PT-2026-90853

A weakness has been identified in PHPGurukul Bank Locker Management System 1.0. Affected is an unknown function of the file /blms/banker/add-locker-form.php. This manipulation of the argument addressproof causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has...

PT-2026-90785

A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance-findAll of the file application/models/CompanyWebsite.class.php of the component Legacy API. Such manipulation of the argument auth leads to sql injection. The attack can be...

PT-2026-90731

A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This issue affects some unknown processing of the component MailReceiver. Performing a manipulation results in deserialization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be...

PT-2026-90870

A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is an unknown function of the file dashboard.php. Performing a manipulation of the argument userid results in improper access controls. It is possible to initiate t...

PT-2026-90788

Name of the Vulnerable Software and Affected Versions Fengoffice Feng Office versions prior to 3.11.13.12 Description An issue exists in the Reorder Handlers component within the file application/controllers/MoreController.class.php. A remote attacker can perform a SQL injection by manipulating t...

PT-2026-90852

Name of the Vulnerable Software and Affected Versions PHPGurukul Bank Locker Management System version 1.0 Description An improper access control issue exists in the sidebar.php file. A remote attacker can manipulate the UserType argument to bypass security restrictions and gain unauthorized...

PT-2026-90828

Name of the Vulnerable Software and Affected Versions dromara orion-visor versions prior to 2.5.8 Description A remote manipulation of the ExposeApiAspect.beforeExposeApi function within the ExposeApiAspect.java file can lead to the exposure of hard-coded credentials. Recommendations At the momen...

PT-2026-90799

A vulnerability was identified in lenve vhr 1.0-SNAPSHOT. Affected by this issue is some unknown functionality of the file vhr.sql. The manipulation leads to use of default credentials. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor...

PT-2026-90930

A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gf sg mfurl del of the file scenegraph/vrml tools.c of the component MP4Box. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit is publicly...

PT-2026-90968

A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. The impacted element is the function processFrameContinuousAndNonFin of the file Draft 6455.java of the component Fragmentation Handler. Executing a manipulation can lead to allocation of resources. The attack may be...

PT-2026-90821

A vulnerability was found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. This affects the function doUpdateLicenseKey. The manipulation results in race condition. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is...

PT-2026-90931

Name of the Vulnerable Software and Affected Versions itsourcecode Sales and Inventory System version 1.0 Description A remote SQL injection flaw exists in the file /pages/emp transac.php?action=add. The issue occurs when the firstname argument is manipulated, allowing an attacker to execute...

PT-2026-90944

A vulnerability was detected in GPAC up to f1219cde. Affected by this vulnerability is the function gf node get field of the file scenegraph/base scenegraph.c of the component MP4Box. Performing a manipulation results in heap-based buffer overflow. The attack is only possible with local access. T...

CVE-2026-90489 Xuxueli xxl-job insert cross site scripting

A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown code of the file /jobinfo/insert. Such manipulation of the argument name/author leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used...

CVE-2026-90489

Xuxueli xxl-job up to 3.5.0 contains a cross-site scripting (XSS) vulnerability in the /jobinfo/insert endpoint. Manipulating the name or author arguments allows remote attackers with low privileges (requiring user interaction) to inject client-side scripts. The CVSS 3.1 base score is 3.5 (LOW) ,...

CVE-2026-90487

A vulnerability was found in Xuxueli xxl-job up to 3.4.2. Affected by this issue is some unknown functionality of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobGroupController.java. The manipulation results in improper privilege management. The attack may be launch...

CVE-2026-90488

Xuxueli xxl-job (up to 3.4.2 ) is vulnerable to code injection via the GroovyClassLoader.parseClass function in GlueFactory.java (xxl-job-core). The vulnerability allows remote exploitation with low complexity and low privileges required, resulting in a CVSS 3.1 score of 6.3 (MEDIUM) . A proof-of...

CVE-2026-90487 Xuxueli xxl-job JobGroupController.java privileges management

A vulnerability was found in Xuxueli xxl-job up to 3.4.2. Affected by this issue is some unknown functionality of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobGroupController.java. The manipulation results in improper privilege management. The attack may be launch...

CVE-2026-90487

Xuxueli xxl-job versions up to 3.4.2 are affected by an improper privilege management flaw in the JobGroupController.java file within the xxl-job-admin module. The root cause is a missing authentication check on the loadById endpoint, allowing a remote, low-privilege attacker to access job group ...

PT-2026-90729

Name of the Vulnerable Software and Affected Versions Xuxueli xxl-job versions prior to 3.5.1 Description A remote cross site scripting issue exists in the /jobinfo/insert endpoint. This occurs when the name or author variables are manipulated, allowing an attacker to execute malicious scripts in...