CVE-2026-76997 SourceCodester Simple Online Food Ordering System ajax.php save_category sql injection

A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. The affected element is an unknown function of the file /admin/ajax.php?action=savecategory. This manipulation of the argument ID causes sql injection. It is possible to initiate the attack remotely. The...

Microsoft Entra ID Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network...

CVE-2026-76990

A proof-of-concept exploit exists for CVE-2026-76990, a SQL injection in the ID argument of /delete.php in code-projects Simple Inventory System 1.0, exploitable remotely without authentication (CVSS 7.3 HIGH). No patch or workaround is mentioned in the provided documents.

EUVD-2026-63219

A low privileged remote attacker can hijack an active administrative session without needing to know the administrator password by extracting live plaintext session identifiers for authenticated users from downloadable error log archives...

PT-2026-79048

A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects the function add grade of the file /index.php. Performing a manipulation of the argument student id results in improper authorization. The attack can be initiated remotely...

PT-2026-79214

Name of the Vulnerable Software and Affected Versions Microsoft Entra ID affected versions not specified Description An issue exists in the cloud identity platform where the deserialization of untrusted data allows an unauthorized remote attacker to execute arbitrary code over the network. This...

VulnCheck KEV: CVE-2026-69836

Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network...

CVE-2026-53546

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the terminal WebSocket accepts a user-controlled hostConfig.id and src/backend/ssh/host-resolver.ts resolves that host without requiring ownership or explicit access. When...

CVE-2026-55482

Snipe-IT is an IT asset/license management system. Prior to 8.4.1, a non-superadmin can use app/Http/Controllers/Assets/BulkAssetsController.php update to submit companyid directly without Company::getIdForCurrentUser, allowing assets to be moved across company boundaries and breaking multi-tenan...

MINI-897R-HJP2-9722

Bulletin has no description...

MINI-27G5-2PW4-J2CQ

Bulletin has no description...

MINI-GMG6-F46W-2G33

Bulletin has no description...

CVE-2026-76216

Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete vict...

EUVD-2026-62457

Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete vict...

CVE-2026-76216 Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing

Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete vict...

MINI-G33P-575P-43VV

Bulletin has no description...

CVE-2026-73354

The WordPress SimplyRETS Real Estate IDX plugin (≤ 3.2.8) allows unauthenticated reflected/stored XSS due to insufficient input sanitization. CVSS 7.1 (HIGH) reflects network exposure requiring user interaction. No in-the-wild exploitation is reported. PatchStack notes a fix is available; upgrade...

EUVD-2026-62227

A vulnerability has been found in SourceCodester Simple Online Food Ordering System 1.0. This affects an unknown function of the file /admin/ajax.php?action=savemenu. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...

PT-2026-78266

A vulnerability was found in SourceCodester Simple Online Food Ordering System 1.0. This impacts an unknown function of the file /admin/ajax.php?action=delete menu. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been mad...

PT-2026-78398

Vikunja through 2.4.0 contains a principal-type confusion vulnerability where LinkSharing principals with id N are treated as user principals with users.id == N at three permission checks lacking type guards. Attackers with a link-share JWT can remove victims from teams, enumerate and delete vict...