EUVD-2026-86495

A security vulnerability has been detected in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This impacts an unknown function of the file user/editLog.php. Such manipulation of the argument sid/addtime/type/reason/detail/logdate leads to authorization bypass...

CVE-2026-97647 ningzichun student-management-system editLog.php authorization

A security vulnerability has been detected in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This impacts an unknown function of the file user/editLog.php. Such manipulation of the argument sid/addtime/type/reason/detail/logdate leads to authorization bypass...

CVE-2026-97647 ningzichun student-management-system editLog.php authorization

A security vulnerability has been detected in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This impacts an unknown function of the file user/editLog.php. Such manipulation of the argument sid/addtime/type/reason/detail/logdate leads to authorization bypass...

CVE-2026-97647 ningzichun student-management-system editLog.php authorization

A security vulnerability has been detected in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This impacts an unknown function of the file user/editLog.php. Such manipulation of the argument sid/addtime/type/reason/detail/logdate leads to authorization bypass...

PT-2026-99067

Name of the Vulnerable Software and Affected Versions GLPI versions 0.70 through 10.0.25 GLPI versions 11.0.0 through 11.0.7 Description An authenticated hotliner or technician can bypass the configured default LDAP filter by submitting crafted criteria through the user import feature. This allow...

PT-2026-98336

Name of the Vulnerable Software and Affected Versions ningzichun student-management-system versions up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf Description A remote authorization bypass exists in the file user/editLog.php. This issue occurs when the arguments sid, addtime, type, reason, detail...

PT-2026-99091

Name of the Vulnerable Software and Affected Versions X-SpringBoot versions prior to 6.0 Description The software lacks object-level authorization in user management endpoints, which allows sub-administrators to modify or delete users without ownership verification. Attackers possessing...

PT-2026-98884

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2 Description InvoicePlane fails to validate Cross-Site Request Forgery CSRF tokens in several delete methods. Specifically, the ensure valid post request function is omitted from Payments::delete,...

CVE-2026-97060: Authorization Bypass Through User-Controlled Key

X-SpringBoot through 6.0 lacks object-level authorization in user management endpoints, allowing sub-administrators to modify or delete users without ownership verification. Attackers with user-management permissions can reset passwords for any account including the super administrator, rebind...

PT-2026-98394

Name of the Vulnerable Software and Affected Versions User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor versions prior to 4.0.3 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and...

PT-2026-98399

Name of the Vulnerable Software and Affected Versions User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor versions prior to 4.0.3 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site...

PT-2026-98865

Name of the Vulnerable Software and Affected Versions OnlyOffice/Document Editing affected versions not specified Description An unauthenticated remote attacker with access to a supported public Briefcase document can abuse unsigned save fields to perform path-traversal writes. This allows the...

PT-2026-98887

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2 Description The User Controller uses PHP's loose inequality operator to compare the session user type value with the required role. In environments using non-standard session backends that return unexpected...

CVE-2026-97737: Access of Resource Using Incompatible Type

In Wakapi before 2.17.6, the user caching service allows a lookup to be resolved in an unintended lookup context, leading to account takeover...

CVE-2026-93656: Improper Neutralization of Input During Web Page Generation

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it...

PT-2026-98903

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.13.0 through 3.13.14 RabbitMQ versions 4.0.x prior to 4.0.20 RabbitMQ versions 4.1.x prior to 4.1.11 RabbitMQ versions 4.2.x prior to 4.2.6 Description A protected tag bypass exists when the rabbitmqmanagement plugin is...

The vulnerability of the golang-x-net package in the Golang programming language arises from an improper limitation on the visible layers of the user interface. This allows attackers to carry out clickjacking attacks.

The vulnerability of the golang-x-net package in the Golang programming language is related to an incorrect limitation on the visible layers of the user interface. Exploiting this vulnerability allows a remote attacker to carry out a clickjacking attack...

The vulnerability of the mechanism for processing user groups in the Containerd environment allows a attacker to trigger a service failure.

The vulnerability of the mechanism for handling user groups in the Containerd runtime is related to an uncontrolled resource consumption. Exploiting this vulnerability can allow a attacker to cause service failures...

CVE-2026-100304: Not Failing Securely

TDuck survey form 6.0 contains an information disclosure vulnerability in FormAuthUtils.hasPermission that fails open when a form does not exist, allowing authenticated users to access deleted form submissions. Attackers can read orphaned submission data including personal information by providin...

PT-2026-99062

Name of the Vulnerable Software and Affected Versions TDuck survey form versions prior to 6.0 Description The software fails to enforce form fill-in restrictions on the authenticated submission endpoint "POST /user/form/data/create". Authenticated attackers with knowledge of a form's key can subm...