CVE-2026-100880 zhistaredu StarTraining Upload Endpoint MimeTypeUtils.java cross site scripting

A weakness has been identified in zhistaredu StarTraining up to 3.8.1. This vulnerability affects unknown code of the file du-common/src/main/java/com/edu/common/utils/file/MimeTypeUtils.java of the component Upload Endpoint. This manipulation of the argument File causes cross site scripting. It ...

CVE-2026-100880

The zhistaredu StarTraining software (versions up to 3.8.1 ) is vulnerable to Cross-Site Scripting (XSS) within the Upload Endpoint component. The root cause lies in the manipulation of the File argument within the file du-common/src/main/java/com/edu/common/utils/file/MimeTypeUtils.java. This vu...

CVE-2026-100877 mathurvishal CloudClassroom-PHP-Project registrationform.php cross site scripting

A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected by this vulnerability is an unknown functionality of the file registrationform.php. Executing a manipulation of the argument FName/LName/Addrs can lead to cross site...

EUVD-2026-88014

A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected by this vulnerability is an unknown functionality of the file registrationform.php. Executing a manipulation of the argument FName/LName/Addrs can lead to cross site...

CVE-2026-100877

The mathurvishal CloudClassroom-PHP-Project (up to commit 5dadec098bfbbf3300d60c3494db3fb95b66e7be ) contains a Cross-Site Scripting (XSS) vulnerability. The flaw exists in an unknown functionality within the registrationform.php file. An attacker can achieve remote execution of this attack by ma...

CVE-2026-100877 mathurvishal CloudClassroom-PHP-Project registrationform.php cross site scripting

A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. Affected by this vulnerability is an unknown functionality of the file registrationform.php. Executing a manipulation of the argument FName/LName/Addrs can lead to cross site...

CVE-2026-100873

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit is now public and may be...

CVE-2026-100873 mathurvishal CloudClassroom-PHP-Project cross-site request forgery

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit is now public and may be...

CVE-2026-100873 mathurvishal CloudClassroom-PHP-Project cross-site request forgery

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit is now public and may be...

EUVD-2026-88006

A vulnerability was detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. The impacted element is an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely. The exploit is now public and may be...

CVE-2026-100873

A cross-site request forgery (CSRF) vulnerability was identified in the mathurvishal CloudClassroom-PHP-Project (specifically in versions up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be ). The vulnerability exists within an unknown function , allowing for remote attacks. The documents indicate tha...

CVE-2026-86841

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators, allowing users granted a custom booking-management capability, which an...

CVE-2026-86841 Bookly 23.2 - 28.2 - Bookly Administrator+ PHP Object Injection via Diagnostics Advanced Options

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators, allowing users granted a custom booking-management capability, which an...

PT-2026-99707

A security vulnerability has been detected in zhistaredu StarTraining up to 3.8.1. This issue affects some unknown processing of the file application.yml. Such manipulation of the argument xss.enabled leads to cross site scripting. It is possible to launch the attack remotely. Attacks of this...

Linux Distros Unpatched Vulnerability : CVE-2026-100694

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo is a static site generator. In versions from v0.56.0 through v0.165.x, content files mapped to the text/org media type are rendered without escaping raw...

PT-2026-99496

Name of the Vulnerable Software and Affected Versions Online Scheduling and Appointment Booking System WordPress plugin versions prior to 28.3 Description The plugin fails to prevent the deserialization of untrusted input and does not properly restrict a privileged maintenance feature to...

CVE-2026-86841: Deserialization of Untrusted Data

The Online Scheduling and Appointment Booking System WordPress plugin before 28.3 does not prevent deserialization of untrusted input and does not correctly restrict a privileged maintenance feature to administrators, allowing users granted a custom booking-management capability, which an...

Linux Distros Unpatched Vulnerability : CVE-2026-100695

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTIONID database result is interpolated into JavaScript without proper escapin...

Linux Distros Unpatched Vulnerability : CVE-2026-100692

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo is a static site generator. In versions after v0.123.0 and before v0.166.0, Hugo's symlink confinement checks stopped at the mount root itself, so a theme ...

DEBIAN-CVE-2026-100695

Adminer before 6.0.2 contains a cross-site scripting vulnerability where the CONNECTIONID database result is interpolated into JavaScript without proper escaping, allowing a malicious database server to execute arbitrary JavaScript in the authenticated Adminer origin. In co-located deployments...