CVE-2026-16570 NextScripts: Social Networks Auto-Poster < 4.4.8 - Reflected XSS via Facebook OAuth Callback

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are...

EUVD-2026-62270

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are...

CVE-2026-16570

The NextScripts: Social Networks Auto-Poster WordPress plugin, in versions before 4.4.8 , is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly escape certain query-string parameters reflected on one of its admin pages. Attackers can exploit this ...

EUVD-2026-62258

The Eventin WordPress plugin before 4.1.21 does not properly verify ownership of events before allowing them to be modified, deleted, or reassigned to a different author, allowing users with contributor-level access and above to alter, delete, or take over events created by other users including...

CVE-2026-23938

A flaw was found in Zabbix. An authenticated administrator can exploit this vulnerability by creating specially crafted JavaScript scripts within preprocessing or script items. This can lead to a denial of service DoS by crashing the Zabbix server or proxy. Mitigation Restrict administrative acce...

CVE-2026-70408

An incorrect authorization vulnerability exists in acmailer, which may allow a user to create a sub-account that has administrative privileges...

EUVD-2026-62238

An incorrect authorization vulnerability exists in acmailer, which may allow a user to create a sub-account that has administrative privileges...

CVE-2026-76050

A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This impacts an unknown function of the file /admin/ajax.php?action=deletemenu. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been made...

CVE-2026-76049

A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=savemenu. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-76048

A flaw has been found in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/ajax.php?action=login. Executing a manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit h...

EUVD-2026-62227

A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=savemenu. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-76049

CVE-2026-76049 is a SQL injection in SourceCodester Simple Online Food Ordering System 1.0, triggered via the ID argument in /admin/ajax.php?action=save_menu, exploitable remotely with no authentication; CVSS 7.3 HIGH, exploit code maturity PoC, but no specific in-the-wild exploitation evidence i...

CVE-2026-76049: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=savemenu. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...

PT-2026-78264

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Online Food Ordering System version 1.0 Description A remote SQL injection flaw exists in the /admin/ajax.php?action=login endpoint. The issue occurs when the Username argument is manipulated, allowing an attacker to...

PT-2026-78266

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Online Food Ordering System version 1.0 Description Remote SQL injection is possible via the /admin/ajax.php?action=delete menu endpoint. The issue occurs when the ID argument is manipulated, allowing an attacker to execu...

PT-2026-78265

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Online Food Ordering System version 1.0 Description Remote SQL injection is possible through the manipulation of the ID argument in the '/admin/ajax.php?action=save menu' endpoint. SQL injection is a technique where an...

PT-2026-78390

phpMyFAQ versions 3.1.0 through 4.1.6 contain an authentication bypass vulnerability in AuthLdap::create. When LDAP authentication is enabled, after a successful LDAP bind the code calls User::setStatus'active' unconditionally, which overwrites the account status column of a pre-existing local...

PT-2026-78393

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.7 Description Insufficient enforcement of the CONFIGURATION EDIT permission on administrative API read endpoints allows any authenticated user to access sensitive administrative data. By utilizing a valid session...

PT-2026-78643

Etherpad is a real-time collaborative editor. From 2.1.0 until 3.1.0, Etherpad's src/node/handler/APIHandler.ts authorizes requests to /api/2/ in the authorization code OAuth path by using requiredClaims with the admin claim. This check requires only that the claim exists, while...

PT-2026-78768

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user with the "power" role can store malicious Search...