Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute

Impact Multiple @opentelemetry/instrumentation- packages recorded the database connection username as the db.user span attribute on every instrumented database operation. This attribute was emitted unconditionally — it was not gated by enhancedDatabaseReporting or any other opt-in flag, and it wa...

GHSA-QQMP-WF37-98F9 Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute

Impact Multiple @opentelemetry/instrumentation- packages recorded the database connection username as the db.user span attribute on every instrumented database operation. This attribute was emitted unconditionally — it was not gated by enhancedDatabaseReporting or any other opt-in flag, and it wa...

BIT-MOODLE-2026-102586 Moodle: xss via password reset link due to insufficient username escaping

A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting XSS attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary...

Astra Linux – Vulnerability in OpenSSH

In OpenSSH versions prior to 10.3, command execution could occur through shell metacharacters within a username in a command line. This requires a scenario where the username on the command line is untrusted, and also requires non-default configurations of % in sshconfig...

Astra Linux – Vulnerability in cups

OpenPrinting CUPS is an open-source printing system for Linux and other Unix-like operating systems. In versions 2.4.16 and earlier, the CUPS daemon cupsd contained a authorization bypass vulnerability due to case-insensitive username comparisons during authorization checks. This vulnerability...

CVE-2026-105232 kishor-23 food-waste-management-system Registration deliverysignup.php sql injection

A flaw has been found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The impacted element is an unknown function of the file delivery/deliverysignup.php of the component Registration Page. This manipulation of the...

CVE-2026-105231 kishor-23 food-waste-management-system Admin Registration signup.php sql injection

A vulnerability was detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The affected element is an unknown function of the file admin/signup.php of the component Admin Registration. The manipulation of the argument...

CVE-2026-105231 kishor-23 food-waste-management-system Admin Registration signup.php sql injection

A vulnerability was detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The affected element is an unknown function of the file admin/signup.php of the component Admin Registration. The manipulation of the argument...

CVE-2026-105232: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The impacted element is an unknown function of the file delivery/deliverysignup.php of the component Registration Page. This manipulation of the...

PT-2026-104722

A vulnerability was detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The affected element is an unknown function of the file admin/signup.php of the component Admin Registration. The manipulation of the argument...

CVE-2026-105231: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The affected element is an unknown function of the file admin/signup.php of the component Admin Registration. The manipulation of the argument...

metasploitable2-red-team-assessment

Red Team Assessment — Metasploitable 2 Type: Authorized P...

higernes

higernes Python으로 작성된 수동적 OSINT 툴킷. API 키도, 계정도, 어디에도 로깅도 없다. 핸들, 이메일, 도메인, IP, 전화번호 또는 해시를 지정하면 이미 공개된 정보를 파헤친다. 무엇을 하는가 6개의 모듈, 모두 공개 엔드포인트를 읽는다: 모듈| 얻을 수 있는 것 ---|--- username| 핸들을 약 700개 사이트WhatsMyName 데이터셋에 걸쳐 훑으며, 적중이 들어오는 대로 실시간 갱신 email| 구문, MX, 일회용 여부 검사, gravatar, 그다음 @ 앞부분을 username으로 ...

CVE-2026-105124

The W (vincent-peugnet/wcms) content management system, versions through 3.18.0 , is vulnerable to unauthenticated stored XSS . The root cause is the lack of input sanitization in the login user field and the visitor comment website field . Attackers can inject scripts via failed login attempts, ...

CVE-2026-105124 W (wcms) through 3.18.0 Unauthenticated Stored XSS via Login Username and Comments

W vincent-peugnet/wcms through 3.18.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the login user field and visitor comment website field. Attackers can submit failed logins rendered unescaped in the adminlog.php log viewer, or...

CVE-2026-105124 W (wcms) through 3.18.0 Unauthenticated Stored XSS via Login Username and Comments

W vincent-peugnet/wcms through 3.18.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the login user field and visitor comment website field. Attackers can submit failed logins rendered unescaped in the adminlog.php log viewer, or...

CVE-2026-96962

The Pie Register WordPress plugin (versions prior to 3.8.4.14 ) contains a vulnerability where it fails to restrict access to an invitation-code report . This flaw allows unauthenticated visitors to obtain the usernames and email addresses of all users who registered using a specific, known invit...

EUVD-2026-91949

The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code...

PT-2026-104535

Name of the Vulnerable Software and Affected Versions The Pie Register WordPress plugin versions prior to 3.8.4.14 Description The plugin fails to restrict access to an invitation-code report. This allows unauthenticated visitors who possess a valid invitation code to retrieve the usernames and...

CVE-2026-96962: Exposure of Sensitive Information to an Unauthorized Actor

The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code...