CVE-2026-86180 code-projects Task Management System In PHP Login index.php sql injection

A vulnerability has been found in code-projects Task Management System In PHP 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The...

EUVD-2026-72077

A vulnerability has been found in code-projects Task Management System In PHP 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The...

CVE-2026-86180

A SQL injection vulnerability affects the Login component of code-projects Task Management System In PHP 1.0 , specifically through manipulation of the email parameter in /index.php. The attack is remote and requires no authentication or user interaction , with a CVSS 3.1 score of 7.3 (HIGH) . Th...

CVE-2026-18480

The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that...

EUVD-2026-72062

The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that...

CVE-2026-18480

The SureCart WordPress plugin (versions before 4.6.3 ) contains an improper privilege management vulnerability. The plugin fails to verify that the account targeted by a customer update matches the account authorized by the permission check. This flaw allows an attacker with a subscriber-level ac...

CVE-2026-18480 SureCart < 4.6.3 - Subscriber+ Administrator Account Takeover

The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that...

CVE-2026-18480 SureCart < 4.6.3 - Subscriber+ Administrator Account Takeover

The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that...

CVE-2026-75816

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the preupdatevalue function lacking any capability or ownership check, and ActionPost::conditionslogic short-circuiting it...

CVE-2026-75816

The Frontend Admin by DynamiApps WordPress plugin (all versions up to and including 3.29.12 ) is vulnerable to unauthenticated account takeover via an authentication bypass. The root cause lies in the pre_update_value function lacking a capability or ownership check, combined with ActionPost::con...

CVE-2026-75816 Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the preupdatevalue function lacking any capability or ownership check, and ActionPost::conditionslogic short-circuiting it...

CVE-2026-75816 Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the preupdatevalue function lacking any capability or ownership check, and ActionPost::conditionslogic short-circuiting it...

EUVD-2026-72044

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the preupdatevalue function lacking any capability or ownership check, and ActionPost::conditionslogic short-circuiting it...

PT-2026-86573

Name of the Vulnerable Software and Affected Versions Projectwolds Online Attendance System version 1.0 Description A remote cross-site scripting issue exists in the profile.php file. The flaw allows for the manipulation of the email variable to execute malicious scripts in the context of the...

PT-2026-86491

A vulnerability has been found in code-projects Task Management System In PHP 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The...

PT-2026-86530

A vulnerability was determined in Mstfakts College-Management-System. Impacted is an unknown function of the file Front-end/login.php. This manipulation of the argument email causes improper authentication. It is possible to initiate the attack remotely. The exploit has been publicly disclosed an...

CVE-2026-86180: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in code-projects Task Management System In PHP 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The...

PT-2026-86482

🚨 CVE-2026-18480 The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and...

PT-2026-86473

Name of the Vulnerable Software and Affected Versions Frontend Admin by DynamiApps versions prior to 3.29.13 Description An authentication bypass allows unauthenticated attackers to take over accounts. The issue occurs because the pre update value function lacks capability or ownership checks, an...

PT-2026-86505

The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients a...