PT-2026-79828

A vulnerability was detected in SourceCodester Simple Online Food Ordering System 1.0. Impacted is an unknown function of the file /fos/view prod.php. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit is now public an...

EUVD-2022-56022

A cross-site scripting XSS vulnerability in Support chatbot in Nopaperforms Niaa-Chatbot through 2022-05-17 allows remote attackers to inject arbitrary web script or HTML via the Enter email parameter...

PT-2026-79830

Name of the Vulnerable Software and Affected Versions itsourcecode Payroll System version 1.0 Description A remote SQL injection is possible through the manipulation of the Username argument within the Login function of the admin class.php file. SQL injection is a technique where malicious SQL...

PT-2026-81005

Dolibarr before 24.0.0 contains a SQL injection vulnerability in the users REST API that allows authenticated attackers with user-read rights to extract sensitive data by splicing unsanitized filter parameters into SQL WHERE clauses without column restrictions. Attackers can perform binary search...

CVE-2025-26238

D-Link DI-8100G running version 17.12.20A1 is vulnerable to an improper control of generation of code . An attacker can exploit the flag parameter within the msp_info endpoint to achieve arbitrary code execution , allowing for the execution of unauthorized commands on the system. As of the provid...

PT-2026-80883

TIM Flow before 26.0.6 contains a CRLF injection vulnerability that allows remote attackers to inject arbitrary HTTP headers and response body content by embedding unsanitized carriage return and line feed sequences in the rt URL parameter and access token cookie, which are reflected into...

PT-2026-79835

Joomla Extension - joomlack.fr - Reflected XSS in Page Builder CK 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a reflected XSS via the iscontenttype parameter...

PT-2026-80989

Name of the Vulnerable Software and Affected Versions D-Link DI-7001 MINI 5G version 19.10.31A1 Description A code execution issue exists in the msp info endpoint. An attacker can exploit the flag parameter to execute arbitrary commands on the system. Recommendations At the moment, there is no...

PT-2026-81273

Name of the Vulnerable Software and Affected Versions Media Sweep – WordPress Media Cleaner versions prior to 1.1.4 Description An issue exists where authenticated attackers with administrator-level access and above can perform a generic SQL Injection. This occurs due to insufficient escaping of...

PT-2026-79820

A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/cust edit.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit is now public and may be used...

PT-2026-80994

Name of the Vulnerable Software and Affected Versions D-Link DI-8100G version 17.12.20A1 Description An issue exists in the msp info endpoint where the flag parameter can be exploited to execute arbitrary code. Arbitrary code execution allows an attacker to run unauthorized commands on the system...

PT-2026-80808

Name of the Vulnerable Software and Affected Versions itsourcecode Online Clinic Management System version 1.0 Description An issue in the Admin Login component allows remote exploitation via SQL injection, a technique where malicious SQL statements are inserted into entry fields for execution. T...

CVE-2025-26238

In D-Link DI-8100G 17.12.20A1, the flag parameter in mspinfo can be exploited to execute arbitrary code...

EUVD-2025-210768

D-Link DI-7001 MINI5G 19.10.31A1 contains a code execution vulnerability in the flag parameter of mspinfo, which can be exploited to run arbitrary commands...

PT-2026-81036

Name of the Vulnerable Software and Affected Versions CakePHP versions prior to 5.1.10 CakePHP versions prior to 5.2.15 CakePHP versions prior to 5.3.7 Description When using the PostgresDriver, the FunctionsBuilder::jsonValue function is susceptible to SQL injection. This occurs when...

CVE-2026-78154 the-momentum open-wearables Public Invitation-Code Redemption Endpoint user_invitation_code.py redeem_invitation_code missing authentication

A vulnerability was identified in the-momentum open-wearables up to 0.6.2. This impacts the function redeeminvitationcode of the file backend/app/api/routes/v1/userinvitationcode.py of the component Public Invitation-Code Redemption Endpoint. The manipulation of the argument code leads to missing...

CVE-2026-78144

A vulnerability was identified in code-projects Barangay Resident Profiling Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /boarders.php of the component Boarder Management Module. Such manipulation of the argument ID leads to authorization bypass. T...

CVE-2026-78143

A vulnerability was determined in code-projects Barangay Resident Profiling Management System 1.0. Affected is an unknown function of the file residents.php of the component Resident Search Functionality. This manipulation of the argument Search causes sql injection. Remote exploitation of the...

CVE-2026-78145 CTFd __init__.py _is_safe_url redirect

A vulnerability has been found in CTFd up to 3.8.4. The affected element is the function issafeurl of the file CTFd/utils/validators/init.py. Such manipulation of the argument Next leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be...

CVE-2026-78144 code-projects Barangay Resident Profiling Management System Boarder Management boarders.php authorization

A vulnerability was identified in code-projects Barangay Resident Profiling Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /boarders.php of the component Boarder Management Module. Such manipulation of the argument ID leads to authorization bypass. T...