CVE-2026-14331

Subscribe2 WordPress plugin vulnerable versions are

EUVD-2026-54308

SQL Injection vulnerability in FineAdmin V1.0 allows a remote attacker to execute arbitrary code via the field and order parameters in paginated list endpoints...

EUVD-2026-54223

A security flaw has been discovered in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /treatment.php. Performing a manipulation of the argument editid results in sql injection. Remote exploitation of the attack is possible. The exploit has bee...

EUVD-2026-54246

A vulnerability was detected in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /viewadmin.php. The manipulation of the argument delid results in sql injection. The attack may be performed from remote. The exploit is now public and may be used...

EUVD-2026-54240

A security vulnerability has been detected in itsourcecode Hospital Management System 1.0. This affects an unknown function of the file /treatmentrecord.php. The manipulation of the argument editid leads to sql injection. The attack is possible to be carried out remotely. The exploit has been...

EUVD-2026-54253

A flaw has been found in itsourcecode Hospital Management System 1.0. Affected is an unknown function of the file /viewappointment.php. This manipulation of the argument delid causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used...

EUVD-2026-54203

A vulnerability has been found in chiuwingyan house up to dea6bcceaebe2b364a5a209747f48ecc2b2dc670. This affects an unknown part of the file /paid/selectall.action. The manipulation of the argument zuname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed...

CVE-2026-48054

OpenZeppelin Contracts Wizard prior to version 0.10.9 is affected by a code injection vulnerability in generated Hardhat/Foundry tests. The root cause is interpolation of user-supplied opts.name and opts.uri directly into TypeScript test files (zip-hardhat.ts:48 and :50) without escaping, enablin...

CVE-2026-19071

Technical details about CVE-2026-19071 are not publicly available in the provided documents. Monitor for updates from linked sources, as no affected versions, root cause, or remediation details are included here.

CVE-2026-19070

The CVE affects itsourcecode Hospital Management System 1.0, specifically the /viewadmin.php script where the delid parameter can be manipulated to trigger a SQL injection. The root cause is an injection vulnerability in that file/parameter, enabling remote exploitation with low prerequisites. CV...

CVE-2026-19068

The CVE-2026-19068 entry concerns itsourcecode Hospital Management System 1.0. The vulnerability is an SQL injection in the /treatmentdetail.php file, triggered by manipulating the patientid argument. It is exploitable remotely, with a publicly available exploit and Proof-of-Concept code, indicat...

CVE-2026-19067

The CVE-2026-19067 entry concerns itsourcecode Hospital Management System 1.0. A SQL injection flaw is triggered in /treatment.php via the editid parameter, enabling remote exploitation. The exploit has been released publicly. No remediation details are provided in the supplied documents.

CVE-2026-19062

Summary: CVE-2026-19062 affects the chiuwingyan house application, specifically the /paid/selectall.action endpoint. The vulnerability arises from manipulation of the zuname parameter, enabling a remote SQL injection. Public disclosure exists; no product version details are provided, and there is...

EUVD-2026-54088

The Creative Mail WordPress plugin from 1.6.5 to 1.6.9 does not sanitize and escape a parameter before using in an SQL statement, leading to an unauthenticated SQL injection when the abandoned cart email is managed by creative mail...

CVE-2026-3430

CVE-2026-3430 affects the Creative Mail WordPress plugin versions 1.6.5–1.6.9. The issue is an unauthenticated SQL injection caused by not sanitizing/escaping a parameter before use in an SQL statement when handling abandoned cart emails. CVSS 3.1 metrics (from WPScan) indicate NETWORK attack vec...

EUVD-2026-53877

A vulnerability was detected in Kino-Kafkaesque ssh-mcp-server up to 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. Impacted is the function sshexec of the file src/index.ts of the component SSH Command Handler. Performing a manipulation of the argument host/username results in command injection. The...

EUVD-2026-53860

Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT e.g., one whose clientsecret is known or compromised can thereby substitute th...

CVE-2026-57819

Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which may lead to denial of service attacks when processing requests with very large numbers of form parameters. Users are...

EUVD-2026-53855

The OpenID Connect Core 1.0 specification mandates that the RP MUST validate the chash parameter when operating in the Hybrid Flow. If an Apache CXF RP is integrated with a non-compliant or misconfigured Identity Provider IdP that omits the chash, the RP becomes vulnerable to Authorization Code...

CVE-2026-19020

The CVE concerns itsourcecode Hospital Management System 1.0. The vulnerability lies in the file /servicetype.php, where manipulation of the editid parameter enables SQL injection. This affects remote attackers and public PoCs exist, indicating exploitable conditions. CVSS data across versions in...