grade of the file /index.php. Performing a manipulation of the argument student id results in improper authorization. The attack can be initiated remotely...

PT-2026-79214

Name of the Vulnerable Software and Affected Versions Microsoft Entra ID affected versions not specified Description An issue exists in the cloud identity platform where the deserialization of untrusted data allows an unauthorized remote attacker to execute arbitrary code over the network. This...

VulnCheck KEV: CVE-2026-69836

Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network...

CVE-2026-53546

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the terminal WebSocket accepts a user-controlled hostConfig.id and src/backend/ssh/host-resolver.ts resolves that host without requiring ownership or explicit access. When...

CVE-2026-55482

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/BulkAssetsController.php update to submit companyid directly without Company::getIdForCurrentUser, allowing assets to be moved across company boundaries and breaking multi-tenan...

MINI-897R-HJP2-9722

Bulletin has no description...

MINI-27G5-2PW4-J2CQ

Bulletin has no description...

MINI-GMG6-F46W-2G33

Bulletin has no description...

MINI-G673-24H4-G66X

Bulletin has no description...

CVE-2026-75950 Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - Unauthenticated listing ownership takeover in J-BusinessDirectory 6.2.3 - Ownership could be changed using attacker-supplied company and user IDs, including for listings that already had an owner. 6.2.3 binds the action to the authenticated user and only allows...

CVE-2026-76216

Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete vict...

EUVD-2026-62457

Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete vict...

CVE-2026-76216 Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing

Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete vict...

MINI-G33P-575P-43VV

Bulletin has no description...

CVE-2026-73354

The WordPress SimplyRETS Real Estate IDX plugin (≤ 3.2.8) allows unauthenticated reflected/stored XSS due to insufficient input sanitization. CVSS 7.1 (HIGH) reflects network exposure requiring user interaction. No in-the-wild exploitation is reported. PatchStack notes a fix is available; upgrade...

WordPress Database for Contact Form 7, WPforms, Elementor forms plugin < 1.5.5 - Authenticated SQL Injection via id Parameter vulnerability

Authenticated SQL Injection via id Parameter vulnerability discovered by Andrew Lyons in WordPress Plugin Contact Form Entries versions 1.5.5...