58853 matches found
EUVD-2026-71035
Snipe-IT versions before 8.6.2 contain an authorization bypass vulnerability in checkout-acceptance report actions when Full Multiple Company Support is enabled. Authenticated users with reports.view permission can enumerate sequential acceptance IDs and soft-delete or trigger reminder emails for...
CVE-2026-85579
SiYuan before v3.8.2 contains an information disclosure vulnerability in the reader-accessible POST /api/transactions/undoState endpoint. The endpoint returns the peekMutatedRootIDs list from the global undo-log stack for a caller-supplied root ID without applying publish-access visibility filter...
CVE-2026-85579 SiYuan before v3.8.2 Information Disclosure via undoState
SiYuan is affected by an information disclosure vulnerability confirmed in v3.8.1, fixed in v3.8.2 in the reader-accessible POST /api/transactions/undoState endpoint. The endpoint returns the peekMutatedRootIDs list from the global undo-log stack for a caller-supplied root ID without applying...
CVE-2026-85579 SiYuan before v3.8.2 Information Disclosure via undoState
SiYuan is affected by an information disclosure vulnerability confirmed in v3.8.1, fixed in v3.8.2 in the reader-accessible POST /api/transactions/undoState endpoint. The endpoint returns the peekMutatedRootIDs list from the global undo-log stack for a caller-supplied root ID without applying...
CVE-2026-85512
A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /admin/session.php. The manipulation of the argument ID results in missing authorization. The attack can be executed remotely. The exploit has been...
CVE-2026-85512 SourceCodester Class and Exam Timetabling System session.php authorization
A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /admin/session.php. The manipulation of the argument ID results in missing authorization. The attack can be executed remotely. The exploit has been...
EUVD-2026-70995
A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /admin/session.php. The manipulation of the argument ID results in missing authorization. The attack can be executed remotely. The exploit has been...
CVE-2026-79630
The WPFunnels WordPress plugin prior to 3.13.0 contains an unauthenticated price manipulation vulnerability in its checkout order-bump feature. The plugin fails to verify that the product ID submitted via an order bump matches the product for which the bump's discount was configured. An unauthent...
CVE-2026-79630 WPFunnels < 3.13.0 - Unauthenticated Price Manipulation via Order Bump Product ID Substitution
The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bump's discount was configured for, allowing unauthenticated users to obtain any purchasable product at a discount intended for a different one, with the reduc...
CVE-2026-85398
A vulnerability was identified in code-projects Hospital Information System 1.0. Affected is the function viewReq of the file viewReq.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used...
CVE-2026-85399
A SQL injection vulnerability exists in code-projects Hospital Information System 1.0 , specifically in the function getSinglePresp within the file includes/presp/PrespController.php . An unauthenticated remote attacker can manipulate the ID argument to inject SQL, potentially affecting confident...
CVE-2026-85383
A flaw has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/invdel.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be us...
EUVD-2026-70866
A vulnerability was identified in code-projects Hospital Information System 1.0. Affected is the function viewReq of the file viewReq.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used...
CVE-2026-85398
code-projects Hospital Information System 1.0 contains a SQL injection vulnerability in the viewReq function of the file viewReq.php , triggered by manipulating the ID argument. The attack can be launched remotely without authentication. The CVSS 3.1 base score is 7.3 (HIGH) with low impacts on c...
CVE-2026-85398 code-projects Hospital Information System viewReq.php viewReq sql injection
A vulnerability was identified in code-projects Hospital Information System 1.0. Affected is the function viewReq of the file viewReq.php. Such manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used...
CVE-2026-85383 itsourcecode Sales and Inventory System inv_del.php sql injection
A flaw has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/invdel.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be us...
CVE-2026-85383
itsourcecode Sales and Inventory System 1.0 is affected by a SQL injection vulnerability in the file /pages/inv_del.php. The flaw is triggered by manipulating the ID argument in an unknown function within that file, allowing remote execution with low privileges required . The CVSS v3.1 score is 6...
EUVD-2026-70856
A flaw has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/invdel.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be us...