CVE-2026-78185

A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/custedit.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit is now public and may be used...

CVE-2026-78185 itsourcecode Sales and Inventory System cust_edit.php sql injection

A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/custedit.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit is now public and may be used...

EUVD-2026-64721

A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/custedit.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit is now public and may be used...

CVE-2026-78185

A SQL injection vulnerability exists in itsourcecode Sales and Inventory System 1.0 , specifically in an unknown function of the file /pages/cust_edit.php . An authenticated remote attacker can exploit this by manipulating the ID parameter, achieving partial impact on confidentiality, integrity, ...

CVE-2026-78171

itsourcecode Sales and Inventory System 1.0 is affected by a SQL injection vulnerability in the file /pages/processlogin.php. The manipulation of the User argument allows a remote, unauthenticated attacker to inject SQL queries, potentially compromising confidentiality, integrity, and availabilit...

CVE-2026-78171 itsourcecode Sales and Inventory System processlogin.php sql injection

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/processlogin.php. The manipulation of the argument User leads to sql injection. It is possible to initiate the attack remotely. The exploit...

EUVD-2026-64693

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/processlogin.php. The manipulation of the argument User leads to sql injection. It is possible to initiate the attack remotely. The exploit...

CVE-2026-53487 Kite has an authenticated cluster RBAC bypass in /api/v1/overview

Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request /api/v1/overview for a cluster that their roles do not permit by selecting that cluster with x-cluster-name. The overview route is registered before middleware.RBACMiddleware and GetOvervie...

CVE-2026-76990

A vulnerability has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file /delete.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public...

CVE-2026-76990 code-projects Simple Inventory System delete.php sql injection

A vulnerability has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file /delete.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public...

EUVD-2026-63348

A vulnerability has been found in code-projects Simple Inventory System 1.0. Affected by this issue is some unknown functionality of the file /delete.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public...

CVE-2026-76990

A proof-of-concept exploit exists for CVE-2026-76990, a SQL injection in the ID argument of /delete.php in code-projects Simple Inventory System 1.0, exploitable remotely without authentication (CVSS 7.3 HIGH). No patch or workaround is mentioned in the provided documents.

CVE-2026-76785

A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System 0.1. Affected is the function Transaction::getAll of the file application/models/Transaction.php. Performing a manipulation of the argument orderBy/orderFormat results in sql injection. It is possible to...

CVE-2026-76785 amirsanni Mini-Inventory-and-Sales-Management-System Transaction.php getAll sql injection

A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System 0.1. Affected is the function Transaction::getAll of the file application/models/Transaction.php. Performing a manipulation of the argument orderBy/orderFormat results in sql injection. It is possible to...

CVE-2026-76785

In amirsanni's Mini-Inventory-and-Sales-Management-System 0.1, the Transaction::getAll method in application/models/Transaction.php concatenates the orderBy/orderFormat arguments directly into SQL queries, enabling remote SQL injection. The project maintainer has not responded to the early issue ...

EUVD-2026-63188

A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System 0.1. Affected is the function Transaction::getAll of the file application/models/Transaction.php. Performing a manipulation of the argument orderBy/orderFormat results in sql injection. It is possible to...

CVE-2026-44845 JumpServer: Remote Command Execution (RCE) via Jinja Template Injection in Applet Host Deployment

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, an authenticated administrator with Applet Host management and deployment permissions can inject Jinja2 expressions into the IP/Host field or Core Service Address field, causing...

CVE-2026-44845 JumpServer: Remote Command Execution (RCE) via Jinja Template Injection in Applet Host Deployment

JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.10.17, an authenticated administrator with Applet Host management and deployment permissions can inject Jinja2 expressions into the IP/Host field or Core Service Address field, causing...

Why API Discovery Is Critical for Modern AppSec Programs

Hidden API Estate And AI-speed Recon Are Reshaping Modern Application Risk Key Takeaways Unknown APIs create unattributed exposure , and such exposure rarely gets tested. Attackers build their own inventory through live reconnaissance; they do not wait for your spreadsheet. API discovery must pul...

CVE-2026-47233

Admidio is an open-source user management solution. Version 5.0.9 added a missing isAdministratorInventory gate to case 'itemdelete': in modules/inventory.php. The same fix was not applied to the sibling case 'fielddelete': handler, which destroys an entire inventory field definition, cascading t...