CVE-2026-94048: Improper Privilege Management

A vulnerability was detected in CodeAstro QR Code Attendance Management System 1.0. This affects the function Save of the file app/Controllers/UserController.php. The manipulation of the argument roleid results in improper privilege management. The attack can be executed remotely. The exploit is...

CVE-2026-12188: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in Grit42 Grit up to 0.11.0. Affected by this issue is some unknown functionality of the file modules/core/backend/app/controllers/concerns/grit/core/gritentitycontroller.rb of the component GritEntityController. Performing a manipulation results in sql injection. The...

CVE-2026-8802: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This issue affects the function getPicThumb of the file app/Controllers/Items.php. The manipulation of the argument picfilename results in path traversal. The attack may be launched remotely. The patch is...

CVE-2025-10472: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability has been found in harry0703 MoneyPrinterTurbo up to 1.2.6. The impacted element is the function downloadvideo/streamvideo of the file app/controllers/v1/video.py of the component URL Handler. The manipulation of the argument filepath leads to path traversal. The attack can be...

CVE-2025-7896: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability has been found in harry0703 MoneyPrinterTurbo up to 1.2.6 and classified as critical. Affected by this vulnerability is the function downloadvideo/deletevideo of the file app/controllers/v1/video.py. The manipulation leads to path traversal. The attack can be launched remotely...

CVE-2017-20179

CVE-2017-20179 affects InSTEDD Pollit 2.3.1, specifically the TourController in app/controllers/tour_controller.rb. The issue is described as a critical vulnerability with remote attack potential and an unknown weakness resulting from manipulation. A fix exists in Pollit 2.3.2, with the patch ide...