CVE-2026-77128 Broken Access Control in extension "Event management and registration" (sf_event_mgt)

The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires on...

CVE-2026-77128

The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter to view hidden or time-restricted events, unless the disableOverrideDemand plugin setting is active. Exploitation of this issue requires on...

CVE-2026-77137 SQL Injection in extension "Forms Export" (frp_form_answers)

The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the...

CVE-2026-77137

CVE-2026-77137 is a SQL injection vulnerability in the TYPO3 extension "Forms Export" (extension key: frp_form_answers ). The extension fails to properly sanitize user input before using it in a database query, allowing a low-privileged backend user to inject arbitrary SQL through a URL parameter...

EUVD-2026-65339

The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the...

CVE-2026-77137

The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the...

CVE-2026-77137 SQL Injection in extension "Forms Export" (frp_form_answers)

The extension fails to properly sanitize user input before using it in a database query. As a result, a low-privileged backend user can inject arbitrary SQL through a URL parameter within the "Forms Export" backend module. Exploitation requires a low-privileged backend user and read access to the...

EUVD-2026-65321

Improper Neutralization of Input During Web Page Generation XSS vulnerability in team-alembic AshAuthentication allows reflected cross-site scripting via the confirmation and magic link interaction forms. When a strategy is configured with requireinteraction? set to true, AshAuthentication serves...

CVE-2026-66882 Reflected XSS in AshAuthentication confirmation and magic link interaction forms

Improper Neutralization of Input During Web Page Generation XSS vulnerability in team-alembic AshAuthentication allows reflected cross-site scripting via the confirmation and magic link interaction forms. When a strategy is configured with requireinteraction? set to true, AshAuthentication serves...

CVE-2026-66882

AshAuthentication (team-alembic) is affected by a reflected cross-site scripting vulnerability in its confirmation and magic link interaction forms. When require_interaction? is true, the templates confirmation_form.html.eex and sign_in_form.html.eex interpolate request parameters into hidden inp...

CVE-2026-78656

A vulnerability was found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/custdel.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used...

Exploit for OS Command Injection in Totolink N600R_Firmware

CVE-2022-28906 PoC Python proof of concept for unauthenticate...

EUVD-2026-65305

A vulnerability was found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/custdel.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used...

CVE-2026-78656

itsourcecode Sales and Inventory System 1.0 is affected by a SQL injection vulnerability in the file /pages/cust_del.php, triggered by manipulation of the ID argument. The flaw can be exploited remotely with low privileges required (authenticated user) and no user interaction, yielding low impact...

CVE-2026-78656 itsourcecode Sales and Inventory System cust_del.php sql injection

A vulnerability was found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/custdel.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used...

CVE-2026-78656 itsourcecode Sales and Inventory System cust_del.php sql injection

A vulnerability was found in itsourcecode Sales and Inventory System 1.0. Affected is an unknown function of the file /pages/custdel.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used...

External Control of File Name or Path

Overview vrana/adminer is a Database management in a single file. Affected versions of this package are vulnerable to External Control of File Name or Path via the ns parameter in plugins/sql-log.php. An attacker can write arbitrary .sql files with attacker-controlled content to any writable...

Directory Traversal

Overview vrana/adminer is a Database management in a single file. Affected versions of this package are vulnerable to Directory Traversal via the db parameter in SQLite mode when the database-list drop action does not validate file extensions before deletion. An attacker can delete arbitrary file...

GHSA-6RJ2-96F5-CHJ9 Duplicate Advisory: GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-3wxw-xv34-2frg. This link is maintained to preserve external references. Original Description GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create where a positional...

Duplicate Advisory: GitPython: TagReference.create positional reference bypasses kwargs-only --file guard, enabling arbitrary file read (incomplete fix of 3af0c251)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-3wxw-xv34-2frg. This link is maintained to preserve external references. Original Description GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create where a positional...