CVE-2026-46382

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available...

PT-2026-71513

Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...

PT-2026-71497

Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...

CVE-2026-46688: URL Redirection to Untrusted Site

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, an unauthenticated request can be made to redirect the user to a query-specified location. This allows an attacker to create a specially-crafted URL to an MRBS installation that wil...

CVE-2026-73532: Embedded Malicious Code

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file libs/class-license-sync.php, loaded via a requireonce directive added to fluentformpro.php,...

CVE-2026-28176: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

CVE-2026-28149: Deserialization of Untrusted Data

Unauthenticated PHP Object Injection in Headless Single Sign On = 1.6 versions...

CVE-2026-27380: Deserialization of Untrusted Data

Editor PHP Object Injection in Car Rental Manager = 1.3.9 versions...

PT-2026-71882

Name of the Vulnerable Software and Affected Versions FreePBX versions prior to 16.0.47 FreePBX versions prior to 17.0.30 Description The FreePBX Framework module allows an authenticated user with write access to backup files or sufficient backup-restore permissions to disable authentication. By...

PT-2026-71391

The Customer Email Verification for WooCommerce WordPress plugin before 3.2.6 does not correctly validate the email-verification activation code, relying on a loose comparison that an attacker can satisfy with a crafted value type, allowing unauthenticated users to verify and take over the accoun...

CVE-2026-49827: Improper Input Validation

WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scanfile parameter, leading to Remote Code Execution. Combined with open registration no invite...

CVE-2026-46382: Server-Side Request Forgery (SSRF)

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available...

PT-2026-71486

Name of the Vulnerable Software and Affected Versions WebErpMesv2 versions prior to 1.20 Description WebErpMesv2 allows self-registered users to upload arbitrary PHP files via the scan file parameter in the HR Expense section, resulting in Remote Code Execution RCE. This is exacerbated by open...

PT-2026-71579

Unauthenticated Local File Inclusion in Barista = 2.5.1 versions...

Online Food Ordering System 1.0 Shell Upload

Online Food Ordering System version 1.0 suffers from a remote shell upload vulnerability. The upload endpoint /web/admin/updatefood.php accepts files with any extension, including .php, and stores them in the web-accessible directory without renaming or sanitizing the filename. Titles:...

PT-2026-80143

TuxCare rebuilt phenx/php-svg-lib to address 3 CVEs. Fixed in 0.4.1-p1+tuxcare...

PT-2026-71525

Unauthenticated PHP Object Injection in Booking Activities = 1.18.4 versions...

PT-2026-80149

TuxCare rebuilt webonyx/graphql-php to address 4 CVEs. Fixed in v14.11.10-p1+tuxcare...

EUVD-2026-57701

The Meeting Room Booking System MRBS is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available...

CVE-2026-46382

MRBS prior to v1.12.2 is vulnerable to server-side request forgery during import, where a user-supplied private/local URI can be fetched without validation. The fixed version is v1.12.2; no workaround is listed in the provided documents. Remediation: upgrade to v1.12.2 or newer as stated in the s...