CVE-2026-11469

A flaw has been found in jishenghua jshERP up to 3.6. Impacted is the function insertPlatformConfig of the file jshERP-boot/src/main/java/com/jsh/erp/service/PlatformConfigService.java of the component platformConfig Add Endpoint. Executing a manipulation of the argument platformValue can lead to...

PT-2026-47335

A security flaw has been discovered in imvks786 student management system up to 9599b560ad3c3b83e75d328b76bedcd489ef1f46. This impacts an unknown function of the file admin/admin login.php of the component Administrator Login Endpoint. Performing a manipulation of the argument a usr/a pwd results...

Zimbra Collaboration Suite XSS

The vulnerability of the Zimbra Collaboration Suite email management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

Zimbra Collaboration Suite Briefcase XSS

The vulnerability of the Briefcase feature in the Zimbra Collaboration Suite email management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

tunnel.allowNgrokFreeTierLoopbackBypass Parameter Compromise

The vulnerability of the tunnel.allowNgrokFreeTierLoopbackBypass parameter is related to the AI agent OpenClaw previously ClawdBot or MoltBot. This vulnerability stems from the lack of authentication for a critical function. Exploiting this vulnerability allows an attacker operating remotely to...

OpenClaw OAuth CSRF

The vulnerability of the OAuth authorization protocol implementation of the AI agent OpenClaw formerly known as ClawdBot or MoltBot is related to the manipulation of cross-site requests. Exploiting this vulnerability allows a malicious actor to perform a CSRF attack remotely...

Navigation Section Bypass

The vulnerability of the Navigation section in Microsoft Edge and Google Chrome relates to a flaw in data protection mechanisms. Exploiting this vulnerability allows an attacker to bypass existing security measures through a specially created HTML page, operating remotely...

Zimbra Collaboration Suite XXE

The vulnerability of the Zimbra Collaboration Suite email management system is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability allows a malicious actor to perform XXE attacks remotely...

PT-2026-47269

A vulnerability has been found in CodeAstro Leave Management System 1.0. This impacts an unknown function of the file /admin/search staff for deletion.php. The manipulation of the argument Name leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed t...

CVE-2026-11506: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in CodeAstro Leave Management System 1.0. This impacts an unknown function of the file /admin/searchstafffordeletion.php. The manipulation of the argument Name leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to t...

SourceCodester Online Examination & Learning Management System – Syllabus-aligned Learning Management and Examination System. Issues with trust management vulnerabilities.

SourceCodester Online Examination & Learning Management System is an open-source online examination and learning management system developed by SourceCodester. Version 1.0 of the SourceCodester Online Examination & Learning Management System and Syllabus-aligned Learning Management and Examinatio...

PT-2026-47253

A vulnerability was identified in CodeAstro Human Resource Management System 1.0. Impacted is an unknown function of the file /notice/All notice of the component Notice Board Management. Such manipulation of the argument Notice Title with the input as part of POST leads to cross site scripting. I...

ROS-20260608-73-0003

The vulnerability of the ASP.NET Core software platform is related to errors in checking the cryptographic signature. Exploiting this vulnerability can allow an attacker, operating remotely, to increase their privileges...

Everbrite BeikeShop injection vulnerability

Everbrite BeikeShop is an e-commerce system developed by China Everbright Corporation. Versions of Everbrite BeikeShop prior to 1.6.0.22 contained a SQL injection vulnerability. This vulnerability stemmed from improper handling of parameters with the value “settings.value” in the unknown function...

CVE-2026-11529: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in designcomputer mysql-mcp-server up to 0.2.2. The impacted element is the function readresource of the file src/mysqlmcpserver/server.py of the component mysql URI Handler. This manipulation of the argument uristr causes sql injection. Remote exploitation of the...

Student-Management-System injection vulnerability

Student-Management-System is an open-source student information management system developed by Cyber-III. There is a vulnerability in Student-Management-System, which stems from improper handling of the parameter “nic” in the getStatus function of the controllers/GradeController.php file at the...

hsweb4 Path traversal vulnerability

hsweb4 is an open-source full-responsive backend management framework based on Spring Boot 2. Versions of hsweb4 prior to 5.0.1 contained a path traversal vulnerability. This vulnerability stemmed from improper handling of the parameter filename in the file upload component’s code, located at...

📄 WordPress ARMember Premium 7.3.1 SQL Injection

WordPress ARMember Premium plugin version 7.3.1 remote SQL injection and account takeover exploit. ================================================================================================================================== | Title : WordPress ARMember Premium 7.3.1 SQL Injection and Accoun...

CVE-2026-11486: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /archive1.php. Performing a manipulation of the argument sy results in sql injection. Remote exploitation of the attack is possible. The...

PT-2026-47439

Name of the Vulnerable Software and Affected Versions CodeAstro Payroll System version 1.0 Description A remote SQL injection is possible due to the manipulation of the rate/salary rate argument within an unknown function of the '/home salary.php' file. SQL injection is a technique where an...