CVE-2026-10235 CodeAstro Ingredients Stock Management System stock_manager.php sql injection

A flaw has been found in CodeAstro Ingredients Stock Management System 1.0. This vulnerability affects unknown code of the file /Ingredients-Stock/stockmanager.php. This manipulation of the argument txtsearchcategory causes sql injection. The attack may be initiated remotely. The exploit has been...

MAL-2026-5163 Malicious code in @emcd-vue/auth (npm)

Part of a coordinated multi-package supply-chain attack impersonating EMCD emcd.io, a legitimate Russian cryptocurrency exchange and mining pool. The attacker registered the @emcd-vue npm scope to pose as an internal Vue.js front-end tooling package from "EMCD Platform Engineering." The package...

html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping

A flaw was found in html/template. A trusted template author could craft a script tag with an empty or whitespace-only 'type' attribute. This vulnerability causes the template engine to incorrectly escape data passed into the script block, potentially leading to cross-site scripting XSS. An...

html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping

A flaw was found in html/template. A trusted template author could craft a script tag with an empty or whitespace-only 'type' attribute. This vulnerability causes the template engine to incorrectly escape data passed into the script block, potentially leading to cross-site scripting XSS. An...

html/template: golang: html/template: Cross-site scripting due to incorrect script tag escaping

A flaw was found in html/template. A trusted template author could craft a script tag with an empty or whitespace-only 'type' attribute. This vulnerability causes the template engine to incorrectly escape data passed into the script block, potentially leading to cross-site scripting XSS. An...

PT-2026-45439

Name of the Vulnerable Software and Affected Versions LearnPress versions prior to 4.3.6 Description Improper neutralization of input during web page generation allows for Reflected Cross-Site Scripting XSS, a flaw where an application includes untrusted data in a web page without proper...

PT-2026-45551

Name of the Vulnerable Software and Affected Versions CodeAstro Payroll System version 1.0 Description Remote SQL injection is possible via the manipulation of the emp id argument within the '/home employee.php' endpoint. SQL injection is a technique where malicious SQL statements are inserted in...

📄 Espanso 2.3.0 Configuration Injection

This Python script is a configuration manipulation tool for Espanso version 2.3.0 that modifies its YAML configuration file base.yml to add new text triggers capable of executing system commands via shell or script extensions...

DMonitor 1.0.3 Outbound Connection / Port Configuration Auditor

This Python script is an outbound connection and port configuration auditor for DMonitor version 1.0.3...

CodeAstro Ingredients Stock Management System SQL Injection Vulnerability

The CodeAstro Ingredients Stock Management System is a inventory management system developed by CodeAstro Inc. Version 1.0 of the CodeAstro Ingredients Stock Management System has a SQL injection vulnerability. This vulnerability arises from incorrect operations with the parameter txtsearchcatego...

PT-2026-45422

A vulnerability was detected in CodeAstro Online Job Portal 1.0. The impacted element is an unknown function of the file /admin/jobs-admins/delete-jobs.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the attack remotely. The exploit is now...

PT-2026-45492

Name of the Vulnerable Software and Affected Versions Vitest versions prior to 4.1.0 Description A flaw in the UI/API server on Windows allows remote attackers to bypass file access restrictions and read arbitrary files when the server is exposed to the network. The issue occurs because the API...

Mozilla Firefox security vulnerabilities

Mozilla Firefox is an open-source web browser developed by the Mozilla Foundation in the United States. Versions of Mozilla Firefox prior to 151.2 contained security vulnerabilities. These vulnerabilities stemmed from Reader View incorrectly escaping HTML tags in JSON-LD metadata. This could allo...

LibreChat HTTP Request Handler XSS

The vulnerability of the HTTP GET Request Handler component of the LibreChat artificial intelligence-based platform is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

TOTOLINK A7100RU Router setLedCfg() Command Execution

The vulnerability of the setLedCfg function in the cgi-bin/cstecgi.cgi script of the TOTOLINK A7100RU router’s microprogramming software is related to the lack of measures taken to protect data at the control level. Exploiting this vulnerability could allow an attacker to execute arbitrary comman...

TOTOLINK A7100RU Router Arbitrary Command Execution

The vulnerability of the setPptpServerCfg function in the cgi-bin/cstecgi.cgi script of the TOTOLINK A7100RU router’s microprogramming system is related to the lack of measures taken at the control level to protect data. Exploiting this vulnerability could allow an attacker to execute arbitrary...

TOTOLINK A7100RU Router Command Execution

The vulnerability of the setWizardCfg function in the cgi-bin/cstecgi.cgi script of the TOTOLINK A7100RU router’s microprogramming software is related to the lack of measures taken to clean up data at the control level. Exploiting this vulnerability could allow a remote attacker to execute...

TOTOLINK A7100RU Router Arbitrary Command Execution

The vulnerability of the setUrlFilterRules function in the cgi-bin/cstecgi.cgi script of the TOTOLINK A7100RU router’s microprogramming system is related to the lack of measures taken at the management level to prevent data corruption. Exploiting this vulnerability could allow a remote attacker t...

TOTOLINK A7100RU Router Command Execution

The vulnerability of the setWanCfg function in the cgi-bin/cstecgi.cgi script of the TOTOLINK A7100RU router’s software is related to the lack of measures for cleaning input data. Exploiting this vulnerability could allow a remote attacker to execute arbitrary commands...

TOTOLINK A7100RU Router Arbitrary Command Execution

The vulnerability of the setIpQosRules function in the cgi-bin/cstecgi.cgi script of the TOTOLINK A7100RU router’s microprogramming software is related to the lack of measures taken at the management level to protect data. Exploiting this vulnerability could allow a remote attacker to execute...