PT-2026-87028

The WPML Multilingual CMS plugin for WordPress is vulnerable to time-based SQL Injection via the ‘elementIds’ parameter in all versions up to, and including, 4.9.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes ...

EulerOS 2.0 SP12 : proftpd (EulerOS-SA-2026-3298)

According to the versions of the proftpd package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : ProFTPD modsftp contains a heap-based buffer overflow reachable by an authenticated SFTP user. The fxppacketread function accepts the...

PT-2026-88179

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 11.110.0.143 cPanel versions prior to 11.134.0.55 cPanel versions prior to 11.136.0.39 cPanel versions prior to 11.138.0.4 cPanel WP Squared versions prior to 11.138.1.9 Description A SQL injection flaw exists in the...

CVE-2026-86310

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/custedit1.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the publ...

CVE-2026-86309

A flaw has been found in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/prosearchfrm.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used...

CVE-2026-86310 itsourcecode Sales and Inventory System cust_edit1.php sql injection

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/custedit1.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the publ...

CVE-2026-86310 itsourcecode Sales and Inventory System cust_edit1.php sql injection

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/custedit1.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the publ...

EUVD-2026-72450

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/custedit1.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the publ...

CVE-2026-86310

itsourcecode Sales and Inventory System 1.0 contains a SQL injection vulnerability in the file /pages/cust_edit1.php , triggered by manipulating the ID argument. The attack can be launched remotely with low privileges and no user interaction. A proof-of-concept exploit has been disclosed to the p...

USN-8734-1: PHP vulnerabilities

It was discovered that PHP incorrectly handled Apache map decoding in SOAP servers with a typemap configured. A remote attacker could use this issue to cause a NULL pointer dereference, resulting in a denial of service. CVE-2026-7262 It was discovered that PHP incorrectly handled signed integer...

USN-8734-1 php7.0 vulnerabilities

It was discovered that PHP incorrectly handled Apache map decoding in SOAP servers with a typemap configured. A remote attacker could use this issue to cause a NULL pointer dereference, resulting in a denial of service. CVE-2026-7262 It was discovered that PHP incorrectly handled signed integer...

EUVD-2026-72410

A flaw has been found in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/prosearchfrm.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used...

CVE-2026-86309 itsourcecode Sales and Inventory System pro_searchfrm.php sql injection

A flaw has been found in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/prosearchfrm.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used...

CVE-2026-86309 itsourcecode Sales and Inventory System pro_searchfrm.php sql injection

A flaw has been found in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/prosearchfrm.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used...

CVE-2026-86309

itsourcecode Sales and Inventory System 1.0 is vulnerable to SQL injection via the ID argument in the file /pages/pro_searchfrm.php . The attack can be initiated remotely with low privileges and no user interaction, resulting in low impact on confidentiality, integrity, and availability (CVSS 3.1...

OSWAP-top10-handson-practical-writeups-report

Cybersecurity Lab Write-Ups Hands-on write-ups from a local,...

CVE-2026-19634

A flaw was found in PostgreSQL Anonymizer. A SQL injection vulnerability exists in the importdatabaserules and importrolesrules functions. A malicious user can craft a JSON document with specially designed object names. If a superuser then imports this document, the malicious code within it can b...

CVE-2026-86298

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file /deletesubject.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit has been...

EUVD-2026-72347

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. Impacted is an unknown function of the file /deletesubject.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-86298

CVE-2026-86298 affects SourceCodester Class and Exam Timetabling System 1.0 , where an unauthenticated remote attacker can exploit a SQL injection vulnerability in the /delete_subject.php file by manipulating the ID parameter. The flaw is rated CVSS 3.1: 7.3 (HIGH) with low impact on confidential...