CVE-2026-82609

itsourcecode Sales and Inventory System 1.0 is affected by a SQL injection vulnerability in the file /pages/inv_edit.php , triggered by manipulating the ID argument. The vulnerability allows a remote attacker with low privileges and no user interaction to impact confidentiality, integrity, and av...

EUVD-2026-68333

A vulnerability was identified in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/invedit.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might b...

EEF-CVE-2026-82681 Query-parameter injection in AshAdmin row-action links via unencoded string primary keys

Summary Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicin...

CVE-2026-82681 Query-parameter injection in AshAdmin row-action links via unencoded string primary keys

Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the...

CVE-2026-82681

ash-project ash_admin (Elixir admin panel) contains a query-parameter injection in the Table, DataTable, and Show components. Row-action URLs were built via raw string interpolation of the primary key without URL-encoding. Because the primary key is spliced last into the query string and Plug.Con...

CVE-2026-82681 Query-parameter injection in AshAdmin row-action links via unencoded string primary keys

Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the...

EUVD-2026-68327

Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the...

CVE-2026-82681 Query-parameter injection in AshAdmin row-action links via unencoded string primary keys

Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the...

CVE-2026-82601

A weakness has been identified in SeaCMS up to 13.6. This affects an unknown part of the file /err.php. Executing a manipulation of the argument errtxt can lead to cross site scripting. The attack can be launched remotely. The exploit has been made available to the public and could be used for...

CVE-2026-82601 SeaCMS err.php cross site scripting

A weakness has been identified in SeaCMS up to 13.6. This affects an unknown part of the file /err.php. Executing a manipulation of the argument errtxt can lead to cross site scripting. The attack can be launched remotely. The exploit has been made available to the public and could be used for...

EUVD-2026-68310

A weakness has been identified in SeaCMS up to 13.6. This affects an unknown part of the file /err.php. Executing a manipulation of the argument errtxt can lead to cross site scripting. The attack can be launched remotely. The exploit has been made available to the public and could be used for...

EUVD-2026-68305

A security flaw has been discovered in SeaCMS up to 13.6. Affected by this issue is some unknown functionality of the file /zyapi.php?ac=videolist. Performing a manipulation of the argument ids results in sql injection. The attack can be initiated remotely. The exploit has been released to the...

CVE-2026-82600

SeaCMS up to version 13.6 is affected by a SQL injection vulnerability in the file /zyapi.php?ac=videolist, specifically through manipulation of the ids argument. The flaw allows remote, unauthenticated attackers to execute arbitrary SQL queries with low complexity . The impact is rated HIGH (7.3...

CVE-2026-82600 SeaCMS zyapi.php sql injection

A security flaw has been discovered in SeaCMS up to 13.6. Affected by this issue is some unknown functionality of the file /zyapi.php?ac=videolist. Performing a manipulation of the argument ids results in sql injection. The attack can be initiated remotely. The exploit has been released to the...

PT-2026-83850

A security flaw has been discovered in Edimax BR-6214K 1.40. This vulnerability affects the function system of the file www/ping.asp of the component asp setPing Endpoint. Performing a manipulation of the argument pingstr results in os command injection. The attack can be initiated remotely. The...

CVE-2026-81892: Authorization Bypass Through User-Controlled Key

EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a single dashboard route and, for custom actions Action::linkToRoute and MenuItem::linkToRoute, swaps the executed controller based on the...

CVE-2026-75460: Authorization Bypass Through User-Controlled Key

XueZhiSi Open Source Exam System = 3.9.0 has a privilege escalation vulnerability in the teacher-end interface POST /api/teacher/user/page/list. The role parameter in UserPageRequestVM is fully controllable by the requester...

CVE-2026-78079: URL Redirection to Untrusted Site

Joomla Extension - joomshaper.com - Open Redirect via Base64 Return Parameter in Helix Ultimate 2.2.10 - Return redirect parameters accepted arbitrary Base64 strings without verifying whether the resolved target was an internal site URL via Uri::isInternal...

CVE-2026-40465: URL Redirection to Untrusted Site

NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL or redirect parameter...

CVE-2026-82727: Generation of Error Message Containing Sensitive Information

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashphoenix writes the entire raw submitted param map into an exception message, so secrets submitted alongside a union form field leak into logs, crash reports and the dev error page. When AshPhoenix.Form.Au...