Academy Learning Management System <5.9.1 - Cross-Site Scripting

Academy Learning Management System before 5.9.1 contains a cross-site scripting vulnerability via the Search parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

Leantime < 2.4 - Authenticated SQL Injection

Leantime is an open source project management system. A 'userId' variable in app/domain/files/repositories/class.files.php is not parameterized. An authenticated attacker can send a carefully crafted POST request to /api/jsonrpc to exploit an SQL injection vulnerability. Confidentiality is impact...

WordPress JobWP Plugin <= 2.3.9 - SQL Injection

The JobWP - Job Board, Job Listing, Career Page and Recruitment Plugin plugin for WordPress is vulnerable to SQL Injection via the 'jobwpuploadresume' parameter in all versions up to, and including, 2.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparati...

Online Event Booking and Reservation System 2.3.0 - SQL Injection

Online Event Booking and Reservation System 2.3.0 contains a SQL injection vulnerability in event-management/views. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id:...

My Calendar WordPress Plugin - Information Disclosure

My Calendar WordPress plugin = 3.7.6 contains an injection vulnerability caused by unvalidated user input passed to parsestr in mcajaxmcjsaction endpoint, letting unauthenticated attackers access or crash sites via switchtoblog, exploit requires WordPress Multisite or Single Site setup. id:...

rConfig 3.9 - SQL Injection

An issue was discovered in rConfig through 3.9.4. The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter. id: CVE-2020-10220 info: name: rConfig 3.9 - SQL Injection author: ritikchaddha,theamanrawat severity: critical description: | An issue was discovered i...

CVE-2026-19351

A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery.from/SelectQuery.build in the library lib/Select.js of the component Request Parameter Handler. Performing a manipulation results in sql injection. It is...

CVE-2026-19351

Technical details for CVE-2026-19351 are not publicly available in the provided documents; monitor for updates.

EUVD-2026-54912

A flaw has been found in code-projects Task Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/AdminLogin.php. Executing a manipulation of the argument email/password can lead to sql injection. The attack may be performed from remote. The exploit...

CVE-2026-71946 D-Link DWR-M961 Command Injection via /boafrm/formPingDiagnosticRun

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5C1202607071108 contain a command injection vulnerability in the /boafrm/formPingDiagnosticRun interface. A remote attacker can inject arbitrary malicious commands into the host field, resulting in command execution...

CVE-2026-64636

CVE-2026-64636 affects Plesk Obsidian up to version 18.0.80 on Linux and Windows. An SQL injection vulnerability allows an authenticated user to read arbitrary data from the panel database. According to the connected sources, the issue has a CVSS v3.1 base score of 7.7 (HIGH), with attack vector ...

EUVD-2026-54246

A vulnerability was detected in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /viewadmin.php. The manipulation of the argument delid results in sql injection. The attack may be performed from remote. The exploit is now public and may be used...

EUVD-2026-54248

A Server-Side Template Injection SSTI vulnerability in WGDashboard version 4.3.2 and earlier, allows authenticated attackers to execute arbitrary code as root...

DEBIAN-CVE-2026-50159

Mermaid is a JavaScript tool that uses Markdown-inspired text to create and modify diagrams and charts. Prior to 10.9.8 and 11.16.1, Mermaid is vulnerable to CSS injection via sibling combinator selectors generated from diagram-supplied class or id names. An attacker who can supply diagram text c...

CVE-2026-15734

A Server-Side Template Injection SSTI vulnerability in WGDashboard version 4.3.2 and earlier, allows authenticated attackers to execute arbitrary code as root...

CVE-2026-15734 WGDashboard Server-Side Template Injection vulnerability

A Server-Side Template Injection SSTI vulnerability in WGDashboard version 4.3.2 and earlier, allows authenticated attackers to execute arbitrary code as root...

CVE-2026-65520

Unauthenticated SQL Injection in WP OAuth Server = 6.2.0 versions...

CVE-2026-68747

CVE-2026-68747 affects html_sanitize_ex: the CSS Scrubber (Scrubber.CSS.scrub/1) has a non-declaration input bypass in versions prior to 1.5.4 (0.3.1). An attacker can inject CSS at-rules (e.g., @import url(...)) into pages served to other users because the allowlist is applied via a Regex over d...

EUVD-2026-54083

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other...

CVE-2026-68747 CSS sanitizer allowlist bypass in html_sanitize_ex via non-declaration input

Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' vulnerability in the CSS scrubber in rrrene htmlsanitizeex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other...