CVE-2026-5472

CVE-2026-5472 affects ProjectsAndPrograms School Management System (up to build 6b6fae5426044f89c08d0dd101c7fa71f9042a59). The vulnerability lies in the Profile Picture Handler, specifically an unknown function in /admin_panel/settings.php that manipulates the File argument to cause unrestricted ...

CVE-2026-5472

A flaw has been found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. The affected element is an unknown function of the file /adminpanel/settings.php of the component Profile Picture Handler. This manipulation of the argument File causes unrestrict...

CVE-2026-5472 ProjectsAndPrograms School Management System Profile Picture settings.php unrestricted upload

A flaw has been found in ProjectsAndPrograms School Management System up to 6b6fae5426044f89c08d0dd101c7fa71f9042a59. The affected element is an unknown function of the file /adminpanel/settings.php of the component Profile Picture Handler. This manipulation of the argument File causes unrestrict...

GHSA-GHC5-95C2-VWCV

creationtimestamp| type| source ---|---|--- 2026-04-03 15:22:05+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3milzkcnizop2 2026-04-03 16:52:24+00:00| seen|...

CVE-2026-28756

creationtimestamp| type| source ---|---|--- 2026-04-03 12:00:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3milocanjqh24 2026-04-03 12:53:33+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3milrayuqdt2g 2026-04-03 13:19:05+00:00| seen|...

CVE-2026-35414

creationtimestamp| type| source ---|---|--- 2026-04-03 09:56:02+00:00| seen| https://bsky.app/profile/omo.bsky.social/post/3milhdeiiu22d 2026-04-27 18:30:06+00:00| seen| https://t.me/truesecator/8150 2026-04-29 07:06:34+00:00| seen|...

CVE-2026-34444

creationtimestamp| type| source ---|---|--- 2026-04-03 09:00:05+00:00| published-proof-of-concept| Telegram/iJe41NTkZQJK4wFVG9OP9y2V0JVLEcjlDCmGEFn1YNc-zvI 2026-04-06 17:32:38+00:00| seen| Telegram/n5Nok-XlRHEre5O89LvYLplT02rw8wZYprnGR4USXlLgM 2026-04-09 20:41:47+00:00| seen|...

CVE-2026-33752

creationtimestamp| type| source ---|---|--- 2026-04-03 09:00:05+00:00| published-proof-of-concept| Telegram/iJe41NTkZQJK4wFVG9OP9y2V0JVLEcjlDCmGEFn1YNc-zvI 2026-04-03 10:27:33+00:00| published-proof-of-concept| https://github.com/lexiforest/curlcffi/security/advisories/GHSA-qw2m-4pqf-rmpp...

CVE-2025-70951

creationtimestamp| type| source ---|---|--- 2026-04-03 08:28:11+00:00| seen| https://bsky.app/profile/r-netsec-bot.bsky.social/post/3milcgipy3h2d 2026-04-03 09:24:32+00:00| seen| https://bsky.app/profile/r-netsec.bsky.social/post/3milflba2je26 2026-04-03 20:14:53+00:00| seen|...

CVE-2026-34876

creationtimestamp| type| source ---|---|--- 2026-04-03 07:01:00+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mil5kl4adx27 2026-04-03 07:01:24+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mil5lcfqjt2p...

CVE-2026-35507

creationtimestamp| type| source ---|---|--- 2026-04-03 04:10:28+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3miktznighg2q...

CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

Summary Vulnerability 1: Stored DOM XSS via Profile Name Update Persistent Payload Injection - Stored Cross-Site Scripting via Unsanitized User Name in Profile Management Description The application fails to properly sanitize user-controlled input when users update their profile name e.g., full...

Improper Privilege Management

Overview ci4-cms-erp/ci4ms is a composer create-project ci4-cms-erp/ci4ms Affected versions of this package are vulnerable to Improper Privilege Management via the profile name update process. An attacker can execute arbitrary JavaScript in the browsers of users, including administrators, by...

GHSA-VR2G-RHM5-Q4JR CI4MS: Profile & User Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

Summary Vulnerability 1: Stored DOM XSS via Profile Name Update Persistent Payload Injection - Stored Cross-Site Scripting via Unsanitized User Name in Profile Management Description The application fails to properly sanitize user-controlled input when users update their profile name e.g., full...

GHSA-H5HG-H7RR-GPF3 OpenClaw: Node browser proxy `allowProfiles` bypass through persistent profile mutation and runtime profile selection

Summary Node browser proxy allowProfiles bypass through persistent profile mutation and runtime profile selection Current Maintainer Triage - Status: open - Normalized severity: high - Assessment: Real released allowProfiles bypass through profile mutation and runtime profile selection, fixed and...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization via persistent mutation of the allowProfiles configuration and runtime profile selection. An attacker can gain unauthorized access to restricted profiles by...

OpenClaw: Node browser proxy `allowProfiles` bypass through persistent profile mutation and runtime profile selection

Summary Node browser proxy allowProfiles bypass through persistent profile mutation and runtime profile selection Current Maintainer Triage - Status: open - Normalized severity: high - Assessment: Real released allowProfiles bypass through profile mutation and runtime profile selection, fixed and...

CVE-2026-32213

creationtimestamp| type| source ---|---|--- 2026-04-03 01:05:19+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mikjolecgh24 2026-04-03 01:16:28+00:00| seen| Telegram/iJ-TXq8dDjuzcBmcTa4J1ArjLXeEo9DZvpPvRg0iyulgok 2026-04-03 02:32:29+00:00| seen|...

CVE-2026-26135

creationtimestamp| type| source ---|---|--- 2026-04-03 00:50:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mikitpnzqk2z 2026-04-03 01:16:28+00:00| seen| Telegram/iJ-TXq8dDjuzcBmcTa4J1ArjLXeEo9DZvpPvRg0iyulgok 2026-04-03 01:50:22+00:00| seen|...

CVE-2026-32173

creationtimestamp| type| source ---|---|--- 2026-04-03 00:40:59+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mikid3mvqm22 2026-04-03 01:16:28+00:00| seen| Telegram/iJ-TXq8dDjuzcBmcTa4J1ArjLXeEo9DZvpPvRg0iyulgok 2026-04-03 02:14:31+00:00| seen|...