EUVD-2026-64828

A vulnerability has been found in itsourcecode Online Clinic Management System 1.0. This vulnerability affects unknown code of the file success/login.php of the component Admin Login. The manipulation of the argument Username leads to sql injection. Remote exploitation of the attack is possible...

CVE-2026-78246 itsourcecode Online Clinic Management System Admin Login login.php sql injection

A vulnerability has been found in itsourcecode Online Clinic Management System 1.0. This vulnerability affects unknown code of the file success/login.php of the component Admin Login. The manipulation of the argument Username leads to sql injection. Remote exploitation of the attack is possible...

CVE-2026-78246

A SQL injection vulnerability exists in itsourcecode Online Clinic Management System 1.0 , specifically in the Admin Login component (file success/login.php). The root cause is the unsanitized handling of the Username argument, allowing an unauthenticated remote attacker to inject arbitrary SQL. ...

EUVD-2026-64827

Firmware in KAON PG5298A and PG5298B routers allow an unauthenticated user to query a specific endpoint and acquire sensitive information such as a password to the administrative portal. This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B...

CVE-2026-6017 Missing Authentication for Critical Function in KAON PG5298

Firmware in KAON PG5298A and PG5298B routers allow an unauthenticated user to query a specific endpoint and acquire sensitive information such as a password to the administrative portal. This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B...

CVE-2026-6017 Missing Authentication for Critical Function in KAON PG5298

Firmware in KAON PG5298A and PG5298B routers allow an unauthenticated user to query a specific endpoint and acquire sensitive information such as a password to the administrative portal. This vulnerability has been fixed in firmware version: 3.0.82 for PG5298A and 4.0.82 for PG5298B...

WordPress AI Engine plugin 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP User Tools vulnerability

WordPress AI Engine plugin 2.8.0 - 3.6.0 - Admin+ Multisite Network Administrator Account Takeover via MCP User Tools vulnerability discovered by Charles Vosburgh in WordPress Plugin AI Engine versions = 3.6.0...

WordPress Drag and Drop Multiple File Upload for Contact Form 7 plugin < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag Setting vulnerability

Admin+ Stored XSS via dragndropheadingtag Setting vulnerability discovered by Sai Praneeth Koti in WordPress Plugin Drag and Drop Multiple File Upload – Contact Form 7 versions 1.3.9.9...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: Wifi: nl80211: Fixed an integer overflow in nl80211ParseMBSSIDElems. The nl80211ParseMBSSIDElems function uses a u8 variable numElems to count the number of MBSSID elements in the nested netlink attribute attrs. This can lead to ...

Malicious Package

Overview sm-admin is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

PT-2026-79831

Name of the Vulnerable Software and Affected Versions itsourcecode Payroll System version 1.0 Description An unrestricted file upload issue exists in the save settings function within the admin class.php file. A remote attacker can exploit this by manipulating the img argument to upload arbitrary...

PT-2026-80808

Name of the Vulnerable Software and Affected Versions itsourcecode Online Clinic Management System version 1.0 Description An issue in the Admin Login component allows remote exploitation via SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. T...

PT-2026-80894

RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint. The endpoint requires an authenticated session but does not perform an explicit privilege or administrator authorization check before allowing access to...

EUVD-2026-64900

A local privilege escalation vulnerability exists in the Restricted Access Kiosk Mode implementation of Scheidt & Bachmann entervo HMI prior to V2 R5 P0 M5. The vulnerability affects the external PDF viewer functionality used to display the application manual and its interaction with the underlyi...

PT-2026-80881

Name of the Vulnerable Software and Affected Versions Scheidt & Bachmann entervo HMI versions prior to V2 R5 P0 M5 Description A local privilege escalation issue exists in the Restricted Access Kiosk Mode implementation. An authenticated low-privileged user can escape the kiosk environment by...

PT-2026-79830

A vulnerability has been found in itsourcecode Payroll System 1.0. The impacted element is the function Login of the file admin class.php. The manipulation of the argument Username leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed to the...

PT-2026-80938

Multiple DrayTek VigorAP models contain a command injection vulnerability in the tr069TestInform function. The vulnerability is caused by insufficient filtering of dangerous characters before the event code field is concatenated into a system command. A remote attacker can trigger this...

CVE-2026-55468: Improper Handling of Insufficient Permissions or Privileges

Wagtail is an open source content management system built on Django. Prior to versions 7.0.9, 7.3.4, 7.4.3, and 8.0rc2 on their respective release lines, the internal Pages admin API returns page fields declared in apifields without sufficient access control, allowing a user with Wagtail admin...

CVE-2026-78369: Missing Authentication for Critical Function

RansomLook contains a missing authentication vulnerability in the /admin/crypto/group/new endpoint. While the endpoint provides an administrative function for creating new crypto group entries, it was not protected by the application's authentication mechanism. An unauthenticated remote attacker...

PT-2026-81015

Name of the Vulnerable Software and Affected Versions RansomLook affected versions not specified Description The authenticated /admin/apikeys administration page exposes complete API keys within the HTML source. While the user interface shows only a shortened version of the key, the full token is...