PT-2026-91846

A flaw has been found in PHPGurukul Hostel Management System 3.0. This affects an unknown part of the file /admin/includes/checklogin.php. This manipulation of the argument ID causes improper access controls. Remote exploitation of the attack is possible. The exploit has been published and may be...

PT-2026-93202

Netcore NR255-V version 1.5.130703 contains a null pointer dereference vulnerability in route policy add.cgi caused by a missing exit port parameter. Attackers can send requests lacking the exit port field to trigger the null pointer dereference, resulting in a denial of service...

PT-2026-92315

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A logic error in the s decode vui param function within the fw hevc dec header.c file allows for an out-of-bounds write. This condition can be exploited to achie...

School Registration and Fee System SQL Injection Vulnerability

School Registration and Fee System is a school registration and fee management software developed by the SourceCodester community. The School Registration and Fee System has a SQL injection vulnerability, which stems from incorrect handling of the Category parameter in the file bilal/saveclass.ph...

PT-2026-92386

Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce their order total below the legitimate price of shippable goods...

PT-2026-91858

A vulnerability was identified in zyx0814 FilePress up to 3.0.1. This vulnerability affects unknown code of the file dzz/publish/search.php of the component Publish Module. Such manipulation of the argument orderby/order leads to sql injection. The attack can be launched remotely. The exploit is...

CVE-2026-51133

A Cross-Site Scripting (XSS) vulnerability exists in za-internet GmbH C-MOR Video Surveillance version 6.0104 and below . The flaw allows a remote attacker to execute arbitrary client-side code by enticing an authenticated user to click crafted URLs. The vulnerability is triggered via the size pa...

CVE-2026-92237: Insertion of Sensitive Information into Log File

Insertion of sensitive information into log file in the slow query logging feature in Devolutions PowerShell Universal 2026.2.5 and earlier allows an authenticated user with log read permission to obtain application tokens, data protection key material and other stored credentials via SQL paramet...

CVE-2026-82189: External Control of Assumed-Immutable Web Parameter

Joomla Extension - j2commerce.com - Any order can be marked Failed by anyone in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - Unauthenticated denial-of-service against the order pipeline: mass-failing pending orders to disrupt revenue and force manual reprocessing, or flipping already-fulfille...

CVE-2026-79410: Improper Input Validation

Improper validation of the quantity parameter in the add-to-cart path of Webkul Bagisto v2.4.9 allows authenticated attackers to reduce their order total below the legitimate price of shippable goods...

CVE-2026-91772: URL Redirection to Untrusted Site

Halo through 2.26.1 contains an open redirect vulnerability in the anonymous thumbnail endpoint that fails to validate the uri query parameter. Attackers can craft malicious links on the trusted Halo domain that redirect visitors to arbitrary external sites, enabling phishing attacks and abuse of...

CVE-2026-51133: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance = V6.0104 allows a remote attacker to execute arbitrary code via the size parameter in ptzpreset.pml component and the showmovies.pml component...

CVE-2026-91932: Improper Input Validation

Flowise before 3.1.4 contains a validation bypass vulnerability in MCP server configuration allowing authenticated attackers remote code execution through an unvalidated cwd parameter. Attackers can bypass path validation using clean filenames in the args array while controlling the working...

CVE-2026-82191: Use of Predictable Algorithm in Random Number Generator

Joomla Extension - j2commerce.com - Unescaped request data reflected into PayPal notify redirect in J2Store 1.0.0-3.3.2, 4.0.0-4.0.22, 4.1.0-4.1.7 - A crafted link to the paypal notify endpoint, if followed by a victim's browser or an automated system that fetches it, causes the resulting redirec...

PT-2026-92145

Name of the Vulnerable Software and Affected Versions IBM Security Verify Identity Access affected versions not specified Description The reverse proxy may allow parameters to be injected in requests sent to third party services. Recommendations At the moment, there is no information about a newe...

PT-2026-93179

QloApps through 1.7.0 reflects unescaped child feature names into back-office validation error messages in the Hotel Reservation System feature management page. Authenticated back-office users who follow a crafted link can execute injected JavaScript in their administrative session via the child...

PT-2026-92114

Name of the Vulnerable Software and Affected Versions Design Scuole Italia affected versions not specified Description The Firma Circolare feature allows an authenticated attacker to perform stored HTML injection. By manipulating the sign parameter, an attacker can inject arbitrary HTML to force...

PT-2026-92123

Payload Plugins is a collection of plugins designed to enhance Payload CMS. From 0.3.0 until 0.4.0, @jhb.software/payload-cloudinary-plugin deployments with clientUploads enabled expose POST /api/cloudinary-generate-signature, whose handler in cloudinary/src/getGenerateSignature.ts passes...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37980)

Sales and Inventory System is an enterprise resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability, which stems from the failure of the /pages/sup Edit1.php file to properly validate the ID parameter...

EUVD-2026-79998

Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance = V6.0104 allows a remote attacker to execute arbitrary code via the size parameter in ptzpreset.pml component and the showmovies.pml component...