PT-2026-88292

A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/us edit.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used...

CVE-2026-79570

The software mfish-nocode-pro v1.0.0 is vulnerable to a SQL injection flaw located in the tableName parameter at the /sys/dbConnect/data endpoint. An attacker can exploit this by sending a crafted SQL statement to gain unauthorized access to sensitive database information . The vulnerability has ...

CVE-2026-79570

mfish-nocode-pro v1.0.0 was discovered to contain a SQL injection vulnerability in the tableName parameter at /sys/dbConnect/data. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...

PT-2026-86986

A vulnerability has been found in code-projects Student Crud Operation 1.0. This affects an unknown function of the file /edit.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used...

PT-2026-88518

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.9 of opnsense/core and version 26.4 20 of BE/opnsense/core, a path traversal vulnerability in the NTP configuration module allows an attacker to overwrite arbitrary files on the system as the root user. By manipulati...

CVE-2026-79569

The Movie_Recommend v1.0.0 software is vulnerable to a SQL injection flaw within the sort parameter at the /loadingmore endpoint. This vulnerability exists because of improper neutralization of special elements used in an SQL command, which allows an attacker to execute a crafted SQL statement to...

PT-2026-87111

Name of the Vulnerable Software and Affected Versions L-ONE version 1.0.0 Description Multiple SQL injection flaws exist in the '/attachment/getBusinessUploadList' endpoint. An attacker can use crafted SQL statements through the busid, id, and taskid parameters to access sensitive database...

CVE-2026-79573

L-ONE v1.0.0 is vulnerable to multiple SQL injection flaws within the /attachment/getBusinessUploadList component. The root cause is the improper neutralization of special elements in the busid , id , and taskid parameters. An attacker can exploit these vulnerabilities by submitting a crafted SQL...

PT-2026-87143

Movie Recommend v1.0.0 was discovered to contain a SQL injection vulnerability in the sort parameter at /loadingmore. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement...

PT-2026-86985

A flaw has been found in itsourcecode Sales and Inventory System 1.0. The impacted element is the function mysqli query of the file /pages/us searchfrm.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-86538

knowns versions before 0.30.0 contain a path traversal vulnerability in the POST /api/templates/preview endpoint that allows unauthenticated attackers to read arbitrary files. Attackers can supply directory traversal sequences in the templateFile parameter to bypass path restrictions and read...

CVE-2026-82756

Improper Encoding or Escaping of Output vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. BearerPlug and RequireScopePlug built the Bearer resourcemetadata="..."...

CVE-2026-86542

knowns before version 0.30.0 contains a path traversal vulnerability in its import routes. The server fails to validate the name parameter, allowing an unauthenticated remote attacker to supply traversal sequences that escape the imports directory and overwrite arbitrary files writable by the ser...

CVE-2026-82756

Improper Encoding or Escaping of Output vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. BearerPlug and RequireScopePlug built the Bearer resourcemetadata="..."...

CVE-2026-82756 ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection

Improper Encoding or Escaping of Output vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. BearerPlug and RequireScopePlug built the Bearer resourcemetadata="..."...

EUVD-2026-72538

Improper Encoding or Escaping of Output vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. BearerPlug and RequireScopePlug built the Bearer resourcemetadata="..."...

CVE-2026-82756 ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection

Improper Encoding or Escaping of Output vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. BearerPlug and RequireScopePlug built the Bearer resourcemetadata="..."...

CVE-2026-82756

ash_authentication_oauth2_server (ash-project) is vulnerable to header parameter injection in its BearerPlug and RequireScopePlug. A tenant-derived resource_metadata URL is interpolated directly into the WWW-Authenticate challenge without escaping, allowing an unauthenticated attacker in a multi-...

CVE-2026-82756 ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection

Improper Encoding or Escaping of Output vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. BearerPlug and RequireScopePlug built the Bearer resourcemetadata="..."...

EEF-CVE-2026-82756 ash_authentication_oauth2_server interpolates a tenant-derived value into the WWW-Authenticate challenge without escaping, allowing header parameter injection

Summary Improper Encoding or Escaping of Output vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. BearerPlug and RequireScopePlug built the Bearer...