CVE-2026-19384

CVE-2026-19384 affects SourceCodester Simple Doctors Appointment System 1.0. The vulnerability is an SQL injection in the admin/ajax.php?action=set_appointment path, caused by manipulating the argument ID in an unknown function. The issue can be remotely exploitable, and public exploits/PoC are n...

EUVD-2026-54983

A weakness has been identified in SourceCodester Simple Doctors Appointment System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=setappointment. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has...

Photon OS 5.0: Postgresql13 PHSA-2024-5.0-91-0419

An update of the postgresql13 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0419. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Postgresql15 PHSA-2025-5.0-91-0490

An update of the postgresql15 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0490. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Photon OS 5.0: Postgresql15 PHSA-2024-5.0-91-0419

An update of the postgresql15 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0419. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

PT-2026-69889

Name of the Vulnerable Software and Affected Versions Metabase affected versions not specified Description A remote, unauthenticated attacker can perform a SQL injection, which is the insertion of malicious SQL queries into input fields to manipulate a database, via the '/reset password' endpoint...

PT-2026-69983

Name of the Vulnerable Software and Affected Versions Mastodon versions prior to 4.4.21 Mastodon versions prior to 4.5.14 Mastodon versions prior to 4.6.4 Mastodon versions prior to 4.7.0-beta.1 Description Administrative statistics endpoints handled by Api::V1::Admin::MeasuresController and...

PT-2026-69890

Name of the Vulnerable Software and Affected Versions Metabase affected versions not specified Description An unauthenticated attacker can perform SQL injection by utilizing a publicly shared card or dashboard. The issue occurs when these shared elements expose a field-filter dimension parameter,...

Photon OS 5.0: Postgresql15 PHSA-2025-5.0-91-0683

An update of the postgresql15 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0683. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

PT-2026-69328

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Doctors Appointment System version 1.0 Description A SQL injection flaw exists that allows remote attackers to manipulate the ID argument. This issue occurs within an unknown function in the '/admin/ajax.php?action=set...

Photon OS 5.0: Postgresql13 PHSA-2025-5.0-91-0490

An update of the postgresql13 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0490. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

WordPress Core 6.9-7.0.1 - Pre-Auth Batch-Route Confusion

WordPress core versions 6.9.0 through 6.9.4 and 7.0.0 through 7.0.1 are vulnerable to a pre-authentication route confusion issue in the REST API batch endpoint /?restroute=/batch/v1. A malformed nested batch request desynchronizes the batch router, allowing unauthenticated requests to reach...

CVE-2026-19364

A vulnerability was determined in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /viewdoctorconsultancycharge.php. This manipulation of the argument delid causes sql injection. The attack is possible to be carried out remotely. The exploit has...

CVE-2026-19364 itsourcecode Hospital Management System viewdoctorconsultancycharge.php sql injection

A vulnerability was determined in itsourcecode Hospital Management System 1.0. The affected element is an unknown function of the file /viewdoctorconsultancycharge.php. This manipulation of the argument delid causes sql injection. The attack is possible to be carried out remotely. The exploit has...

CVE-2026-19364

The CVE concerns itsourcecode Hospital Management System 1.0. The vulnerability is in an unknown function in /viewdoctorconsultancycharge.php where manipulating the delid argument leads to SQL injection. Attacks can be performed remotely, and public disclosure of the exploit is noted. The connect...

CVE-2026-19355

A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of the component ms-mdiy. Executing a manipulation of the argument formFields can lead to sql injection. The attack may be performed from remot...

CVE-2026-19354

A vulnerability was found in lock-upme OPMS up to 831440f37a92c1568f2e071d5233bc873a9d8b09. The impacted element is an unknown function of the file controllers/messages/message.go of the component IN Clause Handler. Performing a manipulation of the argument ids results in sql injection. The attac...

CVE-2026-19355 MingSoft MCMS ms-mdiy list.do ModelDataImpl.queryDiyFormData sql injection

A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of the component ms-mdiy. Executing a manipulation of the argument formFields can lead to sql injection. The attack may be performed from remot...

CVE-2026-19355

A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of the component ms-mdiy. Executing a manipulation of the argument formFields can lead to sql injection. The attack may be performed from remot...

EUVD-2026-54923

A vulnerability was determined in MingSoft MCMS up to 3.0.6. This affects the function ModelDataImpl.queryDiyFormData of the file /mdiy/form/data/list.do of the component ms-mdiy. Executing a manipulation of the argument formFields can lead to sql injection. The attack may be performed from remot...