PT-2026-79048

A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects the function add grade of the file /index.php. Performing a manipulation of the argument student id results in improper authorization. The attack can be initiated remotely...

EUVD-2026-61020

MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the configuration file, resulting in PHP code injection and remote code execution when the installer is available...

CVE-2026-75778

A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::selectwithmultiplecondition of the file /index.php of the component Login Form. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack...

GHSA-2RHW-8953-48Q3 Duplicate Advisory: Grav: Unauthenticated Path Traversal via Missing Directory-Boundary Check in `plugin-asset-map.php` Static Asset Server (`index.php`)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-4v9q-p283-qc2m. This link is maintained to preserve external references. Original Description Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses stri...

CVE-2026-74907

Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base pa...

EUVD-2026-60732

A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::selectwithmultiplecondition of the file /index.php of the component Login Form. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack...

CVE-2026-75778 code-projects Task Management System Login Form index.php select_with_multiple_condition sql injection

A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::selectwithmultiplecondition of the file /index.php of the component Login Form. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack...

CVE-2026-74907

Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base pa...

CVE-2026-74907 Grav before 2.0.15 Path Traversal via plugin-asset-map.php

Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base pa...

CVE-2026-74907 Grav before 2.0.15 Path Traversal via plugin-asset-map.php

Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base pa...

CVE-2026-74907: Improper Limitation of a Pathname to a Restricted Directory

Grav before 2.0.15 contains a path traversal vulnerability in the static asset server within index.php that uses string prefix matching instead of directory-boundary validation. Unauthenticated attackers can access files in sibling directories by exploiting directory names that extend the base pa...

PT-2026-76922

Name of the Vulnerable Software and Affected Versions Grav versions prior to 2.0.15 Description A path traversal issue exists in the static asset server within the index.php file. The system employs string prefix matching rather than directory-boundary validation, allowing unauthenticated attacke...

CVE-2026-45117: Improper Control of Generation of Code

MyBB is free and open source forum software. From 1.8.13 until 1.8.40, the installer module does not properly escape user-supplied database configuration values written to the configuration file, resulting in PHP code injection and remote code execution when the installer is available...

PT-2026-76965

A vulnerability was identified in code-projects Task Management System 1.0. This affects the function Operation::select with multiple condition of the file /index.php of the component Login Form. Such manipulation of the argument email leads to sql injection. It is possible to launch the attack...

CVE-2026-19904

A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=sitesettings of the component System Settings Module. The manipulation results in cross site scripting. The attack can be executed remotely. The...

CVE-2026-19904 SourceCodester Online Book Store System System Settings index.php site_settings cross site scripting

A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=sitesettings of the component System Settings Module. The manipulation results in cross site scripting. The attack can be executed remotely. The...

CVE-2026-19904: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=sitesettings of the component System Settings Module. The manipulation results in cross site scripting. The attack can be executed remotely. The...

PT-2026-73044

Name of the Vulnerable Software and Affected Versions SourceCodester Online Book Store System version 1.0 Description Cross site scripting occurs in the System Settings Module within the file '/admin/index.php?page=site settings'. This issue allows a remote attacker to execute malicious scripts...

DedeCMS Setup Code Execution

The vulnerability of the 4Setup function in the DedeCMS content management system’s install/index.php script is related to improper external manipulation of file names or file paths. Exploiting this vulnerability could allow a remote attacker to execute arbitrary code...

CaupoShop - template LFI Detection (CVE-2011-4832)

Detects CVE-2011-4832 via index.php?action=template&template=../../../../../../../etc/passwd. !/usr/bin/env python3 -- coding: utf-8 -- """Detects CVE-2011-4832 via index.""" import re from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: in...