CVE-2026-13495

The CVE-2026-13495 entry affects itsourcecode Hospital Management System 1.0, with a vulnerability in /adminprofile.php where the loginid parameter is susceptible to SQL injection. The issue can be exploited remotely, and the exploit has been disclosed publicly. No remediation details are provide...

CVE-2026-13495

A vulnerability has been found in itsourcecode Hospital Management System 1.0. Impacted is an unknown function of the file /adminprofile.php. The manipulation of the argument loginid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the publ...

school-buslocation-sqli-cve

CVE-2026-XXXXX Unauthenticated SQL Injection in School Man...

PT-2026-53106

Name of the Vulnerable Software and Affected Versions itsourcecode Hospital Management System version 1.0 Description A SQL injection issue exists in the /adminprofile.php endpoint. This occurs when the loginid variable is manipulated, allowing a remote attacker to execute unauthorized database...

PT-2026-53108

Name of the Vulnerable Software and Affected Versions itsourcecode Hospital Management System version 1.0 Description A SQL injection issue exists in the /appointment.php file. This occurs when the editid parameter is manipulated, allowing a remote attacker to execute unauthorized database querie...

PT-2026-53109

Name of the Vulnerable Software and Affected Versions yashpokharna2555 restaurent-management-system affected versions not specified Description An issue exists in the POST Parameter Handler component within the /forgotpassword.php file. Remote manipulation of the email parameter allows for SQL...

PT-2026-53115

Name of the Vulnerable Software and Affected Versions code-projects Project Management System version 1.0 Description Cross site scripting XSS occurs in the Mail Compose Page component within the /mail.php endpoint. This issue allows a remote attacker to execute malicious scripts through the...

CVE-2026-56034

Unauthenticated SQL Injection in Library Management System = 3.5.7 versions...

CVE-2026-56034 WordPress Library Management System plugin <= 3.5.7 - SQL Injection vulnerability

Unauthenticated SQL Injection in Library Management System = 3.5.7 versions...

EUVD-2026-39697

Unauthenticated SQL Injection in Library Management System = 3.5.7 versions...

CVE-2026-56034

The CVE concerns the WordPress Library Management System plugin (versions

CVE-2026-57913

Johnson & Johnson Audit Tracking Management System ATMS before 2026-04-21 allows viewing of meeting minutes and transcripts...

PT-2026-52750

Name of the Vulnerable Software and Affected Versions Library Management System versions prior to 3.5.8 Description An unauthenticated SQL Injection exists in the system, allowing an attacker to execute arbitrary SQL commands without providing credentials. Recommendations Update to a version newe...

CVE-2026-40702

CVE-2026-40702 involves WebSocket endpoints in EVoke Systems EVoke CSMS that lack authentication, allowing attackers to impersonate charging stations and gain unauthorized access or perform actions. The underlying issue is no authentication for the WebSocket interface, enabling privilege escalati...

CVE-2026-45233

The CVE details a path traversal in HTMLy CMS (up to version 3.1.1) where an authenticated, low-privilege user can relocate arbitrary files via the admin autosave endpoint. The root cause is unsanitized directory traversal sequences passed to file_exists() and rename() in admin.php without canoni...

EUVD-2026-39459

HTMLy CMS through 3.1.1 contains a path traversal vulnerability that allows low-privileged authenticated attackers to relocate arbitrary files by supplying directory traversal sequences in the oldfile parameter at the admin autosave endpoint. Attackers can pass unsanitized traversal sequences...

CVE-2026-37149

GCV- CVE-2026-37149 affects GROCERY-STORE-MANAGEMENT-SYSTEM-USING-PHP-AND-MYSQL-PHPMYADMIN v1.0. A SQL injection vulnerability exists in the scost parameter of /grocery/search_products.php, enabling an attacker to access sensitive database information through a crafted SQL statement. The CVSS v3....

Zhengfang Software Co., Ltd.'s Zhengfang Academic Management System has a vulnerability regarding arbitrary file reading.

Positive Software Co., Ltd. hereinafter referred to as “Positive Company” was established in January 1999. It is a software and high-tech enterprise specialized in consulting, planning, construction, and services in the field of higher education informatization. Positive Software Co., Ltd. has a...

CVE-2026-53662

immich is a high performance self-hosted photo and video management solution. From commit 4ffa26c9 until 4eb1003, a reflected cross-site scripting XSS vulnerability on the /auth/login page allows an attacker to fully compromise any authenticated user's account with a single link click. The contin...

EUVD-2026-38178

Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Control Panel user without permission to view a target private asset can call the endpoint with an attacker-controlled assetId and receive preview HTML containing a signed fallback transform preview...