PT-2026-33232

Name of the Vulnerable Software and Affected Versions goshs versions 2.0.0-beta.4 through 2.0.0-beta.5 Description goshs contains a cross-site request forgery issue in its state-changing HTTP GET routes. An external attacker can cause an authenticated browser to trigger destructive actions becaus...

EUVD-2026-21912

Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/loadadmin.php...

CVE-2026-36874

Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/loadstudent.php...

basic-ftp FTP Client Arbitrary Command Execution

The vulnerability of the protectWhitespace function in the FTP-client library of the Node.js software platform’s basic-ftp library is related to the failure to take measures to neutralize CRLF sequences. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands...

Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability

Microsoft Visual Basic for Applications VBA contains an insecure library loading vulnerability that could allow for remote code execution...

CVE-2026-36873

Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/loadadmin.php...

CVE-2026-36872

Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/loadbook.php...

CVE-2026-26460: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

A HTML Injection vulnerability exists in the Dashboard module of Vtiger CRM 8.4.0. The application fails to properly neutralize user-supplied input in the tabid parameter of the DashBoardTab view getTabContents action, allowing an attacker to inject arbitrary HTML content into the dashboard...

PT-2026-32333

Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/load admin.php...

CVE-2026-36873: Improper Neutralization of Special Elements used in an SQL Command

Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/loadadmin.php...

CVE-2026-36873

The Sourcecodester Basic Library System v1.0 is vulnerable to an SQL Injection flaw located in the /librarysystem/load_admin.php file. The vulnerability arises from the improper neutralization of special elements used in an SQL command , which could allow an attacker to interfere with the queries...

CVE-2026-36872

Sourcecodester Basic Library System v1.0 is vulnerable to an SQL Injection vulnerability located in the /librarysystem/load_book.php file. The root cause is the improper neutralization of special elements used in an SQL command. Exploitation details and specific remediation steps are not provided...

CVE-2026-36874: Improper Neutralization of Special Elements used in an SQL Command

Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/loadstudent.php...

CVE-2026-36872

Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/loadbook.php...

SourceCodester Basic Library System Security Vulnerabilities

SourceCodester Basic Library System is an open-source library system developed by SourceCodester. Version 1.0 of the SourceCodester Basic Library System contains a security vulnerability, which stems from an SQL injection vulnerability in the /librarysystem/loadbook.php file...

CVE-2026-36872: Improper Neutralization of Special Elements used in an SQL Command

Sourcecodester Basic Library System v1.0 is vulnerable to SQL Injection in /librarysystem/loadbook.php...

Linux Distros Unpatched Vulnerability : CVE-2026-39983

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - basic-ftp is an FTP client for Node.js. Prior to 5.2.1, basic-ftp allows FTP command injection via CRLF sequences \r\n in file path parameters passed to...

PT-2026-33747

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds access occurs when parsing X.509 certificates containing empty Basic Constraints or Key Usage extensions. This happens because the first byte of the extension is read...

CVE-2026-39983

A flaw was found in basic-ftp, an FTP client for Node.js. A remote attacker can exploit this vulnerability by injecting Carriage Return Line Feed CRLF sequences into file path parameters used by high-level APIs. This allows the attacker to split a single intended FTP command into multiple command...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization via the CloudSpec method on the Controller facade. An attacker can obtain sensitive cloud credentials by making an authenticated API call with only basic login permissions, without requiring elevated privileges...