CVE-2026-19998 code-projects Online Shopping System offersmail.php cross site scripting

A weakness has been identified in code-projects Online Shopping System 1.0. Impacted is an unknown function of the file offersmail.php. Executing a manipulation of the argument email can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to...

CVE-2026-19998

A weakness has been identified in code-projects Online Shopping System 1.0. Impacted is an unknown function of the file offersmail.php. Executing a manipulation of the argument email can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to...

GitLab - Account Takeover via Password Reset

An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to a...

CVE-2026-50771

Cross Site Scripting vulnerability in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions...

EUVD-2026-60355

Cross Site Scripting vulnerability in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions...

PT-2026-76647

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets CSS sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. This issue exists because of insufficient fixes for...

CVE-2026-50771

Cross Site Scripting vulnerability in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions...

CVE-2026-50771

A stored/reflected XSS vulnerability exists in Squirro Cognitive Search versions below 3.14.2, exploitable through the Email Notification, Create Evaluation Sets, and HTML Editor functions. No authentication is required, though user interaction is needed. CVSS 6.1 (MEDIUM) reflects low confidenti...

EUVD-2026-59809

A vulnerability was found in code-projects Online Shopping System 1.0. This impacts an unknown function of the file /login.php of the component Login. The manipulation of the argument email results in sql injection. The attack may be performed from remote. The exploit has been made public and cou...

CVE-2026-19919 code-projects Online Shopping System Login login.php sql injection

A vulnerability was found in code-projects Online Shopping System 1.0. This impacts an unknown function of the file /login.php of the component Login. The manipulation of the argument email results in sql injection. The attack may be performed from remote. The exploit has been made public and cou...

CVE-2026-19919

CVE-2026-19919 affects code-projects Online Shopping System 1.0, specifically the Login component’s login.php where manipulation of the email parameter causes SQL injection. At risk is remote exploitation with public exploits reported; CVSS scores (3.0/3.1/4.0/2.0) indicate high/medium severity v...

CVE-2026-19919

A vulnerability was found in code-projects Online Shopping System 1.0. This impacts an unknown function of the file /login.php of the component Login. The manipulation of the argument email results in sql injection. The attack may be performed from remote. The exploit has been made public and cou...

CVE-2026-15689

Dancer2::Plugin::Auth::Extensible versions through 0.713 for Perl allow password reset link poisoning via the request Host header in defaultemailpasswordreset and defaultwelcomesend. Both default emails emit a link of the form $base/login/$code, whose authority comes from the request Host header,...

CVE-2026-16142

CVE-2026-16142 concerns the TrueBooker WordPress plugin (versions up to 1.2.6). The vulnerability arises because the add_front_user_update() AJAX handler is registered for unauthenticated users and accepts an arbitrary truebooker_wp_user_id, passing it directly to wp_update_user() without authent...

EUVD-2026-59598

The TrueBooker plugin for WordPress is vulnerable to Account Takeover in all versions up to, and including, 1.2.6. This is due to the addfrontuserupdate AJAX handler being registered for unauthenticated users and accepting an arbitrary truebookerwpuserid value, which is passed directly to...

CVE-2026-15303 6Storage Rentals <= 2.27.0 - Unauthenticated Account Takeover via 'email' Parameter

The 6Storage Rentals plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.27.0. This is due to the sixstoragecreatewpuser AJAX handler being registered on wpajaxnoprivsixstoragecreatewpuser without any nonce, capability, credential, or ownership...

EUVD-2026-58839

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated...

CVE-2026-8840

The CVE-2026-8840 entry concerns the Booking calendar, Appointment Booking System plugin for WordPress, affected up to version 3.2.36. The vulnerability is an authorization bypass caused by inadequate verification of a user’s permission to perform actions, enabling unauthenticated attackers to ma...

CVE-2026-8840

The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated...

PT-2026-72149

Name of the Vulnerable Software and Affected Versions Booking calendar, Appointment Booking System versions prior to 3.2.37 Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can wri...