CVE-2025-52182

The Library Corporation LS2 Admin v5.7 to v5.8.0 was discovered to contain an information disclosure vulnerability...

PT-2026-79152

Name of the Vulnerable Software and Affected Versions The Library Corporation LS2 Admin versions 5.7 through 5.8.0 Description The software contains an information disclosure issue that could allow unauthorized access to sensitive data. Recommendations At the moment, there is no information about...

CVE-2025-52182

The Library Corporation LS2 Admin v5.7 to v5.8.0 was discovered to contain an information disclosure vulnerability...

PT-2026-80253

Summary HasUploadFields used via CrudTrait on Backpack-managed models and the withFiles uploader preserve the client-supplied file extension without validation. On installations using a public disk with php artisan storage:link, this allows an authenticated administrator to upload a file with a...

PT-2026-79016

ATutor is vulnerable to Server-Side request forgery in import functionalities. An authenticated administrator can make the server request arbitrary internal HTTP endpoints, cloud metadata services, or local files via file:// if the PHP environment permits URL wrappers. Product is no longer active...

CVE-2025-52182: Missing Authentication for Critical Function

The Library Corporation LS2 Admin v5.7 to v5.8.0 was discovered to contain an information disclosure vulnerability...

CVE-2026-19615: Improper Neutralization of Input During Web Page Generation

The Admin and Site Enhancements ASE WordPress plugin before 9.0.1 does not sanitise uploaded SVG files on every route it accepts them through, allowing users with a role the site owner granted upload access to store a file containing JavaScript which then executes in the browser of anyone who ope...

CVE-2026-49217: Missing Authentication for Critical Function

Mailu is a mail server as a set of Docker images. Prior to version 2024.06.52, a missing authorization check in the Mailu admin REST API allows any unauthenticated attacker to remove any potential IP restriction or update the comment field from any existing user token provided the REST API is...

CVE-2026-54623: Uncontrolled Recursion

django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, the moveplugin endpoint in cms/admin/placeholderadmin.py accepts an attacker-controlled pluginparent value without rejecting a plugin’s own identifier or a descendant...

PT-2026-78899

Name of the Vulnerable Software and Affected Versions vsDesk versions prior to 14.0101 Description An OS command injection flaw exists due to insufficient input filtering. This allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands, which...

PT-2026-79037

A vulnerability was identified in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /admin/ajax.php?action=save menu. The manipulation of the argument img leads to unrestricted upload. The attack is possible to be carried out remotely. T...

CVE-2026-77648: Server-Side Request Forgery (SSRF)

In OpenStack Glance through 32.0.0, the /v2/tasks API accepts type=import tasks that bypass importfilteringopts, allowing an admin to fetch internal URLs from the Glance service network aka SSRF, as long as https:// or http:// is used. This API has been available only to admins since Xena, and it...

CVE-2026-76997: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=savecategory. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The...

CVE-2026-76764: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in code-projects Employee Management System 1.0. The impacted element is an unknown function of the file /process/aprocess.php of the component Admin Login Endpoint. This manipulation of the argument mailuid causes sql injection. Remote exploitation of the attack is possible...

PT-2026-80213

Impact The internal Pages admin API incorrectly returns page fields without access control when they are declared in api fields. A user with access to the Wagtail admin can use this API to fetch draft and live page fields’ contents that are part of api fields on the base page model title, slug, s...

PT-2026-78891

Name of the Vulnerable Software and Affected Versions Admin and Site Enhancements versions prior to 9.0.1 Description Insufficient sanitization of uploaded SVG files across certain routes allows users with upload permissions to store files containing malicious JavaScript. This leads to a stored...

PT-2026-78901

Joomla Extension - phoca.cz - Stored XSS via User-Agent header in Admin Order View in Phoca Cart 5.0.0-6.1.7...

Mattermost Server 11.7.x < 11.7.7 / 11.8.x < 11.8.4 Incorrect Authorization (MMSA-2026-00718)

The version of Mattermost Server installed on the remote host is affected by a vulnerability as referenced in the MMSA-2026-00718 advisory. - Mattermost versions 11.7.x = 11.7.6, 11.8.x = 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belong...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the BrokerNotAliveException message when the RabbitMQ management aliveness check fails. An attacker can obtain sensitive credentials by accessing exception messages that are logged,...

PT-2026-78873

Name of the Vulnerable Software and Affected Versions code-projects Employee Management System version 1.0 Description A SQL injection flaw exists in the Admin Login Endpoint within the /process/aprocess.php file. The issue occurs when the mailuid argument is manipulated, allowing for remote...