CVE-2026-129133

The Meeting Room Booking System (MRBS) version before 1.13.0 is vulnerable to a CSV formula injection vulnerability in the web/report.php component. The root cause is that the escape() function fails to neutralize leading formula characters, allowing authenticated users to inject malicious formul...

EUVD-2026-125546

MRBS before 1.13.0 contains a CSV formula injection vulnerability that allows authenticated users to inject spreadsheet formulas because the escape function in web/report.php fails to neutralize leading formula characters. Attackers can store formulas in booking names, descriptions or custom fiel...

PT-2026-146991

MRBS before 1.13.0 contains a CSV formula injection vulnerability that allows authenticated users to inject spreadsheet formulas because the escape function in web/report.php fails to neutralize leading formula characters. Attackers can store formulas in booking names, descriptions or custom fiel...

CVE-2026-124452

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eyemag/report.php that allows authenticated users to inject scripts by adding unescaped document notes. Attackers with document-note write access can store malicious JavaScript in a retina document note...

CVE-2026-124452 OpenEMR before 8.3.0 Stored XSS via Eye Exam Document Notes

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eyemag/report.php that allows authenticated users to inject scripts by adding unescaped document notes. Attackers with document-note write access can store malicious JavaScript in a retina document note...

CVE-2026-124452 OpenEMR before 8.3.0 Stored XSS via Eye Exam Document Notes

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eyemag/report.php that allows authenticated users to inject scripts by adding unescaped document notes. Attackers with document-note write access can store malicious JavaScript in a retina document note...

CVE-2026-124452

OpenEMR versions prior to 8.3.0 are vulnerable to a stored cross-site scripting (XSS) vulnerability located in interface/forms/eye_mag/report.php. The root cause is the application's failure to escape document notes, allowing authenticated users with write access to inject malicious JavaScript in...

EUVD-2026-119510

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eyemag/report.php that allows authenticated users to inject scripts by adding unescaped document notes. Attackers with document-note write access can store malicious JavaScript in a retina document note...

CVE-2026-124452 OpenEMR before 8.3.0 Stored XSS via Eye Exam Document Notes

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eyemag/report.php that allows authenticated users to inject scripts by adding unescaped document notes. Attackers with document-note write access can store malicious JavaScript in a retina document note...

PT-2026-139984

OpenEMR before 8.3.0 contains a broken object level authorization vulnerability in portal/report/portal custom report.php that allows authenticated portal patients to read other patients' problem list entries. Attackers can enumerate sequential IDs in issue parameter names to retrieve other...

CVE-2026-124452: openemr: OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eye_mag/report.php that…

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eyemag/report.php that allows authenticated users to inject scripts by adding unescaped document notes. Attackers with document-note write access can store malicious JavaScript in a retina document note...

PT-2026-139968

OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eye mag/report.php that allows authenticated users to inject scripts by adding unescaped document notes. Attackers with document-note write access can store malicious JavaScript in a retina document note...

CVE-2026-90841 PHPGurukul Blood Donor Management System Report Endpoint Report.php sql injection

A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /application/controllers/admin/Report.php of the component Report Endpoint. The manipulation of the argument fromdate/todate results in sql...

CVE-2026-90841

A SQL injection vulnerability in PHPGurukul Blood Donor Management System 1.0 affects the Report Endpoint (file /application/controllers/admin/Report.php). Manipulating the fromdate/todate arguments allows a remote, unauthenticated attacker to inject SQL, potentially compromising confidentiality,...

PT-2026-90845

Name of the Vulnerable Software and Affected Versions SourceCodester School Registration and Fee System version 1.0 Description A remote SQL injection is possible due to improper handling of the period argument within an unknown function in the /bilal/normal/pay report.php file. SQL injection is ...

CVE-2025-69935: Improper Neutralization of Special Elements used in an SQL Command

CodeAstro Membership Management System 1.0 is vulnerale to SQL Injection in the report.php and revenuereport.php via the fromDate parameter...

CVE-2026-51924

An issue in docuForm GmbH Client v.11.11c allows a remote attacker to execute arbitrary code via the file upload and report.php component . The vulnerability has been sighted in the wild, as indicated by sightings reported on July 1, 2026, and July 11, 2026. No specific remediation or exploit det...

CVE-2026-51924: Authorization Bypass Through User-Controlled Key

An issue in docuForm GmbH Client v.11.11c allows a remote attacker to execute arbitrary code via the file upload and report.php component...

CVE-2026-14796 CodeAstro Apartment Visitor Management System report.php sql injection

A vulnerability was found in CodeAstro Apartment Visitor Management System 1.0. This affects an unknown part of the file /apartment-visitor/report.php. Performing a manipulation of the argument fromdate results in sql injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2026-14796

CVE-2026-14796 affects CodeAstro Apartment Visitor Management System 1.0. Affected component: /apartment-visitor/report.php; vulnerability: SQL injection triggered by manipulating the fromdate parameter. Attackable remotely over network with no user interaction; attacker privileges required: LOW....