Alumni Management System 1.0 - SQL Injection

SourceCodester Alumni Management System 1.0 contains a sqlinjection caused by unsanitized input in admin/login.php, letting attackers bypass authentication, exploit requires injection of malicious SQL payload. id: CVE-2020-29214 info: name: Alumni Management System 1.0 - SQL Injection author:...

JFrog Artifactory 6.7.3 - Admin Login Bypass

JFrog Artifactory 6.7.3 is vulnerable to an admin login bypass issue because by default the access-admin account is used to reset the password of the admin account. While this is only allowable from a connection directly from localhost, providing an X-Forwarded-For HTTP header to the request allo...

CVE-2026-76764

A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of the file /process/aprocess.php of the component Admin Login Endpoint. This manipulation of the argument mailuid causes sql injection. Remote exploitation of the attack is possible...

CVE-2026-76764 code-projects Employee Management System Admin Login Endpoint aprocess.php sql injection

A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of the file /process/aprocess.php of the component Admin Login Endpoint. This manipulation of the argument mailuid causes sql injection. Remote exploitation of the attack is possible...

EUVD-2026-63186

A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of the file /process/aprocess.php of the component Admin Login Endpoint. This manipulation of the argument mailuid causes sql injection. Remote exploitation of the attack is possible...

CVE-2026-76764

code-projects Employee Management System 1.0 is vulnerable to SQL injection via the mailuid argument in /process/aprocess.php (Admin Login Endpoint). CVSS 7.3 HIGH. Exploit proof-of-concept published; no patch version provided. Exploitation details not available in provided documents.

CVE-2026-64852 Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any account

Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks in user/plugins/api/api.php and authorizes the caller with only admin.login. A basic panel user c...

PT-2026-78264

A flaw has been found in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/ajax.php?action=login. Executing a manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit h...

PrestaShop - Information Disclosure

User enumeration vulnerability in the AdminLogin controller in PrestaShop 1.7 through 8.2.2 allows remote attackers to obtain administrators user email addresses via manipulation of the idemployee and resettoken parameters. An attacker who has access to the Back Office login URL can trigger the...

CVE-2026-19343

A flaw has been found in code-projects Task Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/AdminLogin.php. Executing a manipulation of the argument email/password can lead to sql injection. The attack may be performed from remote. The exploit...

CVE-2026-19343 code-projects Task Management System AdminLogin.php sql injection

A flaw has been found in code-projects Task Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/AdminLogin.php. Executing a manipulation of the argument email/password can lead to sql injection. The attack may be performed from remote. The exploit...

EUVD-2026-54912

A flaw has been found in code-projects Task Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/AdminLogin.php. Executing a manipulation of the argument email/password can lead to sql injection. The attack may be performed from remote. The exploit...

CVE-2026-15459

The WPMU DEV Dashboard plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 5.0.0. On sites not yet connected to the WPMU DEV Hub — the default state after installation — the site API key that keys the WDP-AUTH request signature is empty, making the...

CVE-2026-70594

Ghost Admin did not invalidate existing sessions on login from version 2.2.0 through 6.54.1, enabling potential session fixation if another vulnerability on the same Ghost Admin domain was present. The issue could allow an attacker to hijack an authenticated session; exploitation would require an...

CVE-2026-58071

A vulnerability in Veeam Service Provider Console allowing an unauthenticated attacker to access the proxied appliance API asPortal Administrator during a short window after an administrator session begins...

CVE-2026-11707

CVE-2026-11707 affects IBM WebSphere Application Server shipped with Tivoli System Automation Application Manager 4.1. The issue is a cross-site scripting vulnerability in the administrative console login page. IBM bulletins for this family (CVE-2026-11594, CVE-2026-11707, CVE-2026-11383) documen...

CVE-2026-14328 Eazy Plugin Manager <= 4.4.1 - Authenticated (Subscriber+) Privilege Escalation via pos_get_option AJAX Action and admin/login REST Endpoint

The Eazy Plugin Manager – Powerful Plugin Management Solution for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.4.1. This is due to insufficient authorization on the wpajaxposgetoption AJAX handler, which verifies only a nonce that is...

CVE-2026-14328

The CVE-2026-14328 entry describes a Privilege Escalation in the Eazy Plugin Manager for WordPress (up to version 4.4.1). The root cause is insufficient authorization on the wp_ajax_pos_get_option AJAX handler, which returns arbitrary WordPress options via get_option() after only a localized nonc...

CVE-2026-65007

The Grav api plugin grav-plugin-api before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission the baseline...

CVE-2026-65007 Grav before 1.0.8 Missing Authorization on API Key Generation

The Grav api plugin grav-plugin-api before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiKeyRevoke admin tasks before the account-management ACL runs and authorizes the caller on only the admin.login permission the baseline...