208 matches found
CVE-2026-45145
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, public/main/inc/lib/career.lib.php and public/main/cron/importcsv.php call PHP's native unserialize on usercareer.extradata retrieved from the database without the allowedclasses: false safety option. An attacker able to...
CVE-2026-45145
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, "public/main/inc/lib/career.lib.php" and "public/main/cron/importcsv.php" call PHP's native "unserialize" on "usercareer.extradata" retrieved from the database without the "allowedclasses: false" safety option. An attacker...
CVE-2026-45145 Chamilo LMS: Database-backed PHP object injection in career deserialization
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, public/main/inc/lib/career.lib.php and public/main/cron/importcsv.php call PHP's native unserialize on usercareer.extradata retrieved from the database without the allowedclasses: false safety option. An attacker able to...
PT-2026-133606
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, public/main/inc/lib/career.lib.php and public/main/cron/import csv.php call PHP's native unserialize on user career.extra data retrieved from the database without the allowed classes: false safety option. An attacker able t...
CVE-2026-45145: chamilo chamilo-lms: Chamilo LMS is an open-source learning management system
Chamilo LMS is an open-source learning management system. Prior to 2.0.1, public/main/inc/lib/career.lib.php and public/main/cron/importcsv.php call PHP's native unserialize on usercareer.extradata retrieved from the database without the allowedclasses: false safety option. An attacker able to...
EUVD-2026-104013
A vulnerability has been found in diem-project diem up to 5.1.3. This affects an unknown part of the file lib/model/doctrine/PluginDmUser.class.php of the component SHA1 Handler. Such manipulation of the argument salt/password leads to password hash with insufficient computational effort. The...
CVE-2026-112029
A vulnerability has been found in diem-project diem up to 5.1.3. This affects an unknown part of the file lib/model/doctrine/PluginDmUser.class.php of the component SHA1 Handler. Such manipulation of the argument salt/password leads to password hash with insufficient computational effort. The...
CVE-2026-112029 diem-project diem SHA1 PluginDmUser.class.php weak password hash
A vulnerability has been found in diem-project diem up to 5.1.3. This affects an unknown part of the file lib/model/doctrine/PluginDmUser.class.php of the component SHA1 Handler. Such manipulation of the argument salt/password leads to password hash with insufficient computational effort. The...
CVE-2026-112029
A vulnerability has been found in diem-project diem up to 5.1.3. This affects an unknown part of the file lib/model/doctrine/PluginDmUser.class.php of the component SHA1 Handler. Such manipulation of the argument salt/password leads to password hash with insufficient computational effort. The...
CVE-2026-112029 diem-project diem SHA1 PluginDmUser.class.php weak password hash
A vulnerability has been found in diem-project diem up to 5.1.3. This affects an unknown part of the file lib/model/doctrine/PluginDmUser.class.php of the component SHA1 Handler. Such manipulation of the argument salt/password leads to password hash with insufficient computational effort. The...
CVE-2026-112029 diem-project diem SHA1 PluginDmUser.class.php weak password hash
A vulnerability has been found in diem-project diem up to 5.1.3. This affects an unknown part of the file lib/model/doctrine/PluginDmUser.class.php of the component SHA1 Handler. Such manipulation of the argument salt/password leads to password hash with insufficient computational effort. The...
CVE-2026-112029
A vulnerability exists in diem-project diem versions up to 5.1.3 within the SHA1 Handler component, specifically affecting a part of the file lib/model/doctrine/PluginDmUser.class.php. The root cause involves the manipulation of the salt/password argument, resulting in a password hash with insuff...
CVE-2026-112029: Use of Password Hash With Insufficient Computational Effort
A vulnerability has been found in diem-project diem up to 5.1.3. This affects an unknown part of the file lib/model/doctrine/PluginDmUser.class.php of the component SHA1 Handler. Such manipulation of the argument salt/password leads to password hash with insufficient computational effort. The...
PT-2026-117163
A vulnerability has been found in diem-project diem up to 5.1.3. This affects an unknown part of the file lib/model/doctrine/PluginDmUser.class.php of the component SHA1 Handler. Such manipulation of the argument salt/password leads to password hash with insufficient computational effort. The...
Diem project Diem encryption issue vulnerabilities
The Diem project versions 5.1.3 and earlier have a security vulnerability related to encryption. This vulnerability stems from improper handling of the parameter ‘salt/password’ in the SHA1 Handler component’s file ‘lib/model/doctrine/PluginDmUser.class.php’. As a result, the strength of password...
CLSA-2026-1777509602 TuxCare security update for doctrine/orm (1 CVE)
TuxCare rebuilt doctrine/orm to address 1 CVE. Fixed in 2.8.3-p1+tuxcare...
PT-2026-74649
TuxCare rebuilt doctrine/orm to address 1 CVE. Fixed in 2.8.3-p1+tuxcare...
CVE-2026-18737
Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL fragments by supplying an unvalidated direction value in the orderBy query parameter of the tag statistics endpoint. Attackers can craft a malicious direction string containing...
CVE-2026-18737: Improper Neutralization of Special Elements used in an SQL Command
Shlink contains a blind SQL injection vulnerability that allows any authenticated API key holder to inject arbitrary SQL fragments by supplying an unvalidated direction value in the orderBy query parameter of the tag statistics endpoint. Attackers can craft a malicious direction string containing...
CVE-2026-49211
Symfony UX is a JavaScript ecosystem for Symfony. From 2.2.0 until 2.36.0 and 3.1.0, Symfony\UX\Autocomplete\Doctrine\EntitySearchUtil::addSearchClause builds the LIKE expression used by the autocomplete endpoint by wrapping the client-supplied query in %...% without escaping SQL LIKE wildcards %...