CVE-2026-86290

SourceCodester Online Voting System 1.0 is vulnerable to a SQL injection in the file /voting/ajax.php?action=save_category, triggered by manipulating the Category argument. The attack can be initiated remotely with no privileges or user interaction required. A proof-of-concept exploit has been ma...

CVE-2026-86290 SourceCodester Online Voting System ajax.php save_category sql injection

A weakness has been identified in SourceCodester Online Voting System 1.0. This affects an unknown function of the file /voting/ajax.php?action=savecategory. This manipulation of the argument Category causes sql injection. The attack can be initiated remotely. The exploit has been made available ...

CVE-2026-86284

A security vulnerability has been detected in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. Affected by this vulnerability is the function getOption of the file travel/src/main/java/com/controller/CommonController.java. The manipulation of the argument...

CVE-2026-86285 BookStack Attachment Edit Endpoint AttachmentController.php getUpdateForm access control

A vulnerability was detected in BookStack up to 26.05.2. Affected by this issue is the function AttachmentController::getUpdateForm of the file app/Uploads/Controllers/AttachmentController.php of the component Attachment Edit Endpoint. The manipulation of the argument ID results in improper acces...

WordPress WP Fusion (Pro) plugin <= 3.47.13 - Authenticated (Subscriber+) Privilege Escalation via ThriveCart Auto Login 'role' Parameter vulnerability

Authenticated Subscriber+ Privilege Escalation via ThriveCart Auto Login 'role' Parameter vulnerability discovered by Jarno Vos jarnovos in WordPress Plugin WP Fusion Pro versions = 3.47.13...

WordPress HivePress Authentication plugin <= 1.1.4 - Unauthenticated Authentication Bypass via 'access_token' Parameter to Facebook Authenticator vulnerability

Unauthenticated Authentication Bypass via 'accesstoken' Parameter to Facebook Authenticator vulnerability discovered by Mutantgun in WordPress Plugin HivePress Authentication versions = 1.1.4...

WordPress MemberDash plugin <= 1.8.5 - Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter vulnerability

Unauthenticated Account Takeover via Insecure Direct Object Reference via 'id' Parameter vulnerability discovered by Foxyyy in WordPress Plugin memberdash versions = 1.8.5...

CVE-2026-86277

A vulnerability has been found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. Impacted is an unknown function of the file deleteexam.php. The manipulation of the argument ID leads to authorization bypass. The attack is possible to be carried out remotely. The...

CVE-2026-86278

A cross-site scripting (XSS) vulnerability exists in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 , affecting an unknown function in manage_subjects.php . Manipulation of the msg/title/content arguments results in XSS, exploitable remotely with user interaction req...

CVE-2026-86277 SourceCodester Syllabus-Aligned Learning Management & Examination System delete_exam.php authorization

A vulnerability has been found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. Impacted is an unknown function of the file deleteexam.php. The manipulation of the argument ID leads to authorization bypass. The attack is possible to be carried out remotely. The...

CVE-2026-86277

An authorization bypass vulnerability in SourceCodester Syllabus-Alabeled Learning Management & Examination System 1.0 affects the delete_exam.php file. Manipulating the ID argument allows a remote attacker to bypass authorization controls, leading to an Insecure Direct Object Reference (IDOR) / ...

CVE-2026-86275 SourceCodester Syllabus-Aligned Learning Management & Examination System auth.php register privileges management

A vulnerability was detected in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This vulnerability affects the function register of the file auth.php. Performing a manipulation of the argument role results in improper privilege management. Remote exploitation of the...

CVE-2026-86268

A vulnerability was detected in itsourcecode School Management System 1.0. Impacted is an unknown function of the file UserLogin.php. The manipulation of the argument email results in sql injection. The attack can be executed remotely. The exploit is now public and may be used...

CVE-2026-86269

A flaw has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/empedit1.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may b...

CVE-2026-86267

A security vulnerability has been detected in itsourcecode Information System Society Membership System 1.0. This issue affects some unknown processing of the file /society/checkstudent.php. The manipulation of the argument studentid leads to sql injection. Remote exploitation of the attack is...

CVE-2026-86265

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/ustransac.php. Such manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit...

CVE-2026-86270 itsourcecode Sales and Inventory System settings_edit.php sql injection

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/settingsedit.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to t...

EUVD-2026-72252

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/settingsedit.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to t...

CVE-2026-86270

itsourcecode Sales and Inventory System 1.0 is affected by a remote SQL injection vulnerability in the file /pages/settings_edit.php, triggered by manipulating the ID argument. The flaw allows a remote, authenticated attacker (low privileges required) to inject SQL queries, potentially leading to...

CVE-2026-86270 itsourcecode Sales and Inventory System settings_edit.php sql injection

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/settingsedit.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to t...