CVE-2026-3401 SourceCodester Web-based Pharmacy Product Management System session expiration

A weakness has been identified in SourceCodester Web-based Pharmacy Product Management System 1.0. This affects an unknown part. This manipulation causes session expiration. Remote exploitation of the attack is possible. The complexity of an attack is rather high. It is indicated that the...

GHSA-4QGR-4H56-8895

creationtimestamp| type| source ---|---|--- 2026-02-26 06:10:19+00:00| seen| https://gist.github.com/alon710/79921bd932bf2a0c25c4d230a1f15f91...

CVE-2026-27629

InvenTree is an Open Source Inventory Management System. Prior to version 1.2.3, insecure server-side templates can be hijacked to expose secure information to the client. When generating custom batch codes, the InvenTree server makes use of a customizable jinja2 template, which can be modified b...

CVE-2026-27629

InvenTree CVE-2026-27629 is a Server-Side Template Injection (SSTI) in PART_NAME_FORMAT prior to 1.2.3. A staff member with settings access could modify a jinja2 template used during batch code generation; after validation, this template could be used by other users to exfiltrate data or execute ...

GHSA-5R3V-VC8M-M96G

creationtimestamp| type| source ---|---|--- 2026-02-25 01:08:02+00:00| seen| https://gist.github.com/alon710/b23e84fd74b0099ad7b9c6587db73222...

CVE-2019-25432

Part-DB 0.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to login by injecting SQL syntax into authentication parameters. Attackers can submit a single quote followed by 'or' in the login form to bypass credential validation and gain unauthorized access to...

CVE-2019-25432

Part-DB 0.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to login by injecting SQL syntax into authentication parameters. Attackers can submit a single quote followed by 'or' in the login form to bypass credential validation and gain unauthorized access to...

CVE-2019-25432 Part-DB 0.4 Authentication Bypass via login.php

Part-DB 0.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to login by injecting SQL syntax into authentication parameters. Attackers can submit a single quote followed by 'or' in the login form to bypass credential validation and gain unauthorized access to...

CVE-2019-25432 Part-DB 0.4 Authentication Bypass via login.php

Part-DB 0.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to login by injecting SQL syntax into authentication parameters. Attackers can submit a single quote followed by 'or' in the login form to bypass credential validation and gain unauthorized access to...

CVE-2019-25432

Part-DB 0.4 contains an authentication bypass vulnerability that allows unauthenticated login by injecting SQL syntax into authentication parameters (e.g., a single quote followed by or in the login form). Affected component is the login/authentication flow (login.php). Documented impact is unaut...

Part-DB SQL注入漏洞

Part-DB is an open-source web-based database designed for managing electronic components. Version 0.4 of Part-DB contains a SQL injection vulnerability. This vulnerability stems from SQL injection attacks on authentication parameters, which could allow unverified attackers to bypass authenticatio...

PT-2026-21310

Part-DB 0.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to login by injecting SQL syntax into authentication parameters. Attackers can submit a single quote followed by 'or' in the login form to bypass credential validation and gain unauthorized access to...

MINI-J5RW-HP65-X32V

Bulletin has no description...

Orchard Core cross-site scripting vulnerabilities

Orchard Core is an open-source modularized and multi-tenant application framework built using Asp.Net Core by the US-based Orchard Core company. It also includes a content management system Cms built on top of this framework. The Orchard Core RC1 version contained a cross-site scripting...

CGA-J2H4-853H-52PC

Bulletin has no description...

CGA-3PHR-PC3X-MVPV

Bulletin has no description...

CVE-2026-1551

A weakness has been identified in itsourcecode School Management System 1.0. This affects an unknown part of the file /ramonsys/course/controller.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been made available to...

CGA-253R-6V2P-HWF2

Bulletin has no description...

GHSA-4WP9-CF5H-V2G5

creationtimestamp| type| source ---|---|--- 2026-01-25 17:13:30+00:00| seen| https://bsky.app/profile/0xacb.com/post/3mdba37uwhz2s...

GHSA-6PW3-H7XF-X4GP

creationtimestamp| type| source ---|---|--- 2026-01-24 21:25:05+00:00| seen| https://gist.github.com/alon710/f05df8863d4316e4f7a003f62735ffa6 2026-01-24 22:34:42+00:00| seen| https://gist.github.com/alon710/ca1278aa87a44b0cf4af1ac5fda3f0eb 2026-01-24 22:34:45+00:00| seen|...