PT-2026-92398

Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - A crafted link to the paypal notify endpoint, if followed by a victim's browser or an automated system that fetches it, causes the resulting redirec...

PT-2026-91772

Flextype CMS through 1.0.0-alpha.3 fails to properly validate id and new id parameters in the Entries REST API, allowing API token holders to read, create, or overwrite files outside the entries directory. Attackers can use traversal sequences in API requests to escape the project entries directo...

PT-2026-91850

A security flaw has been discovered in SourceCodester/katojkalemba Online Food Ordering System 1.0. The impacted element is an unknown function of the file /web/category-foods.php. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The...

PT-2026-91851

A weakness has been identified in SourceCodester/katojkalemba Online Food Ordering System 1.0. This affects an unknown function of the file /web/order.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been made available to the...

School Registration and Fee System SQL Injection Vulnerability (CNVD-2026-37879)

School Registration and Fee System is a school registration and fee management software developed by the SourceCodester community. The system has a SQL injection vulnerability, which stems from incorrect handling of the period parameter in the file bilal/normal/payreport.php. Attackers can exploi...

PT-2026-91828

A security vulnerability has been detected in SourceCodester College Notes Gallery Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /College/login.php. The manipulation of the argument User leads to sql injection. The attack may be initiated remotely...

CVE-2026-51134

The C-MOR Video Surveillance web interface (up to version 6.0104 ) by za-internet GmbH is vulnerable to a Path Traversal vulnerability. An unauthenticated attacker can access arbitrary system files by sending specially crafted HTTP requests to the show-movies.pml component, specifically by using ...

PT-2026-92145

Name of the Vulnerable Software and Affected Versions IBM Security Verify Identity Access affected versions not specified Description The reverse proxy may allow parameters to be injected in requests sent to third party services. Recommendations At the moment, there is no information about a newe...

CVE-2026-51134

The C-MOR Video Surveillance web interface up to version 6.0104 is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml...

PT-2026-92419

The C-MOR Video Surveillance web interface up to version 6.0104 is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml...

EUVD-2026-79997

The C-MOR Video Surveillance web interface up to version 6.0104 is vulnerable to Path Traversal via the 'cam' parameter in show-movies.pml...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37981)

Sales and Inventory System is an enterprise resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability, which stems from incorrect handling of the parameter “firstname” in the...

PT-2026-91869

A vulnerability has been found in SourceCodester Online Faculty Clearance System 1.0. The impacted element is an unknown function of the file /delete faculty1.php. Such manipulation of the argument ID leads to sql injection. The attack can be executed remotely. The exploit has been disclosed to t...

PT-2026-91846

A flaw has been found in PHPGurukul Hostel Management System 3.0. This affects an unknown part of the file /admin/includes/checklogin.php. This manipulation of the argument ID causes improper access controls. Remote exploitation of the attack is possible. The exploit has been published and may be...

PT-2026-91856

A vulnerability was found in SourceCodester Online Faculty Clearance System 1.0. Affected by this issue is some unknown functionality of the file /update requirement status.php. The manipulation of the argument haydi results in sql injection. It is possible to launch the attack remotely. The...

PT-2026-93202

Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in route policy add.cgi caused by a missing exit port parameter. Attackers can send requests lacking the exit port field to trigger the null pointer dereference, resulting in a denial of service...

CVE-2026-51133

Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance = V6.0104 allows a remote attacker to execute arbitrary code via the size parameter in ptzpreset.pml component and the showmovies.pml component...

PT-2026-92315

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A logic error in the s decode vui param function within the fw hevc dec header.c file allows for an out-of-bounds write. This condition can be exploited to achie...

PT-2026-91858

A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Publish Module. Such manipulation of the argument orderby/order leads to sql injection. The attack can be launched remotely. The exploit is...

CVE-2026-51133

A Cross-Site Scripting (XSS) vulnerability exists in za-internet GmbH C-MOR Video Surveillance version 6.0104 and below . The flaw allows a remote attacker to execute arbitrary client-side code by enticing an authenticated user to click crafted URLs. The vulnerability is triggered via the size pa...