CVE-2026-76049

CVE-2026-76049 is a SQL injection in SourceCodester Simple Online Food Ordering System 1.0, triggered via the ID argument in /admin/ajax.php?action=save_menu, exploitable remotely with no authentication; CVSS 7.3 HIGH, exploit code maturity PoC, but no specific in-the-wild exploitation evidence i...

PT-2026-78768

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user with the "power" role can store malicious Search...

PT-2026-78331

Name of the Vulnerable Software and Affected Versions JetEngine versions prior to 3.8.15 Description An unauthenticated remote code execution RCE flaw exists, allowing an attacker to execute arbitrary code on the server without requiring authentication. Recommendations Update JetEngine to version...

PT-2026-78342

Name of the Vulnerable Software and Affected Versions Outranking Plugin versions prior to 1.1.4 Description Broken access control allows unauthenticated users to access the options of the Outranking Plugin. Recommendations Update to a version newer than 1.1.3...

PT-2026-78284

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are...

PT-2026-78390

phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create. When LDAP authentication is enabled, after a successful LDAP bind the code calls User::setStatus'active' unconditionally, which overwrites the account status column of a pre-existing local...

PT-2026-78393

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.7 Description Insufficient enforcement of the CONFIGURATION EDIT permission on administrative API read endpoints allows any authenticated user to access sensitive administrative data. By utilizing a valid session...

PT-2026-78693

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /database/export endpoint creates a user export that includes the global settings table even though the rest of the export is user-scoped. The settings table...

PT-2026-78264

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Online Food Ordering System version 1.0 Description A remote SQL injection flaw exists in the /admin/ajax.php?action=login endpoint. The issue occurs when the Username argument is manipulated, allowing an attacker to...

PT-2026-78266

A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This impacts an unknown function of the file /admin/ajax.php?action=delete menu. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been mad...

PT-2026-78301

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted...

PT-2026-78831

Name of the Vulnerable Software and Affected Versions Splunk MCP Server app versions prior to 1.2.1 Description Users with the admin Splunk role can execute arbitrary commands on the underlying operating system. This occurs due to missing input validation within the credential management componen...

PT-2026-78265

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Online Food Ordering System version 1.0 Description Remote SQL injection is possible through the manipulation of the ID argument in the '/admin/ajax.php?action=save menu' endpoint. SQL injection is a technique where an...

PT-2026-78740

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user without admin or power roles can achieve Remote Code...

CVE-2026-55483: Missing Authorization

Snipe-IT is an IT asset/license management system. Prior to 8.6.0, an authenticated user with users.create permission can submit the admin permission while creating a user because store in app/Http/Controllers/Users/UsersController.php strips superuser permission but does not strip admin...

CVE-2026-76583: Improper Neutralization of Special Elements used in a Command

A vulnerability was identified in TRENDnet TV-IP751WIC 11.03.03. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/admin/settime.cgi of the component alphapd. The manipulation leads to command injection. The attack can be initiated remotely. The exploit is publicly...

CVE-2026-55089: Incorrect Authorization

Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/ in the authorizationcode OAuth path by using requiredClaims with the admin claim. This check requires only that the claim exists, while...

CVE-2026-76049: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=savemenu. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-76050: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This impacts an unknown function of the file /admin/ajax.php?action=deletemenu. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been made...

CVE-2026-16570: Improper Neutralization of Input During Web Page Generation

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are...