CVE-2026-90516

A vulnerability was found in SourceCodester School Registration and Fee System 1.0. The affected element is an unknown function of the file /bilal/normal/payreport.php. Performing a manipulation of the argument period results in sql injection. The attack can be initiated remotely. The exploit has...

CVE-2026-90516: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in SourceCodester School Registration and Fee System 1.0. The affected element is an unknown function of the file /bilal/normal/payreport.php. Performing a manipulation of the argument period results in sql injection. The attack can be initiated remotely. The exploit has...

GHSA-89V6-J5X6-CMJ3 YesWiki: SQL injection via the `recentchanges` action `period` argument leads to arbitrary DB read

Summary The recentchanges action actions/recentchanges.php accepts a period argument from two disjoint parameter spaces: the URL query string $GET'period' and the action invocation recentchanges period="...". A whitelist at line 17 validates only the URL form against 'day','week','month'. The...

YesWiki: SQL injection via the `recentchanges` action `period` argument leads to arbitrary DB read

Summary The recentchanges action actions/recentchanges.php accepts a period argument from two disjoint parameter spaces: the URL query string $GET'period' and the action invocation recentchanges period="...". A whitelist at line 17 validates only the URL form against 'day','week','month'. The...