CVE-2026-86279

CVE-2026-86279 affects the SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 , a learning management platform. The vulnerability resides in an unknown function within the file auth_process.php (component: Login ) and results in session fixation , allowing a remote attac...

CVE-2026-86244 FastAdmin User Controller User.php login cross site scripting

A security vulnerability has been detected in FastAdmin up to 1.2.0.20210401beta. Affected is the function register/login of the file application/index/controller/User.php of the component User Controller. Such manipulation of the argument url leads to cross site scripting. The attack may be...

CVE-2026-86244 FastAdmin User Controller User.php login cross site scripting

A security vulnerability has been detected in FastAdmin up to 1.2.0.20210401beta. Affected is the function register/login of the file application/index/controller/User.php of the component User Controller. Such manipulation of the argument url leads to cross site scripting. The attack may be...

CVE-2026-86244 FastAdmin User Controller User.php login cross site scripting

A security vulnerability has been detected in FastAdmin up to 1.2.0.20210401beta. Affected is the function register/login of the file application/index/controller/User.php of the component User Controller. Such manipulation of the argument url leads to cross site scripting. The attack may be...

PT-2026-86804

The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...

CVE-2026-86279: Session Fixation

A vulnerability was determined in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The impacted element is an unknown function of the file authprocess.php of the component Login. This manipulation causes session fixiation. It is possible to initiate the attack remotel...

CVE-2026-86351: URL Redirection to Untrusted Site

Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers. The vulnerable homepage...

CVE-2026-14444: Improper Privilege Management

The WP Fusion Pro plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 3.47.13. This is due to insufficient authorization checks on the role parameter in the ThriveCart Auto Login handler's thrivecart function. This makes it possible for authenticated...

PT-2026-86638

A vulnerability was determined in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The impacted element is an unknown function of the file auth process.php of the component Login. This manipulation causes session fixiation. It is possible to initiate the attack...

CVE-2026-47839 - Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin | Cloud Foundry

High CVSS score: 9.2 Critical CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS score: 9.0 Critical CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H Vendor CloudFoundry Foundation Versions Affected Severity is Critical unless otherwise noted. UAA – All versions through v77.30.0...

PT-2026-86679

Affected versions of MISP validate the user-configurable homepage by checking only whether the supplied path begins with /. That check is insufficient because protocol-relative URLs such as //attacker.example also begin with / but resolve to an external origin in browsers. The vulnerable homepage...

CVE-2026-86256

wger before 2.6 affected versions = 2.5.0 contains an open redirect vulnerability in the trainerlogin view wger/core/views/user.py. After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseRedirect without validating it with...

CVE-2026-86256 wger before 2.6 Open Redirect via trainer-login next parameter

wger before 2.6 affected versions = 2.5.0 contains an open redirect vulnerability in the trainerlogin view wger/core/views/user.py. After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseRedirect without validating it with...

CVE-2026-86256 wger before 2.6 Open Redirect via trainer-login next parameter

wger before 2.6 affected versions = 2.5.0 contains an open redirect vulnerability in the trainerlogin view wger/core/views/user.py. After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseRedirect without validating it with...

CVE-2026-86256 wger before 2.6 Open Redirect via trainer-login next parameter

wger before 2.6 affected versions = 2.5.0 contains an open redirect vulnerability in the trainerlogin view wger/core/views/user.py. After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET parameter via HttpResponseRedirect without validating it with...

CVE-2026-86256

wger before 2.6 (affected versions ≤ 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py). After a trainer enters impersonation mode, the view redirects to a user-supplied next GET parameter via HttpResponseRedirect() without validating it with url_ha...

CVE-2026-86211

A flaw has been found in rabindralamsal inventory-management-system 1.0.0. This affects an unknown part of the file index.php of the component Login. Executing a manipulation of the argument username/password can lead to sql injection. The attack can be executed remotely. The exploit has been...

CVE-2026-86211 rabindralamsal inventory-management-system Login index.php sql injection

A flaw has been found in rabindralamsal inventory-management-system 1.0.0. This affects an unknown part of the file index.php of the component Login. Executing a manipulation of the argument username/password can lead to sql injection. The attack can be executed remotely. The exploit has been...

CVE-2026-86211 rabindralamsal inventory-management-system Login index.php sql injection

A flaw has been found in rabindralamsal inventory-management-system 1.0.0. This affects an unknown part of the file index.php of the component Login. Executing a manipulation of the argument username/password can lead to sql injection. The attack can be executed remotely. The exploit has been...

EUVD-2026-72101

A flaw has been found in rabindralamsal inventory-management-system 1.0.0. This affects an unknown part of the file index.php of the component Login. Executing a manipulation of the argument username/password can lead to sql injection. The attack can be executed remotely. The exploit has been...