CVE-2026-5251 z-9527 admin User Update Endpoint user.js dynamically-determined object attributes

A vulnerability was identified in z-9527 admin 1.0/2.0. This impacts an unknown function of the file /server/routes/user.js of the component User Update Endpoint. Such manipulation of the argument isAdmin with the input 1 leads to dynamically-determined object attributes. It is possible to launch...

CVE-2026-5251

A vulnerability was identified in z-9527 admin 1.0/2.0. This impacts an unknown function of the file /server/routes/user.js of the component User Update Endpoint. Such manipulation of the argument isAdmin with the input 1 leads to dynamically-determined object attributes. It is possible to launch...

CVE-2026-5251

The CVE-2026-5251 entry describes a vulnerability in z-9527 admin 1.0/2.0 affecting the User Update Endpoint. The issue occurs in the code path related to /server/routes/user.js where manipulating the isAdmin argument (e.g., input 1) causes dynamically determined object attributes, enabling remot...

EUVD-2026-17735

A security vulnerability has been detected in code-projects BloodBank Managing System 1.0. This affects an unknown part of the file /adminstate.php. The manipulation of the argument statename leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been...

PT-2026-29521

A Business Logic vulnerability exists in SourceCodester Loan Management System v1.0 due to improper server-side validation. The application allows administrators to create "Loan Plans" with specific penalty rates for overdue payments. While the frontend interface prevents users from entering...

The vulnerability of the bpf_link_inc() function in the kernel/bpf/syscall.c module, which is part of the Linux operating system’s BPF interpreter support, allows a hacker to cause a service failure.

The vulnerability of the bpflinkinc function in the kernel/bpf/syscall.c module, which is part of the BPF interpreter support for Linux’s operating system, relates to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the vortex_probe1() function in the drivers/net/ethernet/3com/3c59x.c file of the Linux kernel’s network adapter driver allows a hacker to cause a service failure.

The vulnerability of the vortexprobe1 function in the drivers/net/ethernet/3com/3c59x.c file of the Linux kernel’s network adapter driver is related to pointer manipulation. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

The vulnerability of the damos_new_filter() function in the mm/damon/core.c module of the Linux kernel’s memory management subsystem allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the damosnewfilter function in the mm/damon/core.c module of the Linux kernel’s memory management subsystem is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protect...

PT-2026-29446

A vulnerability was identified in z-9527 admin 1.0/2.0. This impacts an unknown function of the file /server/routes/user.js of the component User Update Endpoint. Such manipulation of the argument isAdmin with the input 1 leads to dynamically-determined object attributes. It is possible to launch...

PT-2026-29475

A vulnerability has been found in code-projects Simple Laundry System 1.0. This issue affects some unknown processing of the file /delstaffinfo.php of the component Parameter Handler. Such manipulation of the argument userid leads to sql injection. The attack can be executed remotely. The exploit...

The vulnerability of the qla24xx_issue_sa_replace_iocb() function in the drivers/scsi/qla2xxx/qla_edif.c module of the SCSI device driver for the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the qla24xxissuesareplaceiocb function in the drivers/scsi/qla2xxx/qlaedif.c module of the SCSI device driver for the Linux operating system is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

The vulnerability of the `papr_scm_pmu_check_events()` function in the `arch/powerpc/platforms/pseries/papr_scm.c` module allows a hacker to trigger a service failure on the PowerPC platform of the Linux operating system.

The vulnerability of the paprscmpmucheckevents function in the arch/powerpc/platforms/pseries/paprscm.c module is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a system failure...

The vulnerability of the replace_free_hugepage_folios() function in the mm/hugetlb.c module of the Linux kernel’s memory management subsystem allows a hacker to trigger a service failure.

The vulnerability of the replacefreehugepagefolios function in the mm/hugetlb.c module of the Linux kernel’s memory management subsystem is related to pointer manipulation. Exploiting this vulnerability could allow an attacker to cause a service failure...

Permissive List of Allowed Inputs

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Permissive List of Allowed Inputs through incomplete sanitization of host environment variables in the host-env-security-policy.json and host-env-security.ts components. An attacker can...

SUSE CVE-2026-34042

act is a project which allows for local running of github actions. Prior to version 0.2.86, act's built in actions/cache server listens to connections on all interfaces and allows anyone who can connect to it including someone anywhere on the internet to create caches with arbitrary keys and...

CVE-2026-34442

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.211, host header manipulation in FreeScout version http://localhost:8080/system/status allows an attacker to inject an arbitrary domain into generated absolute URLs. This leads to External...

EUVD-2026-17589

A vulnerability was detected in SourceCodester Leave Application System 1.0. This affects an unknown part. Performing a manipulation of the argument page results in file inclusion. Remote exploitation of the attack is possible. The exploit is now public and may be used...

CVE-2026-34442 FreeScout: Host Header Injection Leading to External Resource Loading and Open Redirect in FreeScout

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.211, host header manipulation in FreeScout version http://localhost:8080/system/status allows an attacker to inject an arbitrary domain into generated absolute URLs. This leads to External...

EUVD-2026-17673

FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.211, host header manipulation in FreeScout version http://localhost:8080/system/status allows an attacker to inject an arbitrary domain into generated absolute URLs. This leads to External...

CVE-2026-5213

A vulnerability was determined in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20260205. The affected element is the function...