CVE-2026-10117 Open5GS nghttp2-server.c ogs_pool_id_calloc denial of service

A weakness has been identified in Open5GS up to 2.7.7. This issue affects the function ogspoolidcalloc in the library /lib/sbi/nghttp2-server.c. Executing a manipulation can lead to denial of service. The attack may be launched remotely. The exploit has been made available to the public and could...

CVE-2026-10117

The CVE concerns Open5GS up to 2.7.7. The issue affects the ogs_pool_id_calloc function in /lib/sbi/nghttp2-server.c. A manipulation can remotely trigger a denial of service. Public exploit availability is noted. Remediation guidance: apply the official patch/update to resolve the vulnerability (...

CVE-2026-10117 Open5GS nghttp2-server.c ogs_pool_id_calloc denial of service

A weakness has been identified in Open5GS up to 2.7.7. This issue affects the function ogspoolidcalloc in the library /lib/sbi/nghttp2-server.c. Executing a manipulation can lead to denial of service. The attack may be launched remotely. The exploit has been made available to the public and could...

Insecure Direct Object Reference

phpMyFAQ is vulnerable to Insecure Direct Object Reference. The vulnerability is due to missing authorization checks in the admin API password update endpoint, where authenticated administrators can modify the userId parameter to change any user's password, allowing privilege escalation to...

PT-2026-45120

AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to watch.php with crafted SQL payloads to extract sensitive database informati...

Open5GS security vulnerabilities

Open5GS is an open-source implementation of 5G Core and EPC in C language, which serves as the core network for Lte/Nr networks. Versions of Open5GS 2.7.7 and earlier contain security vulnerabilities; these vulnerabilities stem from the ogspoolidcalloc function, which can cause denial-of-service...

MOGG web simulator: SQL injection vulnerability

MOGG web simulator Script is a Web application scripting environment developed by spider312. The MOGG web simulator Script has a SQL injection vulnerability. This vulnerability stems from the id parameter being susceptible to SQL injections, allowing unauthenticated attackers to execute arbitrary...

CVE-2018-25422: Improper Neutralization of Special Elements used in an SQL Command

MOGG web simulator Script contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL commands by injecting malicious code through the id parameter. Attackers can send GET requests to play.php with crafted SQL payloads in the id parameter to extract...

SIM-PKH SQL Injection Vulnerability

SIM-PKH is a community-based poverty alleviation data management system developed by Insan Sutejo. Version 2.4.1 of SIM-PKH contains an SQL injection vulnerability. This vulnerability arises from injecting malicious code through the id parameter, potentially allowing authenticated attackers to...

PT-2026-45111

Name of the Vulnerable Software and Affected Versions MGB OpenSource Guestbook version 0.7.0.2 Description An SQL injection allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code. This is achieved by sending GET requests to the 'email.php' endpoint using...

CVE-2018-25411: Improper Neutralization of Special Elements used in an SQL Command

MGB OpenSource Guestbook 0.7.0.2 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to email.php with crafted SQL payloads in the 'id' parameter to...

CVE-2018-25410: Improper Neutralization of Special Elements used in an SQL Command

SIM-PKH 2.4.1 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to /admin/media.php with module=pengurus and act=editpengurus parameters containing SQ...

MGB OpenSource Guestbook SQL Injection Vulnerability

MGB OpenSource Guestbook is an open-source web-based message board system developed by MGB OpenSource. Version 0.7.0.2 of MGB OpenSource Guestbook has a SQL injection vulnerability. This vulnerability arises from injecting malicious code through the id parameter, which may allow unauthenticated...

CVE-2018-25420: Improper Neutralization of Special Elements used in an SQL Command

AiOPMSD Final 1.0.0 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'id' parameter. Attackers can send GET requests to watch.php with crafted SQL payloads to extract sensitive database informati...

ECHO-B32F-44B7-8F92

Bulletin has no description...

GHSA-MCH8-WF3H-6X88 Admidio writes session IDs and auto-login cookie values to application logs

Summary When debug logging is enabled, Session::setCookie logs full cookie values and Session::start logs the current session ID. In a real Admidio deployment this includes both the active session cookie and the persistent auto-login cookie. Anyone with access to the log sink can recover live...

Admidio: CSRF in SSO client `enable` action toggles SAML/OIDC clients without token validation

Summary modules/sso/clients.php validates an admcsrftoken on every state-changing branch except enable. The enable case loads the SAML or OIDC client by UUID, calls $client-enable$enabled, and persists the new state with no token check. Because the action is reachable via plain GET parameters, a...

CVE-2026-45627

creationtimestamp| type| source ---|---|--- 2026-05-29 20:14:39+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mmzdzd6pls2x 2026-05-30 05:00:32+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mn2bfmxvw623...

CVE-2026-9416

A security vulnerability has been detected in code-projects Employee Management System 1.0. This impacts an unknown function of the file /myprofile.php. Such manipulation of the argument ID leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed publicly...

CVE-2026-45297

OpenReplay is a self-hosted session replay suite. Prior to 1.26.0, there is a cross-tenant IDOR on feature-flag and assist-stats routes via projectid case mismatch. ProjectAuthorizer.call OSS api/auth/authproject.py:14-38 and EE ee/api/auth/authproject.py:14-46 only runs...