CVE-2026-8197 Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name

Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name. The OAuth authorize template renders the integration name admin-controlled through Concrete's t translation helper as a sprintf-style format. The ... wrap is built by PHP string interpolation before t runs, so th...

EUVD-2025-36078

A flaw has been found in projectworlds Online Shopping System 1.0. Impacted is an unknown function of the file /loginsubmit.php. Executing manipulation of the argument keywords can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used...

PT-2024-18576 · Nway Pro · Nway Pro

Name of the Vulnerable Software and Affected Versions: Nway Pro version 9 Description: A vulnerability was found in the function ajax login submit form of the file loginindex.php of the component Argument Handler. The manipulation of the argument rsargs leads to information exposure through error...