Company Visitor Management System 1.0 - SQL Injection

Company Visitor Management System 1.0 contains a SQL injection vulnerability via the login page in the username parameter. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id...

CVE-2026-19342

CVE-2026-19342 affects code-projects Task Management System 1.0, specifically the Login component’s /index.php. The vulnerability arises from manipulating the Password argument, causing improper authentication. The issue is exploitable remotely, and public exploit details are reported. No remedia...

Ghost CMS - User Enumeration

Ghost CMS 5.9.4 contains a user enumeration vulnerability in the login functionality. The application reveals whether a user account exists through different error messages, allowing attackers to enumerate valid user accounts via specially-crafted HTTP requests. id: CVE-2022-41697 info: name: Gho...

xss2shell

XSS2Shell CVE-2026-64638 pre-auth reflected XSS on...

CVE-2026-64638

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires...

EUVD-2026-54565

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires...

CVE-2026-19196 SourceCodester Photo Share Website ajax.php login sql injection

A vulnerability was found in SourceCodester Photo Share Website 1.0. The impacted element is an unknown function of the file /social/ajax.php?action=login. The manipulation of the argument email results in sql injection. The attack can be launched remotely. The exploit has been made public and...

Linux Distros Unpatched Vulnerability : CVE-2026-64638

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an...

CVE-2026-71231

IOTSmartHome's gui/login.php checkCookie function builds an authentication query as SELECT FROM users WHERE ID='' after base64-decoding the client-supplied lastLogin cookie via safedecode, which performs URL-safe base64 decoding with no sanitization of the decoded value before it is concatenated...

PT-2026-66870

Name of the Vulnerable Software and Affected Versions GeoNetwork versions 3.12.0 through 4.2.15 GeoNetwork versions 4.4.0 through 4.4.10 Description Unsafe redirect validation in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter allows an attacker to redirect...

Cisco FMC Zero-Day Actively Exploited, Static Credentials Could Expose Sensitive Data

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Wednesday added a newly disclosed security flaw impacting Cisco Secure Firewall Management Center FMC Software to its Known Exploited Vulnerabilities KEV catalog, following reports of zero-day exploitation. The vulnerability,...

CVE-2026-13690

The CVE covers the UsersWP WordPress plugin before 1.2.67. The vulnerability is in the two-factor login handler where the selected authentication provider is not validated, allowing an attacker who already has valid user credentials to bypass 2FA and log in as that user. This constitutes an authe...

CVE-2026-56583

HCL MyCloud was affected with Concurrent Login Vulnerability. It may increase the risk of unauthorized access, session hijacking, and account misuse...

EUVD-2026-46346

HCL MyCloud was affected with Concurrent Login Vulnerability. It may increase the risk of unauthorized access, session hijacking, and account misuse...

📄 WordPress WP Extended 3.0.12 Unauthenticated Blind SQL Injection

WordPress WP Extended plugin version 3.0.12 contains an unauthenticated time-based blind SQL injection vulnerability through X-Forwarded-For. A remote attacker can inject SQL through the vulnerable parameter and infer database contents through response timing. This proof of concept exploit...

EUVD-2026-44873

The Happy Coders OTP Login for WooCommerce WordPress plugin before 2.8 does not verify that a one-time password was actually validated before authenticating a user based on a supplied identifier, allowing unauthenticated attackers to log in as any existing user, including administrators, as well ...

EUVD-2026-44791

o CVE-2026-40957 is a frameable content vulnerability in the Secure Access server login page prior to 14.55. Attackers with control of a malicious web site could use it to potentially steal credentials from an unwary administrator...

CVE-2026-58488

HedgeDoc is an open source, real-time, collaborative, markdown notes application. Versions prior to 1.11.0 allowed attackers to circumvent the rate-limiting of the /login and /register routes by spoofing IP addresses. HedgeDoc instances checked for CloudFlare's cf-connecting-ip header and used th...

EUVD-2026-39510

File Browser: Command Injection via Authentication Hook Shell Substitution Pre-Authentication RCE...

CVE-2026-15190

A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. This affects an unknown part of the file /login.php. Performing a manipulation of the argument Username results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and m...