PT-2026-95941

Name of the Vulnerable Software and Affected Versions SourceCodester Online Reviewer Management System version 1.0 Description A remote SQL injection is possible due to improper handling of the ID variable within the /reviewer 0/admins/assessments/subject/btn functions.php?action=remove endpoint...

PT-2026-95970

Name of the Vulnerable Software and Affected Versions WatchDog Anti-Virus version 1.8.640 Description Improper link resolution during the quarantine restoration process on Windows allows a local, low-privileged attacker to write a quarantined file to an arbitrary filesystem location. This is...

CVE-2026-93963: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/department/controller.php. The manipulation of the argument DEPTID leads to sql injection. The attack can be initiated remotely. The exploit has been...

PT-2026-95954

Name of the Vulnerable Software and Affected Versions SourceCodester Drug Recommendation System version 1.0 Description A SQL injection flaw exists in the /Admin/edit symptom.php endpoint. This issue occurs when the ID argument is manipulated, allowing a remote attacker to execute arbitrary SQL...

PT-2026-95978

Name of the Vulnerable Software and Affected Versions SourceCodester Drug Recommendation System version 1.0 Description Cross site scripting XSS occurs when an application includes untrusted data in a web page without proper validation or escaping, allowing an attacker to execute malicious script...

CVE-2026-94042: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in AdithyaYelloju Restaurant Management System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This affects the function mysqliquery of the file admin/addtable.php. The manipulation of the argument table/members/price results in sql injection. It is possible to launch th...

PT-2026-95997

Name of the Vulnerable Software and Affected Versions AdithyaYelloju Restaurant Management System versions up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c Description Remote SQL injection is possible through the manipulation of the table/members/price argument. This issue occurs within the mysqli...

PT-2026-95983

Name of the Vulnerable Software and Affected Versions AdithyaYelloju Restaurant-Management-System versions up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c Description Remote SQL injection is possible through the manipulation of the item, price, image, or type arguments within the 'admin/add...

PT-2026-95951

Name of the Vulnerable Software and Affected Versions code-projects Internship Management System version 1.0 Description A remote SQL injection exists in the /login.php endpoint. This issue occurs when the Password variable is manipulated, allowing an attacker to interfere with the database...

CVE-2026-94041: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. Affected by this issue is some unknown functionality of the file admin/addmenu.php. The manipulation of the argument item/price/image/type leads to sql injection. It is...

PT-2026-96005

Name of the Vulnerable Software and Affected Versions CodeAstro QR Code Attendance Management System version 1.0 Description Improper privilege management exists in the Save function within the app/Controllers/UserController.php file. A remote attacker can manipulate the role id argument to gain...

PT-2026-95977

Name of the Vulnerable Software and Affected Versions SourceCodester Drug Recommendation System version 1.0 Description An issue exists in the Password Change component within the file '/drug recommender/Admin/change password'. Remote attackers can perform cross-site scripting XSS—a technique use...

CVE-2026-94034: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /drugrecommender/Admin/changepassword of the component Password Change. Performing a manipulation of the argument txtoldpassword/txtnewpassword results in cross site...

CVE-2026-94033: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in SourceCodester Drug Recommendation System 1.0. This vulnerability affects unknown code of the file /drugrecommender/Admin/adduser of the component User Management. Such manipulation of the argument txtname/txtemail/txtpassword leads to cross site scripting. It is...

CVE-2026-91847

The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actions, allowing any unauthenticated visitor to read another visitor's assistant messages and ...

EUVD-2026-83509

The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actions, allowing any unauthenticated visitor to read another visitor's assistant messages and ...

EUVD-2026-83508

The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before using them in SQL statements, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-88926

The VikRentItems Flexible Rental Management System WordPress plugin, in versions before 1.2.4 , is vulnerable to an unauthenticated SQL injection attack. The root cause is the failure to properly sanitise and escape certain parameters before including them in SQL statements. This allows remote, u...

CVE-2026-88926 VikRentItems Flexible Rental Management System < 1.2.4 - Unauthenticated SQLi

The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before using them in SQL statements, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-88926 VikRentItems Flexible Rental Management System < 1.2.4 - Unauthenticated SQLi

The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before using them in SQL statements, allowing unauthenticated users to perform SQL injection attacks...