ROS-20260921-73-0016

The vulnerability of the printing subsystem in Samba networking-enabled programs is related to the lack of measures taken to neutralize special elements during the processing of the %J parameter. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-36468

A Cross-site Scripting (XSS) vulnerability exists in the index.php component of CuteNews v.2.1.2 . The root cause is the improper neutralization of input during web page generation , which allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key. If this key contai...

CVE-2026-94139: Improper Neutralization of Special Elements used in a Command

A weakness has been identified in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. Affected is an unknown function of the file /sendorder.cgi?parameter=loginout of the component Cookie Handler. This manipulation of the argument sessionid causes command injection. Remote...

CVE-2026-36468

Cross-site Scripting XSS in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part of its name containing any URL-encoded common XSS payload such as "alert1...

ROS-20260921-73-0109

The vulnerability of the checkpassword script in the DCE/RPC SAMR server of the Samba networking software package is related to the failure to eliminate special elements during the processing of the parameter %u. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by...

CVE-2026-36468: Improper Neutralization of Input During Web Page Generation

Cross-site Scripting XSS in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part of its name containing any URL-encoded common XSS payload such as "...

CVE-2026-36468

Cross-site Scripting XSS in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part of its name containing any URL-encoded common XSS payload such as "alert1...

PT-2026-96125

Name of the Vulnerable Software and Affected Versions CuteNews version 2.1.2 Description Cross-site Scripting XSS occurs in the 'index.php' file. Remote unauthenticated attackers can exploit this by providing an arbitrarily named URL parameter key that contains a URL-encoded XSS payload...

EUVD-2026-83990

Cross-site Scripting XSS in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part of its name containing any URL-encoded common XSS payload such as "alert1...

PT-2026-96298

Name of the Vulnerable Software and Affected Versions Gladys Assistant versions prior to 5.1.0 Description An issue exists where unauthenticated remote attackers can obtain valid password reset tokens for any account. This occurs due to a lack of server-side validation of the client-supplied orig...

Exploit for SQL Injection in Zoneminder

ZoneMinder 1.29/1.30 SQLi to RCE Exploit A ready-to-run Pytho...

EUVD-2026-83767

Joomla Extension - OrdaSoft.com - Unauthenticated SQL Injection in OrdaSoft Joomla Gallery extension for Joomla getVar, which is not a real Joomla filter method and falls through to a filter that strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a...

NextRecon

NextRecon NextRecon is a simple Python-based reconnaissance tool designed for bug bounty hunters, security researchers, and penetration testers. It performs passive recon by collecting archived URLs from the Wayback Machine and fetching leaked credentials from the BreachCollection API. It also...

CVE-2026-94032 itsourcecode Leave Management System index.php sql injection

A flaw has been found in itsourcecode Leave Management System 1.0. This affects an unknown part of the file /module/department/index.php. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The exploit has been published and may be used...

CVE-2026-94105

NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to...

CVE-2026-94015 SourceCodester Drug Recommendation System edit_user.php sql injection

A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file /drugrecommender/Admin/edituser.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly available an...

EUVD-2026-83736

A vulnerability was identified in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file /drugrecommender/Admin/edituser.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly available an...

CVE-2026-93997 SourceCodester Drug Recommendation System edit_symptom.php sql injection

A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected by this issue is some unknown functionality of the file /Admin/editsymptom.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has...

EUVD-2026-83725

NivoCart through 2.4.0 contains a destructive configuration write vulnerability in the admin password reset controller that allows unauthenticated attackers to disable password recovery by supplying an invalid code parameter. Attackers can send a GET request with a missing or incorrect code to...

CVE-2026-94105

NivoCart through 2.4.0 contains a destructive configuration write vulnerability in its admin password reset controller (reset.php). An unauthenticated attacker can send a GET request with a missing or incorrect code parameter , which rewrites the config_password setting to 0, effectively disablin...