CVE-2023-46980

CVE-2023-46980 An issue in Best Courier Management System v.1.000 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted script to the userID parameter. Additional Information Video POC Link On YT ; https://youtu.be/3Mz2lSElg7Y Vulnerability Type Incorrect Access...

CVE-2026-11344-RCE

Vehicle Management System In PHP - Unauthenticated Remote Code Execution via File Upload in newdriver.php Vulnerability Information Field| Details ---|--- Product| Vehicle Management System In PHP Vendor| code-projects.org Version| V1.0 Vulnerability Type| Unrestricted File Upload leading to Remo...

PT-2026-107922

Name of the Vulnerable Software and Affected Versions MasterStudy LMS versions prior to 3.7.53 Description Stored Cross-site Scripting XSS occurs due to improper neutralization of input during web page generation. This allows an attacker to inject malicious scripts that are stored on the server a...

EUVD-2026-93508

Payload: Bypassed sanitization of user uploaded SVGs...

CVE-2019-8997

CVE-2019-8997 An XML External Entity Injection XXE vulnerability in the Management System console of BlackBerry AtHoc versions earlier than 7.6 HF-567 could allow an attacker to potentially read arbitrary local files from the application server or make requests on the network by entering...

[SECURITY] Fedora 44 Update: rocq-9.3.0-1.fc44

Rocq is a formal proof management system. It provides a formal language to write mathematical definitions, executable algorithms and theorems together with an environment for semi-interactive development of machine-checked proof s. Typical applications include the certification of properties of...

CVE-2026-105867

Payload is a free and open source headless content management system. In @payloadcms/storage-s3 versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user can overwrite an existing S3 object belonging to another upload collection when client uploads are enabled for...

CVE-2026-105862

The Payload headless content management system is vulnerable in versions before 3.90.0 and canary versions before 4.0.0-canary.34 . A collection allowing downloadable SVG uploads can store a malicious file that bypasses sanitization. When a user downloads and opens the SVG, it executes attacker-c...

EUVD-2026-93495

Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can expose information about related documents protected by access.read where...

CVE-2026-105851 Payload: Field access control bypass on auth collections

Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, the duplicate operation copies values from a source document even when a field is hidden or its access.read or access.create rule rejects that val...

CVE-2026-105846

Payload is a free and open source headless content management system. In versions from 3.40.0 before 3.88.0 and canary versions before 4.0.0-canary.27, an attacker can craft a redirect URL parameter that sends a guest user to an untrusted destination after the authentication flow completes. This...

CVE-2026-105921

A vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This affects an unknown function of the file searchclass.php. Such manipulation of the argument schoolyear leads to sql injection. The attack may be launched remotely. The...

CVE-2026-105920

A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The impacted element is an unknown function of the file studentsignup.php of the component Student Registration Endpoint. This manipulation causes sql injection. The attack ma...

CVE-2026-105921 Kusalkasilva Learning-Management-System search_class.php sql injection

A vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This affects an unknown function of the file searchclass.php. Such manipulation of the argument schoolyear leads to sql injection. The attack may be launched remotely. The...

CVE-2026-105921

A SQL injection vulnerability exists in the Kusalkasilva Learning-Management-System (up to commit ffeb873f8803f1e9664384ff75000c7da45466d2) within an unknown function of the search_class.php file. The flaw is triggered by manipulating the school_year argument and can be launched remotely . While ...

CVE-2026-105921 Kusalkasilva Learning-Management-System search_class.php sql injection

A vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This affects an unknown function of the file searchclass.php. Such manipulation of the argument schoolyear leads to sql injection. The attack may be launched remotely. The...

EUVD-2026-93423

A vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This affects an unknown function of the file searchclass.php. Such manipulation of the argument schoolyear leads to sql injection. The attack may be launched remotely. The...

CVE-2026-105921 Kusalkasilva Learning-Management-System search_class.php sql injection

A vulnerability was identified in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This affects an unknown function of the file searchclass.php. Such manipulation of the argument schoolyear leads to sql injection. The attack may be launched remotely. The...

CVE-2026-105920

A SQL injection vulnerability exists in the Student Registration Endpoint of the Kusalkasilva Learning-Management-System (up to commit ffeb873f8803f1e9664384ff75000c7da45466d2). The flaw is located within an unknown function in the student_signup.php file. This vulnerability allows for remote att...

EUVD-2026-93414

A vulnerability was determined in Kusalkasilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. The impacted element is an unknown function of the file studentsignup.php of the component Student Registration Endpoint. This manipulation causes sql injection. The attack ma...