PT-2026-43600

An low privileged remote attacker can exploit an unauthenticated SQL Injection vulnerability in the dash layout.php files saveDashboardLayout function due to improper neutralization of special elements in a SQL INSERT command allowing for reading the whole database and inserting entries into a no...

CVE-2026-6486

CVE-2026-6486 affects classroombookings up to version 2.17.0; the read() function in crbs-core/application/views/layout.php (User Display Name Handler) is vulnerable to cross-site scripting via the displayname argument. Exploitation is possible remotely; exploitation is documented as PoC. A fix i...

CVE-2020-37080 webTareas 2.0.p8 - Arbitrary File Deletion

webTareas 2.0.p8 contains a file deletion vulnerability in the printlayout.php administration component that allows authenticated attackers to delete arbitrary files. Attackers can exploit the vulnerability by manipulating the 'atttmp1' parameter to specify and delete files on the server through ...