Code-Projects Simple Content Management System 代码注入漏洞

Code-Projects Simple Content Management System is an open-source simple content management system developed by Code-Projects. Version 1.0 of the code-projects Simple Content Management System contains a code injection vulnerability. This vulnerability arises from incorrect handling of parameters...

CVE-2026-36950

Sourcecodester Online Thesis Archiving System v1.0 is vulnerable to SQL injection in /otas/projectsperdepartment.php...

PT-2026-32397

Sourcecodester Online Thesis Archiving System v1.0 is vulnerable to SQL injection in /otas/projects per department.php...

CVE-2026-36950

Sourcecodester Online Thesis Archiving System v1.0 is vulnerable to SQL injection in /otas/projectsperdepartment.php...

PT-2026-32415

GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that under certain circumstances could have allowed an authenticated user with auditor privileges to modify vulnerability flag data in private projects due to...

CVE-2026-36950

Sourcecodester Online Thesis Archiving System v1.0 is vulnerable to SQL injection in /otas/projectsperdepartment.php...

CVE-2026-6161: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in code-projects Simple ChatBox up to 1.0. This affects an unknown part of the file /chatbox/insert.php of the component Endpoint. Executing a manipulation of the argument msg can lead to sql injection. It is possible to launch the attack remotely. The exploit has...

Code-Projects Lost and Found Thing Management SQL注入漏洞

Code-Projects Lost and Found Thing Management is an open-source lost and found management tool developed by Code-Projects. Version 1.0 of Code-Projects Lost and Found Thing Management contains a SQL injection vulnerability. This vulnerability arises from incorrect handling of the parameter “cata”...

CVE-2026-36950

The Sourcecodester Online Thesis Archiving System v1.0 is vulnerable to SQL injection in the /otas/projects_per_department.php file. This vulnerability arises from the improper neutralization of special elements used in an SQL command. While specific exploitation details or links are not provided...

CVE-2026-6150: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in code-projects Simple Laundry System 1.0. This affects an unknown part of the file /checkupdatestatus.php. The manipulation of the argument serviceId leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to t...

CVE-2026-6202: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in code-projects Easy Blog Site 1.0. This affects an unknown function of the file post.php. Performing a manipulation of the argument tags results in sql injection. The attack may be initiated remotely. The exploit has been released to the public and may be use...

CVE-2026-40103

Summary: Vikunja (open-source self-hosted task manager) had a scoped API token bypass: a token with only the projects.background permission could delete a project background due to a method-confusion in token enforcement. The root cause was in the route permission matching (CanDoAPIRoute) that re...

CVE-2026-40103 Vikunja's Scoped API tokens with projects.background permission can delete project backgrounds

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's scoped API token enforcement for custom project background routes is method-confused. A token with only projects.background can successfully delete a project background, while a token with only...

CVE-2026-35595

CVE-2026-35595 describes a privilege escalation in Vikunja where a user with inherited Write can become Admin on a moved project due to a recursive CTE that recalculates permissions when changing parent_project_id. Before 2.3.0, the CanUpdate check only validated Write on the new parent and did n...

EUVD-2026-21494

Vikunja: Scoped API tokens with projects.background permission can delete project backgrounds...

CVE-2026-6036 code-projects Vehicle Showroom Management System VehicleDetailsFunction.php sql injection

A vulnerability was found in code-projects Vehicle Showroom Management System 1.0. The impacted element is an unknown function of the file /util/VehicleDetailsFunction.php. The manipulation of the argument VEHICLEID results in sql injection. The attack can be executed remotely. The exploit has be...

CVE-2026-6035 code-projects Vehicle Showroom Management System ServiceAndSalesReport.php cross site scripting

A vulnerability has been found in code-projects Vehicle Showroom Management System 1.0. The affected element is an unknown function of the file /BranchManagement/ServiceAndSalesReport.php. The manipulation of the argument BRANCHID leads to cross site scripting. Remote exploitation of the attack i...

CVE-2026-6034

The CVE-2026-6034 entry concerns code-projects Vehicle Showroom Management System 1.0. The vulnerability affects the file /BranchManagement/ProfitAndLossReport.php where manipulating the BRANCH_ID parameter enables cross-site scripting. The description indicates a remote attack is possible and th...

CVE-2026-6034 code-projects Vehicle Showroom Management System ProfitAndLossReport.php cross site scripting

A flaw has been found in code-projects Vehicle Showroom Management System 1.0. Impacted is an unknown function of the file /BranchManagement/ProfitAndLossReport.php. Executing a manipulation of the argument BRANCHID can lead to cross site scripting. The attack may be launched remotely. The exploi...

CVE-2026-6032

CVE-2026-6032 affects code-projects Simple Laundry System 1.0. The vulnerability is in /checkcheckout.php where manipulating the argument serviceId enables cross-site scripting. Exploitation is remotely possible over NETWORK with low attack complexity and no privileges required; user interaction ...