EUVD-2026-72112

wger before 2.6 affected versions = 2.5.0 contains an open redirect vulnerability in the trainerlogin view wger/core/views/user.py. After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseRedirect without validating it with...

CVE-2026-86256 wger before 2.6 Open Redirect via trainer-login next parameter

wger before 2.6 affected versions = 2.5.0 contains an open redirect vulnerability in the trainerlogin view wger/core/views/user.py. After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseRedirect without validating it with...

CVE-2026-86256 wger before 2.6 Open Redirect via trainer-login next parameter

wger before 2.6 affected versions = 2.5.0 contains an open redirect vulnerability in the trainerlogin view wger/core/views/user.py. After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseRedirect without validating it with...

CVE-2026-86256 wger before 2.6 Open Redirect via trainer-login next parameter

wger before 2.6 affected versions = 2.5.0 contains an open redirect vulnerability in the trainerlogin view wger/core/views/user.py. After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseRedirect without validating it with...

CVE-2026-86210

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /deleteuseraccount.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The...

CVE-2026-86209

A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /deleteuser.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public a...

CVE-2026-86208

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /deleteteacher.php. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit has been released to the...

CVE-2026-86210 SourceCodester Class and Exam Timetabling System delete_user_account.php sql injection

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /deleteuseraccount.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The...

EUVD-2026-72093

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /deleteuseraccount.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The...

CVE-2026-86210 SourceCodester Class and Exam Timetabling System delete_user_account.php sql injection

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /deleteuseraccount.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The...

CVE-2026-86210

A SQL injection vulnerability exists in SourceCodester Class and Exam Timetabling System 1.0 , specifically in the ID argument of the file /delete_user_account.php. The flaw allows remote, unauthenticated attackers to manipulate the ID parameter and execute arbitrary SQL, resulting in low impact ...

EUVD-2026-72089

The JetFormBuilder WordPress plugin before 3.6.5.2 does not sanitize a request parameter before rendering it as message content, allowing unauthenticated users to execute arbitrary shortcodes registered on the site on any page displaying a form. Escaping is applied to that content before a later...

CVE-2026-19859 JetFormBuilder < 3.6.5.2 - Unauthenticated Arbitrary Shortcode Execution via 'status' Parameter

The JetFormBuilder WordPress plugin before 3.6.5.2 does not sanitize a request parameter before rendering it as message content, allowing unauthenticated users to execute arbitrary shortcodes registered on the site on any page displaying a form. Escaping is applied to that content before a later...

CVE-2026-19859

JetFormBuilder is a WordPress plugin that allows form creation. Versions before 3.6.5.2 are affected by an unauthenticated arbitrary shortcode execution vulnerability. The root cause is that the status request parameter is not properly sanitized before rendering as message content: escaping is ap...

CVE-2026-19859 JetFormBuilder < 3.6.5.2 - Unauthenticated Arbitrary Shortcode Execution via 'status' Parameter

The JetFormBuilder WordPress plugin before 3.6.5.2 does not sanitize a request parameter before rendering it as message content, allowing unauthenticated users to execute arbitrary shortcodes registered on the site on any page displaying a form. Escaping is applied to that content before a later...

CVE-2026-86209 SourceCodester Class and Exam Timetabling System delete_user.php sql injection

A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /deleteuser.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public a...

CVE-2026-86209 SourceCodester Class and Exam Timetabling System delete_user.php sql injection

A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /deleteuser.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public a...

EUVD-2026-72088

A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /deleteuser.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public a...

CVE-2026-86208 SourceCodester Class and Exam Timetabling System delete_teacher.php sql injection

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /deleteteacher.php. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit has been released to the...

CVE-2026-86208 SourceCodester Class and Exam Timetabling System delete_teacher.php sql injection

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /deleteteacher.php. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit has been released to the...