CVE-2026-82914 kishan0725 Hospital-Management-System search.php sql injection

A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability affects unknown code of the file /search.php. The manipulation of the argument Contact results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the...

CVE-2026-82914 kishan0725 Hospital-Management-System search.php sql injection

A security flaw has been discovered in kishan0725 Hospital-Management-System 1.0. This vulnerability affects unknown code of the file /search.php. The manipulation of the argument Contact results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the...

CVE-2026-82914

kishan0725 Hospital-Management-System 1.0 contains a SQL injection vulnerability in the file /search.php , triggered by manipulation of the Contact argument. The flaw allows a remote, unauthenticated attacker to execute arbitrary SQL queries, resulting in low impact on confidentiality, integrity,...

CVE-2026-81892

EasyAdmin for Symfony (versions 4.0.0 through 4.29.16 and 5.5.1) contains a security bypass in its custom-action dispatcher. When Action::linkToRoute() or MenuItem::linkToRoute() is used, the executed controller is swapped via the routeName query parameter on the kernel.controller event — after S...

CVE-2026-81892 EasyAdmin custom-action dispatcher bypasses access_control on other routes

EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions Action::linkToRoute and MenuItem::linkToRoute, swaps the executed controller based on the...

CVE-2026-82835 caoqianming django-vue-admin file access control

A weakness has been identified in caoqianming django-vue-admin 1.0. This vulnerability affects unknown code of the file /api/file/. Executing a manipulation of the argument fileid can lead to improper access controls. The attack can be executed remotely. The exploit has been made available to the...

CVE-2026-83497

Unrestricted deserialization of untrusted data in the cursor pagination component in the OpenSearch SQL plugin allows a remote authenticated user with basic read/search permissions to execute arbitrary code on the server by sending a crafted cursor parameter to the plugins/sql endpoint...

CVE-2026-72001

Pangolin before 1.22.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by supplying an attacker-controlled URL parameter to the share-link authentication endpoint that omits the expected resource identifier from the token...

WordPress User Profile Builder plugin <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'email' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Profile Builder versions = 4.0.0...

WordPress Listdom: AI-powered Business Directory with Classifieds Ads Listings plugin <= 5.8.1 - Unauthenticated Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'lsddisplstyle' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Listdom versions = 5.8.1...

CVE-2026-75132

WAPT Server versions 2.6.1.17834 and earlier contains a SQL injection vulnerability in the columns parameter of the GET /api/v3/hosts endpoint. A remote authenticated user with read-only privileges can inject arbitrary PostgreSQL expressions into the SQL query constructed by WAPT. By exploiting t...

WordPress Photo Gallery by Ays plugin <= 6.8.2 - Authenticated (Administrator+) SQL Injection via 's' Parameter vulnerability

Authenticated Administrator+ SQL Injection via 's' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Photo Gallery by Ays versions = 6.8.2...

WordPress Cozy Blocks plugin <= 2.2.17 - Unauthenticated Unpublished Product Information Disclosure via 'wishlistData' Parameter vulnerability

Unauthenticated Unpublished Product Information Disclosure via 'wishlistData' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Cozy Blocks versions = 2.2.17...

WordPress LearnPress plugin <= 4.4.4 - Authenticated (Administrator+) SQL Injection via 'orderby' Parameter vulnerability

Authenticated Administrator+ SQL Injection via 'orderby' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin LearnPress versions = 4.4.4...

CVE-2026-75132 WAPT Server SQL Injection via /api/v3/hosts Endpoint

WAPT Server versions 2.6.1.17834 and earlier contains a SQL injection vulnerability in the columns parameter of the GET /api/v3/hosts endpoint. A remote authenticated user with read-only privileges can inject arbitrary PostgreSQL expressions into the SQL query constructed by WAPT. By exploiting t...

CVE-2026-75132 WAPT Server SQL Injection via /api/v3/hosts Endpoint

WAPT Server versions 2.6.1.17834 and earlier contains a SQL injection vulnerability in the columns parameter of the GET /api/v3/hosts endpoint. A remote authenticated user with read-only privileges can inject arbitrary PostgreSQL expressions into the SQL query constructed by WAPT. By exploiting t...

EUVD-2026-68606

WAPT Server versions 2.6.1.17834 and earlier contains a SQL injection vulnerability in the columns parameter of the GET /api/v3/hosts endpoint. A remote authenticated user with read-only privileges can inject arbitrary PostgreSQL expressions into the SQL query constructed by WAPT. By exploiting t...

CVE-2026-75132

WAPT Server versions 2.6.1.17834 and earlier contain a SQL injection vulnerability in the columns parameter of the GET /api/v3/hosts endpoint. A remote authenticated user with read-only privileges can inject arbitrary PostgreSQL expressions into the SQL query constructed by WAPT, allowing them to...

CVE-2026-59111 Command Injection vulnerability in eObčanka-Identifikace

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Digitální a informační agentura DIA eObčanka-Identifikace on MacOS enables an attacker to register a custom URL scheme czeeopauth:// for parameterized application execution. Prior to version...

CVE-2026-59111 Command Injection vulnerability in eObčanka-Identifikace

Improper neutralization of special elements used in an OS command 'OS command injection' vulnerability in Digitální a informační agentura DIA eObčanka-Identifikace on MacOS enables an attacker to register a custom URL scheme czeeopauth:// for parameterized application execution. Prior to version...