CVE-2026-19862 JetFormBuilder < 3.6.5.2 - Unauthenticated Email Header Injection via Send Email Action

The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients a...

WordPress JetFormBuilder plugin < 3.6.5.2 - Unauthenticated Email Header Injection vulnerability

Unauthenticated Email Header Injection vulnerability discovered by Emirhan Kurt in WordPress Plugin JetFormBuilder versions 3.6.5.2...

CVE-2026-19862 JetFormBuilder < 3.6.5.2 - Unauthenticated Email Header Injection via Send Email Action

The JetFormBuilder WordPress plugin before 3.6.5.2 does not validate or strip line breaks from address values it sources from submitted form fields before adding them to the headers of the e-mails it sends, allowing unauthenticated users to inject arbitrary e-mail headers, add hidden recipients a...

CVE-2026-19862

JetFormBuilder WordPress plugin versions before 3.6.5.2 are vulnerable to unauthenticated email header injection via the Send Email action. The root cause is that the plugin does not validate or strip line breaks from address values sourced from submitted form fields before including them in outg...

CVE-2026-86180 code-projects Task Management System In PHP Login index.php sql injection

A vulnerability has been found in code-projects Task Management System In PHP 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The...

CVE-2026-86180 code-projects Task Management System In PHP Login index.php sql injection

A vulnerability has been found in code-projects Task Management System In PHP 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The...

EUVD-2026-72077

A vulnerability has been found in code-projects Task Management System In PHP 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php of the component Login. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The...

CVE-2026-86180

A SQL injection vulnerability affects the Login component of code-projects Task Management System In PHP 1.0 , specifically through manipulation of the email parameter in /index.php. The attack is remote and requires no authentication or user interaction , with a CVSS 3.1 score of 7.3 (HIGH) . Th...

CVE-2026-18480

The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that...

EUVD-2026-72062

The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that...

CVE-2026-18480 SureCart < 4.6.3 - Subscriber+ Administrator Account Takeover

The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that...

CVE-2026-18480 SureCart < 4.6.3 - Subscriber+ Administrator Account Takeover

The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that...

CVE-2026-18480

The SureCart WordPress plugin (versions before 4.6.3 ) contains an improper privilege management vulnerability. The plugin fails to verify that the account targeted by a customer update matches the account authorized by the permission check. This flaw allows an attacker with a subscriber-level ac...

CVE-2026-75816

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the preupdatevalue function lacking any capability or ownership check, and ActionPost::conditionslogic short-circuiting it...

CVE-2026-75816 Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the preupdatevalue function lacking any capability or ownership check, and ActionPost::conditionslogic short-circuiting it...

CVE-2026-75816

The Frontend Admin by DynamiApps WordPress plugin (all versions up to and including 3.29.12 ) is vulnerable to unauthenticated account takeover via an authentication bypass. The root cause lies in the pre_update_value function lacking a capability or ownership check, combined with ActionPost::con...

EUVD-2026-72044

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the preupdatevalue function lacking any capability or ownership check, and ActionPost::conditionslogic short-circuiting it...

CVE-2026-75816 Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Authentication Bypass to Account Takeover in all versions up to, and including, 3.29.12. This is due to the preupdatevalue function lacking any capability or ownership check, and ActionPost::conditionslogic short-circuiting it...

PT-2026-86530

A vulnerability was determined in Mstfakts College-Management-System. Impacted is an unknown function of the file Front-end/login.php. This manipulation of the argument email causes improper authentication. It is possible to initiate the attack remotely. The exploit has been publicly disclosed an...

PT-2026-86573

Name of the Vulnerable Software and Affected Versions Projectwolds Online Attendance System version 1.0 Description A remote cross-site scripting issue exists in the profile.php file. The flaw allows for the manipulation of the email variable to execute malicious scripts in the context of the...