CVE-2026-5699

Stored Cross-Site Scripting XSS vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed in the victim's browser. The list of assigned parameters and identifiers is as follows: parameter 'companyName' in...

EUVD-2026-112741

Stored Cross-Site Scripting XSS vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed in the victim's browser. The list of assigned parameters and identifiers is as follows: parameter 'companyName' in...

CVE-2026-5699 Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application

Stored Cross-Site Scripting XSS vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed in the victim's browser. The list of assigned parameters and identifiers is as follows: parameter 'companyName' in...

CVE-2026-5699

The SABBATIC application contains a Stored Cross-Site Scripting (XSS) vulnerability (CWE-79). An attacker can store malicious JavaScript code via the 'companyName' parameter in the /empresa endpoint. When a victim views the affected page, the stored script executes within their browser. The vulne...

CVE-2026-5699 Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application

Stored Cross-Site Scripting XSS vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed in the victim's browser. The list of assigned parameters and identifiers is as follows: parameter 'companyName' in...

CVE-2026-5699: SABBATIC SABBATIC app: Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript…

Stored Cross-Site Scripting XSS vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed in the victim's browser. The list of assigned parameters and identifiers is as follows: parameter 'companyName' in...

SABBATIC app cross-site scripting vulnerability

Versions prior to 7.96.0.1 and 7.96.0.2 of the SABBATIC app contain a cross-site scripting vulnerability. This vulnerability stems from improper handling of the companyName parameter in the /empresa endpoint, potentially enabling stored cross-site scripting attacks. Attackers can store JavaScript...

PT-2026-132094

Stored Cross-Site Scripting XSS vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed in the victim's browser. The list of assigned parameters and identifiers is as follows: parameter 'companyName' in...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37989)

Sales and Inventory System is a business resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability, which stems from the improper validation of the companyname parameter in the /pages/suptransac.php file...

CVE-2026-86245

A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/suptransac.php. Performing a manipulation of the argument companyname results in sql injection. It is possible to initiate the attack remotely...

EUVD-2026-72192

A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/suptransac.php. Performing a manipulation of the argument companyname results in sql injection. It is possible to initiate the attack remotely...

CVE-2026-86245

itsourcecode Sales and Inventory System 1.0 contains a SQL injection vulnerability in the file /pages/sup_transac.php, triggered by manipulating the companyname argument. The attack can be initiated remotely and requires low privileges (an authenticated user) but no user interaction. Impact is ra...

CVE-2026-86245 itsourcecode Sales and Inventory System sup_transac.php sql injection

A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/suptransac.php. Performing a manipulation of the argument companyname results in sql injection. It is possible to initiate the attack remotely...

CVE-2026-86245 itsourcecode Sales and Inventory System sup_transac.php sql injection

A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/suptransac.php. Performing a manipulation of the argument companyname results in sql injection. It is possible to initiate the attack remotely...

PT-2026-86614

Name of the Vulnerable Software and Affected Versions itsourcecode Sales and Inventory System version 1.0 Description A SQL injection flaw exists in the /pages/sup transac.php endpoint. This issue occurs when the companyname argument is manipulated, allowing a remote attacker to execute arbitrary...

CVE-2026-86245: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file /pages/suptransac.php. Performing a manipulation of the argument companyname results in sql injection. It is possible to initiate the attack remotely...

CVE-2026-75955 Joomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory < 6.2.3

Joomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory 6.2.3 - companyName from the request was written unescaped into an XML attribute...

CVE-2026-75955: Improper Neutralization of Input During Web Page Generation

Joomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory 6.2.3 - companyName from the request was written unescaped into an XML attribute...

CVE-2026-22674

Hashgraph Guardian through 3.6.0, fixed in commit ba8c566, contains a stored cross-site scripting vulnerability that allows authenticated users with the STANDARDREGISTRY role to inject malicious scripts by submitting a crafted companyName value via the branding configuration API endpoint. Attacke...

CVE-2026-22674: Improper Neutralization of Input During Web Page Generation

Hashgraph Guardian through 3.6.0, fixed in commit ba8c566, contains a stored cross-site scripting vulnerability that allows authenticated users with the STANDARDREGISTRY role to inject malicious scripts by submitting a crafted companyName value via the branding configuration API endpoint. Attacke...