CVE-2026-78115 SourceCodester Class and Exam Timetabling System User Account Update edit_user_account.php improper authorization

A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /admin/edituseraccount.php of the component User Account Update. Such manipulation of the argument id/username leads to improper authorization. The attack may be...

CVE-2026-78115

SourceCodester Class and Exam Timetabling System 1.0 is affected by an improper authorization vulnerability in the User Account Update component, specifically in the file /admin/edit_user_account.php. Manipulation of the id/username argument allows a remote, authenticated attacker to bypass autho...

PT-2026-79766

A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /admin/edit user account.php of the component User Account Update. Such manipulation of the argument id/username leads to improper authorization. The attack may be...

CVE-2026-61463

Shiori contains a privilege escalation vulnerability in the account update endpoint that allows authenticated users to modify the owner field without authorization checks. Attackers can escalate to administrator by submitting a crafted PATCH request with owner: true, then re-authenticate to obtai...

CVE-2026-61463 Shiori Authenticated Privilege Escalation via PATCH /api/v1/auth/account

Shiori contains a privilege escalation vulnerability in the account update endpoint that allows authenticated users to modify the owner field without authorization checks. Attackers can escalate to administrator by submitting a crafted PATCH request with owner: true, then re-authenticate to obtai...

CVE-2026-61463

CVE-2026-61463 : Shiori contains a privilege escalation in the account update endpoint. An authenticated user can modify the owner field without authorization checks by submitting a crafted PATCH request with owner: true, then re-authenticate to obtain an admin JWT token that grants full system a...

Real Apple notifications are being used to drive tech support scams

Scammers have found a way to abuse legitimate Apple account notification emails to trick targets into calling fake tech support numbers. According to a report from BleepingComputer, scammers create an Apple account and insert a phishing message into the personal information fields, then modify th...

PT-2025-49250

A vulnerability was identified in Himool ERP up to 2.2. Affected by this issue is the function update account of the file /api/admin/update account/ of the component AdminActionViewSet. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit is...

Red Hat 3scale API Management Platform 安全漏洞

Red Hat 3scale API Management Platform is an infrastructure platform for API management from Red Hat. It enables rapid API sharing, protection, distribution, control, and monetization. A security vulnerability exists in Red Hat 3scale API Management Platform that originates from unvalidated input...

EUVD-2016-9601

Malware in sbrugna...

EUVD-2017-5904

Malware in sbrugna...

EUVD-2002-1098

Malware in sbrugna...

EUVD-2025-31384

Malicious code in bioql PyPI...

EUVD-2022-6985

Malicious code in bioql PyPI...

E-Commerce Website admin_account_update.php file SQL injection vulnerability

E-Commerce Website is an e-commerce website. E-Commerce Website suffers from a SQL injection vulnerability that originates from the lack of validation of an externally entered SQL statement in the parameter userid in the file /pages/adminaccountupdate.php. An attacker can exploit this vulnerabili...

CVE-2025-11036

A vulnerability was identified in code-projects E-Commerce Website 1.0. This affects an unknown function of the file /pages/adminaccountupdate.php. Such manipulation of the argument userid leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be...

CVE-2025-11036

A vulnerability was identified in code-projects E-Commerce Website 1.0. This affects an unknown function of the file /pages/adminaccountupdate.php. Such manipulation of the argument userid leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be...

CVE-2025-11036

CVE-2025-11036 affects code-projects E-Commerce Website 1.0. The vulnerability is in the file /pages/admin_account_update.php where manipulation of the argument user_id enables SQL injection. Exploitation can be performed remotely and public PoCs exist. Root cause is lack of input validation for ...

Code-Projects E-Commerce Website SQL注入漏洞

E-Commerce Website is an e-commerce website. E-Commerce Website suffers from a SQL injection vulnerability that originates from the lack of validation of an externally entered SQL statement in the parameter userid in the file /pages/adminaccountupdate.php. An attacker can exploit this vulnerabili...

CVE-2024-9943

The MultiVendorX – The Ultimate WooCommerce Multivendor Marketplace Solution plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.4. This is due to missing or incorrect nonce validation on several functions in api/class-mvx-rest-controller.php...