CVE-2026-92252 Incorrect Default Permissions in WatchDog Anti-Virus Installation Directory

Incorrect default permissions in the installation directory of WatchDog Anti-Virus on Windows allow local, low-privileged users to modify, replace, or delete antivirus binaries and configuration files, because the installer grants the Users group Full Control over C:\Program Files x86\Watchdog...

CVE-2026-93975

code-projects Assessment Management 1.0 is affected by a cross-site scripting (XSS) vulnerability in the admin/edit-user.php file (User Editing component). Manipulation of the arguments name, sname, email, username, password, or id allows an authenticated remote attacker to inject script, resulti...

CVE-2026-93975 code-projects Assessment Management User Editing edit-user.php cross site scripting

A vulnerability has been found in code-projects Assessment Management 1.0. This impacts an unknown function of the file admin/edit-user.php of the component User Editing. The manipulation of the argument name/sname/email/username/password/id leads to cross site scripting. The attack may be...

CVE-2026-93975 code-projects Assessment Management User Editing edit-user.php cross site scripting

A vulnerability has been found in code-projects Assessment Management 1.0. This impacts an unknown function of the file admin/edit-user.php of the component User Editing. The manipulation of the argument name/sname/email/username/password/id leads to cross site scripting. The attack may be...

CVE-2026-86554

SmartLife app dynamically generates brand‑new SmartLife application authentication parameters within its runtime process. With the obtained SmartLife application authentication parameters, attackers can directly invoke the backend interface /account/verify.serv to determine whether a target email...

CVE-2026-81653

The Photo Gallery, Sliders, Proofing and WordPress plugin before 4.5.0 does not verify that the user acting on an image owns the gallery it belongs to, allowing users granted its gallery-management capability by an administrator to delete, copy and re-tag any image on the site, including images i...

CVE-2026-93975: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in code-projects Assessment Management 1.0. This impacts an unknown function of the file admin/edit-user.php of the component User Editing. The manipulation of the argument name/sname/email/username/password/id leads to cross site scripting. The attack may be...

CVE-2026-94033: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in SourceCodester Drug Recommendation System 1.0. This vulnerability affects unknown code of the file /drugrecommender/Admin/adduser of the component User Management. Such manipulation of the argument txtname/txtemail/txtpassword leads to cross site scripting. It is...

PT-2026-95948

Name of the Vulnerable Software and Affected Versions code-projects Assessment Management version 1.0 Description Cross site scripting occurs in the User Editing component within the admin/edit-user.php file. A remote attacker can trigger this issue by manipulating the name, sname, email, usernam...

PT-2026-95976

Name of the Vulnerable Software and Affected Versions SourceCodester Drug Recommendation System version 1.0 Description Cross site scripting XSS occurs in the User Management component within the file /drug recommender/Admin/add user. A remote attacker can execute this attack by manipulating the...

CVE-2026-92420 Hydra Booking < 1.2.2 - Hydra Host+ Cross-Host Booking Deletion and Modification via IDOR

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints, allowing a booking-provider-level user to cancel and permanently delete other...

CVE-2026-76554 WP Import Export Lite < 3.9.35 - Authenticated Privilege Escalation via User Import

The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage...

CVE-2026-76554 WP Import Export Lite < 3.9.35 - Authenticated Privilege Escalation via User Import

The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage...

CVE-2026-76554

The WP Import Export Lite WordPress plugin (versions before 3.9.35 ) is vulnerable to an authenticated privilege escalation due to improper privilege management. The plugin fails to verify if a user running an import is authorized to create or modify user accounts and assign roles. This allows us...

CVE-2025-15698 Business Name Generator <= 1.3 - Admin+ Stored XSS via Button Color Setting

The Business Name Generator WordPress plugin through 1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2026-92967

CVE-2026-92967 affects the Pochipp WordPress plugin in versions up to and including 1.20.2 . The vulnerability is a Reflected Cross-Site Scripting flaw in the keyword parameter. The root cause is insufficient output escaping: the code reads $_GET['keyword'], applies only sanitize_text_field() (wh...

CLEANSTART-2026-MZ50851 flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled

Security vulnerability affects the keycloak package. A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 FGAP V2 is enabled...

CVE-2025-15698: Improper Neutralization of Input During Web Page Generation

The Business Name Generator WordPress plugin through 1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2026-94001: Missing Authorization

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from...

CVE-2026-92420: Authorization Bypass Through User-Controlled Key

The Hydra Booking — Appointment Scheduling & Booking Calendar WordPress plugin before 1.2.2 does not verify that a booking belongs to the requesting user before modifying or deleting it on two of its booking endpoints, allowing a booking-provider-level user to cancel and permanently delete other...