CVE-2026-86160

SourceCodester Online Voting System 1.0 is vulnerable to SQL injection via the ID argument in /ajax.php?action=delete_voting. The attack is exploitable remotely without authentication . The exploit has been disclosed publicly with proof-of-concept maturity, as indicated by VulDB and a linked GitH...

EUVD-2026-72039

A flaw has been found in SourceCodester Online Voting System 1.0. Impacted is an unknown function of the file /ajax.php?action=saveuser. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used...

CVE-2026-86159

SourceCodester Online Voting System 1.0 is affected by a SQL injection vulnerability in the file /ajax.php?action=save_user , triggered by manipulation of the ID argument. The attack can be initiated remotely with no privileges and no user interaction required. The CVSS 3.1 score is 7.3 (HIGH) wi...

CVE-2026-86159 SourceCodester Online Voting System ajax.php save_user sql injection

A flaw has been found in SourceCodester Online Voting System 1.0. Impacted is an unknown function of the file /ajax.php?action=saveuser. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used...

PT-2026-86467

A vulnerability has been found in SourceCodester Online Voting System 1.0. The affected element is an unknown function of the file /ajax.php?action=delete voting. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to th...

PT-2026-86508

A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0. Affected is an unknown function of the file /delete user.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public...

PT-2026-86487

A security vulnerability has been detected in DefaultFuction CRM 1.0.0. This affects an unknown function of the file /modules/orders/delete.php. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be...

PT-2026-86477

A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/trans view.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been released to the public...

PT-2026-86474

A vulnerability was found in SourceCodester Online Voting System 1.0. The impacted element is an unknown function of the file /ajax.php?action=delete category. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has bee...

PT-2026-86503

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This impacts an unknown function of the file /delete teacher.php. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit has been released to the...

PT-2026-86480

A weakness has been identified in DefaultFuction CRM 1.0.0. The impacted element is an unknown function of the file /modules/orders/edit.php. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the...

PT-2026-86579

A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. Affected by this issue is some unknown functionality of the file /pages/us del.php?type=user. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The...

PT-2026-86509

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. Affected by this vulnerability is an unknown functionality of the file /delete user account.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. Th...

PT-2026-86578

Name of the Vulnerable Software and Affected Versions itsourcecode Sales and Inventory System version 1.0 Description A remote SQL injection is possible due to improper handling of the ID variable in the '/pages/sup del.php?type=supplier' endpoint. SQL injection is a technique where an attacker...

CVE-2026-16310: Authorization Bypass Through User-Controlled Key

The MemberDash plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.8.5 via the 'id' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to change the password of any WordPress...

PT-2026-86488

A vulnerability was detected in DefaultFuction CRM 1.0.0. This impacts an unknown function of the file /modules/customers/delete.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used...

CVE-2026-75586 Unlimited Elements For Elementor <= 2.0.17 - Reflected Cross-Site Scripting via 'formData[id]' Parameter

The Unlimited Elements For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'formDataid' Parameter in all versions up to, and including, 2.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-52774: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using striptags only. Because striptags does not escape double quotes, an attacker can break out of the attribute value, inject an event handler such ...

CVE-2026-85638

A weakness has been identified in jofpin trape 2.0. This affects an unknown part of the file core/user.py. This manipulation of the argument vId/id causes authorization bypass. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for...

CVE-2026-85512

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /admin/session.php. The manipulation of the argument ID results in missing authorization. The attack can be executed remotely. The exploit has been...