CVE-2026-94105

NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to...

CVE-2026-94015 SourceCodester Drug Recommendation System edit_user.php sql injection

A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file /drugrecommender/Admin/edituser.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly available an...

EUVD-2026-83736

A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file /drugrecommender/Admin/edituser.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly available an...

CVE-2026-93997 SourceCodester Drug Recommendation System edit_symptom.php sql injection

A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected by this issue is some unknown functionality of the file /Admin/editsymptom.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has...

CVE-2026-94105

NivoCart through 2.4.0 contains a destructive configuration write vulnerability in its admin password reset controller (reset.php). An unauthenticated attacker can send a GET request with a missing or incorrect code parameter , which rewrites the config_password setting to 0, effectively disablin...

EUVD-2026-83725

NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to...

CVE-2026-93973

A vulnerability was detected in SourceCodester Online Reviewer Management System 1.0. The impacted element is an unknown function of the file /reviewer0/admins/assessments/subject/btnfunctions.php?action=remove. Performing a manipulation of the argument ID results in sql injection. The attack can...

CVE-2026-93974

A flaw has been found in SourceCodester Online Reviewer Management System 1.0. This affects an unknown function of the file /reviewer0/admins/assessments/databank/btnfunctions.php?action=remove. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched...

CVE-2026-93974

A SQL injection vulnerability exists in SourceCodester Online Reviewer Management System 1.0 , specifically in the ID argument of /reviewer_0/admins/assessments/databank/btn_functions.php?action=remove. The flaw can be exploited remotely without authentication or user interaction. The exploit has...

CVE-2026-93959

A SQL injection vulnerability exists in SourceCodester Online Reviewer Management System 1.0 , specifically in the file /reviewer_0/admins/assessments/course/btn_functions.php. The injection is triggered by manipulating the Course argument. The attack can be carried out remotely with no privilege...

PT-2026-95941

Name of the Vulnerable Software and Affected Versions SourceCodester Online Reviewer Management System version 1.0 Description A remote SQL injection is possible due to improper handling of the ID variable within the /reviewer 0/admins/assessments/subject/btn functions.php?action=remove endpoint...

SUSE CVE-2026-63458

Perses is an open-source dashboard and visualization project for observability data. Prior to 0.54.0-beta.3, an authenticated user with viewer access to one project can supply another project through the project query parameter on project-scoped list endpoints, including...

CVE-2026-93988

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...

CVE-2026-93988 QloApps through 1.7.0 Arbitrary File Read via getEmailHTML

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...

CVE-2026-93982

OpenPanel (through commit bad75bdd ) writes Model Context Protocol (MCP) authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP...

CVE-2026-93982 OpenPanel through 2.3.0 MCP Authentication Token in Query Parameter Logged Plaintext

OpenPanel through 2.3.0 writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP requests and acces...

CVE-2026-93982 OpenPanel through 2.3.0 MCP Authentication Token in Query Parameter Logged Plaintext

OpenPanel through 2.3.0 writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP requests and acces...

CVE-2026-76579

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVE-2026-76579 LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter

The LiteSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'esi' parameter in all versions up to, and including, 7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVE-2026-76579

LiteSpeed Cache for WordPress (all versions up to and including 7.9 ) contains a Reflected Cross-Site Scripting vulnerability in the ESI (esi) parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary scripts by supplying a validly sign...