CVE-2026-71483 Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View

Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html in employee/templates/employeenav.html without HTML neutralization. An external attacker can craft and deliver a link that causes JavaScript to execute when an...

PT-2026-99137

Name of the Vulnerable Software and Affected Versions Horilla versions prior to 1.6.0 Description An issue exists where the search parameter at the '/employee/employee-filter-view' endpoint is reflected via the jQuery .html method in the employee/templates/employee nav.html file without proper HT...

CVE-2026-71483: Improper Neutralization of Input During Web Page Generation

Horilla is an HR and CRM software. Prior to 1.6.0, the search parameter at /employee/employee-filter-view is reflected by jQuery .html in employee/templates/employeenav.html without HTML neutralization. An external attacker can craft and deliver a link that causes JavaScript to execute when an...

CVE-2026-89081

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-89081 Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

EUVD-2026-83477

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-89081: Improper Neutralization of Input During Web Page Generation

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search' parameter in all versions up to, and including, 4.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-86667 aircheng-org iWebShop-5 member.php member_list sql injection

A weakness has been identified in aircheng-org iWebShop-5 up to 5.15. The affected element is the function memberlist of the file controllers/member.php. This manipulation of the argument Search causes sql injection. The attack is possible to be carried out remotely. The exploit has been made...

CVE-2026-86667

A SQL injection vulnerability exists in aircheng-org iWebShop-5 (up to version 5.15), specifically in the member_list function within controllers/member.php. The flaw is triggered by manipulation of the Search argument , allowing a remote, authenticated attacker to execute arbitrary SQL queries. ...

CVE-2026-86667 aircheng-org iWebShop-5 member.php member_list sql injection

A weakness has been identified in aircheng-org iWebShop-5 up to 5.15. The affected element is the function memberlist of the file controllers/member.php. This manipulation of the argument Search causes sql injection. The attack is possible to be carried out remotely. The exploit has been made...

CVE-2026-85397

A vulnerability was determined in code-projects Hospital Information System 1.0. This impacts the function findBySearch of the file addReq.php. This manipulation of the argument Search causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed an...

CVE-2026-85397

A SQL injection vulnerability exists in code-projects Hospital Information System 1.0 , specifically in the findBySearch function within addReq.php . An unauthenticated remote attacker can manipulate the Search argument to inject arbitrary SQL, leading to low-impact compromise of confidentiality,...

EUVD-2026-70859

A vulnerability was determined in code-projects Hospital Information System 1.0. This impacts the function findBySearch of the file addReq.php. This manipulation of the argument Search causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed an...

CVE-2026-82664 yaojingang GEOFlow JSON-LD Theme HomeController.php cross site scripting

A security vulnerability has been detected in yaojingang GEOFlow up to 2.1.0. This affects an unknown part of the file app/Http/Controllers/Site/HomeController.php of the component JSON-LD Theme Handler. The manipulation of the argument Search leads to cross site scripting. The attack is possible...

Exploit for CVE-2026-76569

Reflected XSS via search GET Parameter in Phoca Download Ph...

CVE-2026-82613 itsourcecode Online Medicine Delivery System Product Search index.php loadResultList sql injection

A vulnerability was detected in itsourcecode Online Medicine Delivery System 1.0. This affects the function loadResultList of the file /index.php?q=product of the component Product Search Interface. Performing a manipulation of the argument Search results in sql injection. The attack may be...

CVE-2026-78691

Improper Neutralization of Special Elements in Data Query Logic vulnerability in ash-project ashsql allows a user who supplies a search term to contains/2, stringstartswith/2, or stringendswith/2 to inject live SQL LIKE wildcards, turning a literal substring search into an attacker-controlled...

EUVD-2026-64668

A vulnerability was determined in code-projects Barangay Resident Profiling Management System 1.0. Affected is an unknown function of the file residents.php of the component Resident Search Functionality. This manipulation of the argument Search causes sql injection. Remote exploitation of the...

CVE-2026-78143

A vulnerability was determined in code-projects Barangay Resident Profiling Management System 1.0. Affected is an unknown function of the file residents.php of the component Resident Search Functionality. This manipulation of the argument Search causes sql injection. Remote exploitation of the...

CVE-2026-78143

A SQL injection vulnerability exists in the Barangay Resident Profiling Management System 1.0 (code-projects), specifically in the Resident Search Functionality within the file residents.php. The unsanitized Search argument allows a remote, unauthenticated attacker to inject SQL commands. The exp...