PT-2026-3431

A vulnerability was determined in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. This vulnerability affects unknown code. Executing a manipulation can lead to cross-site request forgery. It is possible to launch the attack remotely...

PT-2026-3421

Name of the Vulnerable Software and Affected Versions itsourcecode Society Management System version 1.0 Description A cross site scripting issue exists in itsourcecode Society Management System 1.0. The issue is related to the manipulation of the detail argument in the file '/admin/expenses.php'...

PHPGurukul Directory Management System SQL Injection Vulnerability

The PHPGurukul Directory Management System is a directory management system developed by PHPGurukul Corporation. Version 1.0 of the PHPGurukul Directory Management System has a SQL injection vulnerability. This vulnerability arises from incorrect handling of the parameter “searchdata” in the...

PT-2026-3430

A vulnerability was found in SourceCodester/Patrick Mvuma Patients Waiting Area Queue Management System 1.0. This affects an unknown part of the file /php/api patient schedule.php. Performing a manipulation of the argument Reason results in cross site scripting. It is possible to initiate the...

ITSsourcecode School Management System SQL Injection Vulnerability

itsourcecode School Management System is an open-source school management system developed by itsourcecode. Version 1.0 of itsourcecode School Management System has a SQL injection vulnerability. This vulnerability arises from incorrect handling of the parameter ID in the file /subject/index.php,...

CVE-2026-1119

A flaw has been found in itsourcecode Society Management System 1.0. The affected element is an unknown function of the file /admin/deleteactivity.php. Executing a manipulation of the argument activityid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-1119

A flaw has been found in itsourcecode Society Management System 1.0. The affected element is an unknown function of the file /admin/deleteactivity.php. Executing a manipulation of the argument activityid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-1119 itsourcecode Society Management System delete_activity.php sql injection

A flaw has been found in itsourcecode Society Management System 1.0. The affected element is an unknown function of the file /admin/deleteactivity.php. Executing a manipulation of the argument activityid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-1119

A flaw has been found in itsourcecode Society Management System 1.0. The affected element is an unknown function of the file /admin/deleteactivity.php. Executing a manipulation of the argument activityid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-1119 itsourcecode Society Management System delete_activity.php sql injection

A flaw has been found in itsourcecode Society Management System 1.0. The affected element is an unknown function of the file /admin/deleteactivity.php. Executing a manipulation of the argument activityid can lead to sql injection. It is possible to launch the attack remotely. The exploit has been...

CVE-2026-1118

A vulnerability was detected in itsourcecode Society Management System 1.0. Impacted is an unknown function of the file /admin/addactivity.php. Performing a manipulation of the argument Title results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and m...

CVE-2026-1118

CVE-2026-1118 affects itsourcecode Society Management System 1.0. The vulnerability resides in the file /admin/add_activity.php where manipulating the Title argument triggers SQL injection. Exploitation can be performed remotely, and publicly available exploits are noted across multiple feeds. Co...

CVE-2026-1118 itsourcecode Society Management System add_activity.php sql injection

A vulnerability was detected in itsourcecode Society Management System 1.0. Impacted is an unknown function of the file /admin/addactivity.php. Performing a manipulation of the argument Title results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and m...

PT-2026-3387

Name of the Vulnerable Software and Affected Versions itsourcecode Society Management System version 1.0 Description A flaw exists in itsourcecode Society Management System version 1.0 that could allow for remote code execution. The issue is located in the /admin/delete activity.php file,...

PT-2026-3386

Name of the Vulnerable Software and Affected Versions itsourcecode Society Management System version 1.0 Description A SQL injection issue exists in itsourcecode Society Management System 1.0. The issue is located in the file /admin/add activity.php. Manipulating the Title argument can lead to SQ...

CVE-2026-1063

The vulnerability CVE-2026-1063 affects Bastillion (Bastillion up to 4.0.1) in the Public Key Management System. The issue involves manipulation in src/main/java/io/bastillion/manage/control/AuthKeysKtrl.java that enables command injection. Attack is described as executable remotely and publicly ...

CVE-2026-1059

FeMiner wms is affected by CVE-2026-1059 via /src/chkuser.php, where manipulating the Username parameter leads to SQL injection. The issue is exploitable remotely and publicly disclosed. Affected versions are prior to the commit 9cad1f1b179a98b9547fd003c23b07c7594775fa; due to the rolling-release...

PT-2026-3369

Name of the Vulnerable Software and Affected Versions xiweicheng TMS versions up to 2.28.0 Description A flaw exists in xiweicheng TMS that allows for server-side request forgery. The issue is related to the Summary function within the src/main/java/com/lhjz/portal/util/HtmlUtil.java file...

TMS code-related vulnerabilities

TMS is a channel-based team communication and collaboration tool developed by Weicheng’s individual developers, along with a lightweight task board. Versions of TMS 2.28.0 and earlier contained code vulnerabilities. These vulnerabilities stemmed from incorrect handling of the parameter url in the...

Metasploit Wrap-Up 01/16/2026

Persistence, dMSA Abuse & RCE Goodies This week, we have received a lot of contributions from the community, such as h00die, Chocapikk and countless others, which is greatly appreciated. This week’s modules and improvements in Metasploit Framework range from new modules, such as dMSA Abuse...