CVE-2022-38813

CVE-2022-38813 Veritical Privilege Escalation via user parameter in Blood Donor Management System Using Codeigniter v 1.0 Technical description: Blood Donor Management System 1.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all data of users, delete t...

CVE-2022-40470

CVE-2022-40470 Cross Site Scripting in Blood Donor Management System Using CodeIgniter - 1.0 Suggested description Phpgurukul Blood Donor Management System 1.0 allows Cross Site Scripting via Add Blood Group Name Feature. Additional Information PoC:...

CVE-2026-111981

The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report view access but not donor-edit access to add, modify, or delete the stored address of any donor on the site...

WordPress GiveWP plugin < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification vulnerability

Authenticated Arbitrary Donor Address Modification vulnerability discovered by Hariom Singh in WordPress Plugin GiveWP versions 4.19.0.1...

CVE-2026-111981 GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_addresses

The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report view access but not donor-edit access to add, modify, or delete the stored address of any donor on the site...

CVE-2026-111981 GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_addresses

The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report view access but not donor-edit access to add, modify, or delete the stored address of any donor on the site...

EUVD-2026-109346

The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report view access but not donor-edit access to add, modify, or delete the stored address of any donor on the site...

CVE-2026-111981

The GiveWP WordPress plugin in versions before 4.19.0.1 is vulnerable to an Authenticated Arbitrary Donor Address Modification due to a missing capability check when handling donor address changes. This flaw allows users with donor-report (view) access, but without donor-edit permissions, to add,...

PT-2026-122944

The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes, allowing users who have been granted donor-report view access but not donor-edit access to add, modify, or delete the stored address of any donor on the site...

Astra Linux – vulnerability in mariadb

The MariaDB server is a community-developed fork of the MySQL server. In versions 10.6.1 through 10.6.27, 10.11.1 through 10.11.18, 11.4.1 through 11.4.12, 11.8.1 through 11.8.8, and 12.3.1, the donor node interpolates parameters passed to it by the joiner via the command line. Not all parameters...

CVE-2026-98418

In the Linux kernel, the following vulnerability has been resolved: sched/core: Avoid false migration warning for proxy donors Proxy execution can move a blocked donor's scheduling context to the lock owner's CPU even when the donor is migration-disabled. The donor does not execute there, and its...

CVE-2026-98418

The Linux kernel contains a logic issue where the sched/core component triggers a false positive migration warning for proxy donors . Specifically, set_task_cpu() warns unconditionally for migration-disabled tasks, but moving a blocked donor's scheduling context to a lock owner's CPU does not vio...

CVE-2026-85113

The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...

EUVD-2026-83868

The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...

CVE-2026-85113 GiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution via Donor Name

The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...

CVE-2026-85113 GiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution via Donor Name

The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...

CVE-2026-85113

GiveWP WordPress plugin versions before 4.16.9 fail to remove shortcode delimiters from donor-supplied values (such as donor names) before rendering them on public pages. The shortcode-stripping logic the plugin applies can be defeated by nesting , allowing unauthenticated users to execute arbitr...

EUVD-2026-80196

The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor up, allowing unauthenticated users to be resolved as an arbitrary donor and to set the WordPress password of any user...

EUVD-2026-78224

A weakness has been identified in PHPGurukul Blood Donor Management System 1.0. Affected by this issue is some unknown functionality of the file application/models/admin/LoginModel.php. This manipulation of the argument password/email/currentpassword/dbcurrentpwd/newpassword causes cleartext...

EUVD-2026-78223

A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /application/controllers/admin/Report.php of the component Report Endpoint. The manipulation of the argument fromdate/todate results in sql...