EUVD-2026-72753

XenForo before 2.3.13 contains a payment replay vulnerability in the PayPal REST payment provider that allows attackers to process the same webhook payload multiple times by exploiting a missing duplicate transaction ID check. Attackers can replay a valid webhook payload to trigger duplicate...

CVE-2026-62645

A vulnerability has been identified in Reyrolle 7SR5 All versions V2.70. Information is exposed through the web interface that can be used to calculate the current and past session ID numbers. This could allow an attacker to bypass the authentication and gain unauthorized access to the device...

CVE-2026-62645

A vulnerability in Reyrolle 7SR5 (all versions prior to V2.70 ) exposes information through the web interface that allows an attacker to calculate current and past session ID numbers . This enables authentication bypass and unauthorized access to the device. The vulnerability is rated CVSS 3.1: 9...

CVE-2026-86518

A vulnerability has been found in code-projects Student Crud Operation 1.0. This affects an unknown function of the file /edit.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used...

EUVD-2026-72641

A vulnerability has been found in code-projects Student Crud Operation 1.0. This affects an unknown function of the file /edit.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used...

CVE-2026-86518 code-projects Student Crud Operation edit.php sql injection

A vulnerability has been found in code-projects Student Crud Operation 1.0. This affects an unknown function of the file /edit.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used...

CVE-2026-86518

A time-based blind SQL injection vulnerability exists in the code-projects Student Crud Operation 1.0 application, specifically in the /edit.php file via the id parameter. The vulnerability is remotely exploitable with low privileges required (authenticated user) and no user interaction needed. P...

CVE-2026-86517 itsourcecode Sales and Inventory System us_searchfrm.php mysqli_query sql injection

A flaw has been found in itsourcecode Sales and Inventory System 1.0. The impacted element is the function mysqliquery of the file /pages/ussearchfrm.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-86517

A SQL injection vulnerability exists in itsourcecode Sales and Inventory System version 1.0 , specifically in the mysqli_query function within /pages/us_searchfrm.php. Manipulating the ID parameter allows a remote, authenticated attacker to inject arbitrary SQL, resulting in low impact to confide...

KLA91263 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation of...

CVE-2026-82753

Allocation of Resources Without Limits or Throttling vulnerability in ash-project ashauthenticationoauth2server allows an unauthenticated attacker to exhaust database storage and memory. The /authorize endpoint is unauthenticated by design. With Client ID Metadata Documents enabled, resolveclient...

CVE-2026-81638

ash_double_entry (Elixir library by ash-project) contains an Improper Handling of Alternate Encoding vulnerability in its ULID type. Although a 128-bit ULID is rendered as 26 Crockford base-32 characters, the first character encodes only 3 bits (canonical values 0–7). The decode/1 function masks ...

CVE-2026-81638 Non-canonical ULID spellings are accepted and alias to the same record in ash_double_entry

Improper Handling of Alternate Encoding vulnerability in ash-project ashdoubleentry allows an attacker to submit several distinct string spellings of the same identifier. AshDoubleEntry.ULID renders a 128-bit ULID as 26 Crockford base-32 characters, but the first character encodes only 3 bits, so...

CVE-2021-42670

CVE-2021-42670 CVE-2021-42670 - Vulnerabilidad de SQL Injection en el sistema de portal en línea de Engineers. Descripción técnica: Existe una vulnerabilidad de SQL Injection en el Portal en línea de Engineers. Un atacante puede aprovechar el parámetro vulnerable "id" en la página web...

gitlab-cve-2020-10977

GitLab CVE2020-10977 Introducción Este script proporciona ejecución remota de código contra GitLab Community Edition CE y Enterprise Edition EE. El CVE es una lectura arbitraria de archivos que te permite extraer el secretkeybase de Rails descargando el archivo secrets.yaml de GitLab. Esto, a su...

CVE-2026-86310 itsourcecode Sales and Inventory System cust_edit1.php sql injection

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/custedit1.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the publ...

EUVD-2026-72450

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/custedit1.php. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the publ...

CVE-2026-86310

itsourcecode Sales and Inventory System 1.0 contains a SQL injection vulnerability in the file /pages/cust_edit1.php , triggered by manipulating the ID argument. The attack can be launched remotely with low privileges and no user interaction. A proof-of-concept exploit has been disclosed to the p...

CVE-2023-2986

Prueba de Concepto Original para CVE-2023-2986 Prueba de Concepto para la vulnerabilidad CVE-2023-2986 en el plugin 'Abandoned Cart Lite for WooCommerce' de WordPress Detalles Relacionados Enlace NVD : https://nvd.nist.gov/vuln/detail/CVE-2023-2986 Fuente del Plugin :...

CVE-2026-86309 itsourcecode Sales and Inventory System pro_searchfrm.php sql injection

A flaw has been found in itsourcecode Sales and Inventory System 1.0. Impacted is an unknown function of the file /pages/prosearchfrm.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used...