CVE-2026-86236

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. This issue affects some unknown processing of the file /pages/protransac.php?action=add. Such manipulation of the argument Name leads to sql injection. The attack can be launched remotely. The exploit has been disclose...

EUVD-2026-72181

A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file /pages/usdel.php?type=user. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The...

EUVD-2026-72183

A flaw has been found in itsourcecode Sales and Inventory System 1.0. This vulnerability affects unknown code of the file /pages/postransac.php?action=add. This manipulation of the argument Customer causes sql injection. The attack can be initiated remotely. The exploit has been published and may...

CVE-2026-86234

A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/custtransac.php?action=add. The manipulation of the argument firstname results in sql injection. It is possible to launch the attack remotely. The exploit is now public and...

CVE-2026-86236

itsourcecode Sales and Inventory System 1.0 is affected by a remote SQL injection in /pages/pro_transac.php?action=add, triggered by manipulation of the Name argument. The attack requires low privileges and no user interaction, with a CVSS 3.1 score of 6.3 (Medium) reflecting low impact on confid...

CVE-2026-86236 itsourcecode Sales and Inventory System pro_transac.php add sql injection

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. This issue affects some unknown processing of the file /pages/protransac.php?action=add. Such manipulation of the argument Name leads to sql injection. The attack can be launched remotely. The exploit has been disclose...

PT-2026-86804

The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...

PT-2026-86625

Name of the Vulnerable Software and Affected Versions itsourcecode Sales and Inventory System version 1.0 Description A remote SQL injection flaw exists in the /pages/emp edit1.php file. The issue occurs when the ID argument is manipulated, allowing an attacker to execute arbitrary SQL commands o...

PT-2026-86592

Name of the Vulnerable Software and Affected Versions liufee FeehiCMS versions prior to 2.1.2 Description A server-side request forgery exists in the UEditor component within the catchImage function of the backend/widgets/ueditor/Uploader.php file. A remote attacker can exploit this by manipulati...

PT-2026-86666

A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/us edit1.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly an...

PT-2026-86582

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. This issue affects some unknown processing of the file /pages/pro transac.php?action=add. Such manipulation of the argument Name leads to sql injection. The attack can be launched remotely. The exploit has been disclos...

CVE-2026-82756: Improper Encoding or Escaping of Output

Improper Encoding or Escaping of Output vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to inject arbitrary authentication parameters into the WWW-Authenticate challenge header. BearerPlug and RequireScopePlug built the Bearer resourcemetadata="..."...

PT-2026-86668

A flaw has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this vulnerability is an unknown functionality of the file delete-user.php of the component Deletion Endpoint. Executing a manipulation of the argument ID can lead to missing authentication. The attack may be...

PT-2026-86627

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/settings edit.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to...

VulnCheck KEV: CVE-2025-60687

An unauthenticated command injection vulnerability exists in the ToToLink LR1200GB Router firmware V9.1.0u.6619B20230130 within the cstecgi.cgi binary sub41EC68 function. The binary reads the "imei" parameter from a web request and verifies only that it is 15 characters long. The parameter is the...

PT-2026-86636

A vulnerability has been found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. Impacted is an unknown function of the file delete exam.php. The manipulation of the argument ID leads to authorization bypass. The attack is possible to be carried out remotely. The...

PT-2026-86931

Name of the Vulnerable Software and Affected Versions knowns versions prior to 0.30.0 Description An issue exists where unauthenticated attackers can read arbitrary files by supplying directory traversal sequences in the templateFile parameter. This occurs via the 'POST /api/templates/preview'...

PT-2026-86686

A vulnerability has been found in code-projects Hospital Information System 1.0. Affected is an unknown function of the file /HIS/src/patients/editPatient.php of the component Patient Management. Such manipulation of the argument ID leads to cross site scripting. The attack may be launched...

PT-2026-86814

A flaw has been found in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/pro searchfrm.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used...

PT-2026-86752

The Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.1.7 via the 'watch checkout' function due to missing validation on a user controlled key. This makes it...