EUVD-2026-51428

The WP Go Maps WordPress plugin before 10.1.04 does not properly sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-14554 Check & Log Email < 2.0.15 - Admin+ SQL Injection via d and s Parameters

The Check & Log Email WordPress plugin before 2.0.15 does not properly sanitize and escape parameters before using them in SQL queries, allowing users with administrator privileges to perform SQL injection attacks...

CVE-2026-14540

A Server-Side Request Forgery SSRF vulnerability exists in the generic HTTP source and tool components of Google mcp-toolbox versions 0.3.0 through 1.4.0. While the toolbox implements baseline input sanitization for user-controlled parameters, the underlying HTTP client...

PT-2026-66725

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the keycloak-services component of Keycloak regarding OpenID Connect OIDC authentication flows. The security check intended to prevent HTTP parameter pollution—a technique...

CVE-2026-55100: Relative Path Traversal

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent and...

CVE-2026-18209: Improper Validation of Consistency within Input

A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect OIDC authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. Whe...

CVE-2026-17567: Authorization Bypass Through User-Controlled Key

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.2.8 via the 'transaction' parameter due to missing validation on a user controlled key. This...

CVE-2026-67822

Tenda W6-S 1.0.0.4510 contains a stack-based buffer overflow vulnerability in the /goform/wifiSSIDset endpoint. The function formwrlSSIDset uses sprintf to copy user-controlled 'GO' and 'index' parameters into a 64-byte stack buffer without length restriction, leading to stack overflow...

PT-2026-66717

Name of the Vulnerable Software and Affected Versions WP Go Maps versions prior to 10.1.04 Description Unauthenticated users can perform SQL injection attacks because the plugin fails to properly sanitize and escape a parameter before incorporating it into a SQL query. SQL injection is a techniqu...

EUVD-2025-210576

SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection in ajaxData.php via the parameters districtid , divisionid, regionid, and wardid...

CVE-2026-67350: URL Redirection to Untrusted Site

Serendipity before 2.6.1 contains an open redirect vulnerability in exit.php that allows unauthenticated attackers to redirect users to arbitrary external sites by supplying a malicious Base64-encoded url parameter when the Track Exits plugin is configured with commentredirection set to s9y...

CVE-2025-69946

SourceCodester Modern Loan Management System 1.0 is vulnerable to SQL Injection within the ajaxData.php endpoint. The root cause is the improper handling of the district_id, division_id, region_id, and ward_id parameters, which allows malicious SQL statements to be executed against the database. ...

PT-2026-66743

Name of the Vulnerable Software and Affected Versions Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder versions prior to 6.2.9 Description An Insecure Direct Object Reference exists due to missing validation on a user-controlled key. Unauthenticated attackers...

dependencies_local_check() method Code Execution

The vulnerability of the dependencieslocalcheck method in the application for setting the REBOOT OS parameter redoswelcome is related to the improper elimination of special elements used in the OS command. Exploiting this vulnerability allows a malicious actor to inject special symbols into the...

CVE-2026-68500

Sylius Mollie Plugin provides Mollie payment integration for Sylius applications. Prior to 2.2.8, 3.2.4, and 3.3.1, Sylius Mollie Plugin's POST /locale/update-payment payment webhook accepts attacker-controlled id and orderId parameters but does not verify that the Mollie payment belongs to the...

CVE-2025-69937

CodeAstro Membership Management System 1.0 is vulnerable to SQL Injection in the edittype.php endpoint via the Parameter id...

CVE-2025-69935

CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenuereport.php via the fromDate parameter...

CVE-2025-65342

code-projects Blood System 1.0 is vulnerable to Cross Site Scripting XSS in /don.php via the city field...

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect via the redirectUrl parameter in the login process. An attacker can cause users to be redirected to arbitrary external sites by crafting a malicious login URL that manipulates the redirectUrl parameter, potentially leading...

Directory Traversal

Overview banks is an A prompt programming language Affected versions of this package are vulnerable to Directory Traversal via the Path parameter. An attacker can access sensitive files by supplying crafted path traversal sequences in user-controlled template variables, resulting in unauthorized...