PT-2026-90821

A vulnerability was found in vvbbnn00 WARP-Clash-API up to c7bf2360073959861219b422e51ae86411051b46. This affects the function doUpdateLicenseKey. The manipulation results in race condition. The attack can be launched remotely. The attack requires a high level of complexity. The exploitability is...

PT-2026-90853

A weakness has been identified in PHPGurukul Bank Locker Management System 1.0. Affected is an unknown function of the file /blms/banker/add-locker-form.php. This manipulation of the argument addressproof causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has...

PT-2026-90731

A security flaw has been discovered in lenve vhr 1.0-SNAPSHOT. This issue affects some unknown processing of the component MailReceiver. Performing a manipulation results in deserialization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be...

PT-2026-90870

A security flaw has been discovered in Rizwan17 inventory-management-system up to bfe78a330d01bb26b9daec5dc9ecd5c77900e03f. Affected is an unknown function of the file dashboard.php. Performing a manipulation of the argument userid results in improper access controls. It is possible to initiate t...

PT-2026-90968

A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. The impacted element is the function processFrameContinuousAndNonFin of the file Draft 6455.java of the component Fragmentation Handler. Executing a manipulation can lead to allocation of resources. The attack may be...

PT-2026-90930

A vulnerability was identified in GPAC up to f1219cde. The impacted element is the function gf sg mfurl del of the file scenegraph/vrml tools.c of the component MP4Box. The manipulation leads to null pointer dereference. Local access is required to approach this attack. The exploit is publicly...

PT-2026-90828

Name of the Vulnerable Software and Affected Versions dromara orion-visor versions prior to 2.5.8 Description A remote manipulation of the ExposeApiAspect.beforeExposeApi function within the ExposeApiAspect.java file can lead to the exposure of hard-coded credentials. Recommendations At the momen...

PT-2026-90788

Name of the Vulnerable Software and Affected Versions Fengoffice Feng Office versions prior to 3.11.13.12 Description An issue exists in the Reorder Handlers component within the file application/controllers/MoreController.class.php. A remote attacker can perform a SQL injection by manipulating t...

PT-2026-90971

A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0. This vulnerability affects the function PermissionService.checkUserPermission of the file /rpc/service/PermissionService.java of the component Permission Service. The manipulation leads to missing authorization. Remote...

PT-2026-90861

A security flaw has been discovered in jaychouchannel Tourism-Management-System up to 229956e20dbd4a80eeff14535e44d3099502af09. The impacted element is an unknown function of the component Update Endpoint. Performing a manipulation results in missing authentication. The attack may be initiated...

PT-2026-90944

A vulnerability was detected in GPAC up to f1219cde. Affected by this vulnerability is the function gf node get field of the file scenegraph/base scenegraph.c of the component MP4Box. Performing a manipulation results in heap-based buffer overflow. The attack is only possible with local access. T...

PT-2026-90785

A vulnerability has been found in Fengoffice Feng Office up to 3.11.13.11. This impacts the function Contacts::instance-findAll of the file application/models/CompanyWebsite.class.php of the component Legacy API. Such manipulation of the argument auth leads to sql injection. The attack can be...

PT-2026-90799

A vulnerability was identified in lenve vhr 1.0-SNAPSHOT. Affected by this issue is some unknown functionality of the file vhr.sql. The manipulation leads to use of default credentials. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor...

PT-2026-90852

Name of the Vulnerable Software and Affected Versions PHPGurukul Bank Locker Management System version 1.0 Description An improper access control issue exists in the sidebar.php file. A remote attacker can manipulate the UserType argument to bypass security restrictions and gain unauthorized...

PT-2026-90982

Name of the Vulnerable Software and Affected Versions itsourcecode Sales and Inventory System version 1.0 Description A remote SQL injection is possible due to improper handling of the ID argument within the /pages/inv edit1.php endpoint. SQL injection is a technique where an attacker inserts...

CVE-2026-90489

Xuxueli xxl-job up to 3.5.0 contains a cross-site scripting (XSS) vulnerability in the /jobinfo/insert endpoint. Manipulating the name or author arguments allows remote attackers with low privileges (requiring user interaction) to inject client-side scripts. The CVSS 3.1 base score is 3.5 (LOW) ,...

CVE-2026-90489 Xuxueli xxl-job insert cross site scripting

A vulnerability was identified in Xuxueli xxl-job up to 3.5.0. This vulnerability affects unknown code of the file /jobinfo/insert. Such manipulation of the argument name/author leads to cross site scripting. The attack can be executed remotely. The exploit is publicly available and might be used...

CVE-2026-90487

A vulnerability was found in Xuxueli xxl-job up to 3.4.2. Affected by this issue is some unknown functionality of the file xxl-job-admin/src/main/java/com/xxl/job/admin/business/controller/JobGroupController.java. The manipulation results in improper privilege management. The attack may be launch...

CVE-2026-90488

Xuxueli xxl-job (up to 3.4.2 ) is vulnerable to code injection via the GroovyClassLoader.parseClass function in GlueFactory.java (xxl-job-core). The vulnerability allows remote exploitation with low complexity and low privileges required, resulting in a CVSS 3.1 score of 6.3 (MEDIUM) . A proof-of...

CVE-2026-90487

Xuxueli xxl-job versions up to 3.4.2 are affected by an improper privilege management flaw in the JobGroupController.java file within the xxl-job-admin module. The root cause is a missing authentication check on the loadById endpoint, allowing a remote, low-privilege attacker to access job group ...