CVE-2026-104085

The odt2spip plugin for SPIP (versions before 4.4.0) is vulnerable to OS command injection . The root cause is insufficient sanitization of document filenames within the odt2spip_deplacer_fichier_upload() function and LibreOffice::createCommand(). Authenticated authors can execute arbitrary comma...

CVE-2026-104085 odt2spip < 4.4.0 OS Command Injection via Document Filename

odt2spip plugin for SPIP before 4.4.0 contains an OS command injection vulnerability that allows authenticated authors to execute arbitrary commands by uploading a document with a maliciously crafted filename through the document import form. Attackers can embed shell metacharacters such as $id i...

WordPress Database Addon for Contact Form 7 – CFDB7 plugin <= 1.4.1 - Unauthenticated Limited File Deletion vulnerability

Unauthenticated Limited File Deletion vulnerability discovered by Sawyer in WordPress Plugin Contact Form 7 Database Addon – CFDB7 versions = 1.4.1...

CVE-2026-109162 TYPO3 CMS - Security Misconfiguration in Form Framework

Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/userupload/ instead of the configured destination. This could cause uploaded files to end up in a publicly accessible storage even though a restricted,...

CVE-2026-109162

A security misconfiguration in the TYPO3 CMS Form Framework (versions 14.0.0-14.3.8 ) allows uploaded files to be stored in the default 1:/user_upload/ folder instead of the intended destination when using FileUpload or ImageUpload elements with a custom saveToFileMount configuration. This bypass...

CVE-2026-109162 TYPO3 CMS - Security Misconfiguration in Form Framework

Forms using FileUpload or ImageUpload elements with a custom saveToFileMount configured stored uploaded files in the default storage folder 1:/userupload/ instead of the configured destination. This could cause uploaded files to end up in a publicly accessible storage even though a restricted,...

CVE-2026-109114

A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This vulnerability affects unknown code of the file User/login.php of the component Login Form. Such manipulation of the argument email/passwd leads to improper...

TYPO3-CORE-SA-2026-024: Security Misconfiguration in Form Framework

More info at https://news.typo3.com/security/advisory/typo3-core-sa-2026-024...

EUVD-2026-98326

A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This vulnerability affects unknown code of the file User/login.php of the component Login Form. Such manipulation of the argument email/passwd leads to improper...

CVE-2026-109114 AdithyaYelloju Restaurant-Management-System Login Form login.php improper authentication

A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This vulnerability affects unknown code of the file User/login.php of the component Login Form. Such manipulation of the argument email/passwd leads to improper...

CVE-2026-109114 AdithyaYelloju Restaurant-Management-System Login Form login.php improper authentication

A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This vulnerability affects unknown code of the file User/login.php of the component Login Form. Such manipulation of the argument email/passwd leads to improper...

CVE-2026-109114

The AdithyaYelloju Restaurant-Management-System (up to commit 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c) contains an improper authentication vulnerability in the Login Form component, specifically affecting the User/login.php file. Manipulation of the email/passwd arguments allows for remote unaut...

CVE-2026-108970

A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::addNewUser of the file include/database.php of the component Registration Form. Performing a manipulation of the argument branch results in s...

CVE-2026-108970 itsmeravitejak Online-Examination-System Registration Form database.php addNewUser sql injection

A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::addNewUser of the file include/database.php of the component Registration Form. Performing a manipulation of the argument branch results in s...

EUVD-2026-98293

A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::addNewUser of the file include/database.php of the component Registration Form. Performing a manipulation of the argument branch results in s...

CVE-2026-108970 itsmeravitejak Online-Examination-System Registration Form database.php addNewUser sql injection

A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::addNewUser of the file include/database.php of the component Registration Form. Performing a manipulation of the argument branch results in s...

CVE-2026-108970

The itsmeravitejak Online-Examination-System is vulnerable to a remote SQL injection in the Registration Form component. The vulnerability exists within the MySQLDB::addNewUser function located in the include/database.php file, where manipulation of the branch argument allows for unauthorized dat...

CVE-2023-5965

PoC for Espo CRM 7.2.4 CVE-2023-5965 & CVE-2023-5965 CVE-2023-5965 Advisory An authenticated privileged attacker could upload a specially crafted zip to the EspoCRM server in version 7.2.5, via the update form, which could lead to arbitrary PHP code execution. To upload the file go to...

CVE-2021-42665

CVE-2021-42665 CVE-2021-42665 - SQL Injection authentication bypass vulnerability in the Engineers online portal system. Technical description: An SQL Injection vulnerability exists in the Engineers Online Portal login form which can allow an attacker to bypass authentication. Affected components...

CLEANSTART-2026-VI85539 Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes

CVE-2026-94440 affects multiple packages. Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes. See references for individual vulnerability details...