CVE-2026-82412: Improper Neutralization of Special Elements used in an OS Command

ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, the vulnerability-scan endpoints scripts/lua/rest/v2/add/host/toscan.lua and scripts/lua/rest/v2/exec/host/schedulevulnerabilityscan.lua accept the scanports parameter without an administrator gate and pass it...

CVE-2026-93977

A vulnerability was determined in code-projects Assessment Management 1.0. Affected by this vulnerability is an unknown functionality of the file lecturer/add-single-mark.php. This manipulation of the argument mark causes cross site scripting. Remote exploitation of the attack is possible. The...

CVE-2026-93976

A vulnerability was found in code-projects Assessment Management 1.0. Affected is an unknown function of the file admin/add-user.php. The manipulation of the argument level results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used...

CVE-2026-93977 code-projects Assessment Management add-single-mark.php cross site scripting

A vulnerability was determined in code-projects Assessment Management 1.0. Affected by this vulnerability is an unknown functionality of the file lecturer/add-single-mark.php. This manipulation of the argument mark causes cross site scripting. Remote exploitation of the attack is possible. The...

CVE-2026-93977 code-projects Assessment Management add-single-mark.php cross site scripting

A vulnerability was determined in code-projects Assessment Management 1.0. Affected by this vulnerability is an unknown functionality of the file lecturer/add-single-mark.php. This manipulation of the argument mark causes cross site scripting. Remote exploitation of the attack is possible. The...

CVE-2026-93977

code-projects Assessment Management 1.0 is affected by a cross-site scripting (XSS) vulnerability in the file lecturer/add-single-mark.php . Manipulating the mark parameter allows an attacker to inject script into the application. Remote exploitation is possible, requiring low privileges and user...

EUVD-2026-83720

A vulnerability was determined in code-projects Assessment Management 1.0. Affected by this vulnerability is an unknown functionality of the file lecturer/add-single-mark.php. This manipulation of the argument mark causes cross site scripting. Remote exploitation of the attack is possible. The...

EUVD-2026-83719

A vulnerability was found in code-projects Assessment Management 1.0. Affected is an unknown function of the file admin/add-user.php. The manipulation of the argument level results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used...

CVE-2026-93976

CVE-2026-93976 is a cross-site scripting (XSS) vulnerability in code-projects Assessment Management 1.0 , located in the file admin/add-user.php . Manipulation of the level argument leads to XSS, and the attack can be launched remotely. Exploitation requires high privileges and user interaction ,...

CVE-2026-93976 code-projects Assessment Management add-user.php cross site scripting

A vulnerability was found in code-projects Assessment Management 1.0. Affected is an unknown function of the file admin/add-user.php. The manipulation of the argument level results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used...

CVE-2026-93976 code-projects Assessment Management add-user.php cross site scripting

A vulnerability was found in code-projects Assessment Management 1.0. Affected is an unknown function of the file admin/add-user.php. The manipulation of the argument level results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used...

CVE-2026-93976: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in code-projects Assessment Management 1.0. Affected is an unknown function of the file admin/add-user.php. The manipulation of the argument level results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used...

CVE-2026-93977: Improper Neutralization of Input During Web Page Generation

A vulnerability was determined in code-projects Assessment Management 1.0. Affected by this vulnerability is an unknown functionality of the file lecturer/add-single-mark.php. This manipulation of the argument mark causes cross site scripting. Remote exploitation of the attack is possible. The...

PT-2026-95949

Name of the Vulnerable Software and Affected Versions code-projects Assessment Management version 1.0 Description Cross site scripting occurs in the file admin/add-user.php due to the manipulation of the level argument. This issue allows a remote attack to be launched. Recommendations Avoid using...

PT-2026-95966

Name of the Vulnerable Software and Affected Versions SourceCodester Drug Recommendation System version 1.0 Description A security flaw allows remote exploitation via cross site scripting XSS, a technique where malicious scripts are injected into trusted websites. The issue exists in the file /dr...

PT-2026-95950

Name of the Vulnerable Software and Affected Versions code-projects Assessment Management version 1.0 Description An issue exists in the lecturer/add-single-mark.php file where manipulation of the mark variable allows for cross-site scripting XSS, a technique used to inject malicious scripts into...

PT-2026-95997

Name of the Vulnerable Software and Affected Versions AdithyaYelloju Restaurant Management System versions up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c Description Remote SQL injection is possible through the manipulation of the table/members/price argument. This issue occurs within the mysqli...

PT-2026-95983

Name of the Vulnerable Software and Affected Versions AdithyaYelloju Restaurant-Management-System versions up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c Description Remote SQL injection is possible through the manipulation of the item, price, image, or type arguments within the 'admin/add...

PT-2026-95847

An unauthenticated attacker can inject arbitrary fake log lines into Apache ZooKeeper's operational log by sending a crafted add auth"ensemble", ... request containing newline characters . When the ensemble name doesn't match, EnsembleAuthenticationProvider.handleAuthentication logs the raw,...

CVE-2026-76900 CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. In version 1.7.3, ApprovalResourceService.sendWebHook reads WebHookConfig.webHookUrl from stored approval-node configuration and passes it through...