CVE-2026-111872 itsmeravitejak Online-Examination-System database.php getreport sql injection

A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::valid/MySQLDB::getresults/MySQLDB::noresults/MySQLDB::getExams/MySQLDB::latestExamID/MySQLDB::getreport of the file...

CVE-2026-111872

The itsmeravitejak Online-Examination-System (up to commit e6208e630b14657999bbfe4c9912302d2a1e2449) is vulnerable to a SQL injection vulnerability. The flaw exists in the results.php/include/database.php file, specifically affecting functions including MySQLDB::valid, MySQLDB::getresults, MySQLD...

CVE-2024-32113

CVE-2024-32113 Apache OFBIZ Batch Scanning 注意：このツールを違法攻撃に使用することを支援するものではありません。このツールは技術的な交流のみを目的としています。 Note: This tool does not support any illegal attacks. It is intended solely for technical exchange. 注意：本人不支持任何人使用本工具进行非法攻击，本工具仅作为技术交流。 Help CVE-2024-32113 Batch Scanning optional arguments: -h,...

ROOT-OS-DEBIAN-12-CVE-2026-53074 CVE-2026-53074 in linux - Patched by Root

Root has patched CVE-2026-53074 in the linux package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2025-68259 CVE-2025-68259 in linux - Patched by Root

Root has patched CVE-2025-68259 in the linux package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2025-71233 CVE-2025-71233 in linux - Patched by Root

Root has patched CVE-2025-71233 in the linux package for Root:Debian:12. Multiple fixed versions available...

ROOT-OS-DEBIAN-12-CVE-2026-31617 CVE-2026-31617 in linux - Patched by Root

Root has patched CVE-2026-31617 in the linux package for Root:Debian:12. Multiple fixed versions available...

PT-2026-116916

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix dynamic id driver deregistration race Only free the dynamic ids after having deregistered the driver and removed the "new id" attribute to avoid leaking any id added by a racing write to the attribute...

CVE-2026-98697: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix dynamic id driver deregistration race Only free the dynamic ids after having deregistered the driver and removed the "newid" attribute to avoid leaking any id added by a racing write to the attribute...

Linux Distros Unpatched Vulnerability : CVE-2026-98697

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - USB: serial: fix dynamic id driver deregistration race Only free the dynamic ids after having deregistered the driver and removed the newid attribute to avoid...

PT-2026-117162

The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the bs tcontent shortcode. The bs tcontent shortcode handler in inc/bs tabs.php emits the id attribute value into an unquoted HTML attribute. esc attr is applied, but it does not encode...

openmeetings-chat-user-idor

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · openmeetings-chat-user-idor openmeetings-chat-user-idor Class: IDOR Reach: Remote Apache OpenMeetings 9.1.0 9773c59e. Any ROOM/DASHBOARD session exports another user's private chat by setting activeTab=chatTab-uid...

CVE-2026-111930

Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/id/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. Authenticated users granted workspace use access can query the endpoint ...

CVE-2026-111895

phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferredusername claim and whose AuthEntraId::create ignores the duplicate-login exception while continuing with the existing local...

CVE-2026-111897

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability that allows category-restricted editors to manage attachments of FAQs outside their categories by supplying arbitrary record IDs. Attackers in medium permission mode can send upload or delete requests with a...

CVE-2026-111882

phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked ...

EUVD-2026-103297

Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/id/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. Authenticated users granted workspace use access can query the endpoint ...

CVE-2026-111930 Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint

Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/id/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. Authenticated users granted workspace use access can query the endpoint ...

CVE-2026-111930 Coder from 2.26.0 before 2.34.8 Information Disclosure via Workspace ACL Endpoint

Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/id/acl endpoint, which checks only workspace read access and then fetches group members using an elevated system context. Authenticated users granted workspace use access can query the endpoint ...

CVE-2026-111930

The Coder platform, versions 2.26.0 before 2.34.8 , is susceptible to an information disclosure vulnerability due to an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl endpoint. The system fails to properly validate permissions, checking only for workspace read access before f...