CVE-2026-93972: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in SourceCodester Online Reviewer Management System 1.0. The affected element is an unknown function of the file /reviewer0/admins/assessments/course/btnfunctions.php. Such manipulation of the argument courseID leads to sql injection. It is possible to...

CVE-2026-93974: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in SourceCodester Online Reviewer Management System 1.0. This affects an unknown function of the file /reviewer0/admins/assessments/databank/btnfunctions.php?action=remove. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched...

CVE-2026-93980: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in code-projects Internship Management System 1.0. This vulnerability affects unknown code of the file /admin/login.php of the component Admin Login Form. Executing a manipulation of the argument Password can lead to sql injection. The attack may be performed from...

PT-2026-95953

Name of the Vulnerable Software and Affected Versions code-projects Internship Management System version 1.0 Description A SQL injection flaw exists in the Admin Login Form component within the /admin/login.php endpoint. A remote attacker can exploit this by manipulating the Password variable,...

PT-2026-95951

Name of the Vulnerable Software and Affected Versions code-projects Internship Management System version 1.0 Description A remote SQL injection exists in the /login.php endpoint. This issue occurs when the Password variable is manipulated, allowing an attacker to interfere with the database...

CVE-2026-91847

The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actions, allowing any unauthenticated visitor to read another visitor's assistant messages and ...

EUVD-2026-83509

The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actions, allowing any unauthenticated visitor to read another visitor's assistant messages and ...

CVE-2026-88926 VikRentItems Flexible Rental Management System < 1.2.4 - Unauthenticated SQLi

The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before using them in SQL statements, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-88926

The VikRentItems Flexible Rental Management System WordPress plugin, in versions before 1.2.4 , is vulnerable to an unauthenticated SQL injection attack. The root cause is the failure to properly sanitise and escape certain parameters before including them in SQL statements. This allows remote, u...

EUVD-2026-83508

The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before using them in SQL statements, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-88926 VikRentItems Flexible Rental Management System < 1.2.4 - Unauthenticated SQLi

The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before using them in SQL statements, allowing unauthenticated users to perform SQL injection attacks...

EUVD-2026-83459

SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted notebooks or call administrative endpoints to inject malicious style values that execute in the Electron renderer with fu...

CVE-2026-93923

SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted notebooks or call administrative endpoints to inject malicious style values that execute in the Electron renderer with fu...

CVE-2026-88926: Improper Neutralization of Special Elements used in an SQL Command

The VikRentItems Flexible Rental Management System WordPress plugin before 1.2.4 does not sanitise and escape some of its parameters before using them in SQL statements, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-93922: Improper Neutralization of Input During Web Page Generation

SiYuan through 3.8.4 renders notebook names as raw HTML in the Daily Note picker dialog without escaping, allowing stored cross-site scripting in the Electron renderer. Attackers can create notebooks with HTML payloads in names that execute JavaScript with Node.js access when the picker opens,...

PT-2026-95762

Name of the Vulnerable Software and Affected Versions Online Scheduling and Appointment Booking System WordPress plugin versions prior to 28.2 Description The plugin fails to verify if the requester is the owner of the AI booking-assistant conversation during unauthenticated conversation actions...

PT-2026-95779

Name of the Vulnerable Software and Affected Versions SSL Zen — SSL Certificate Installer & HTTPS Redirects versions prior to 4.7.43 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting XSS, a technique where...

CVE-2026-91847: Authorization Bypass Through User-Controlled Key

The Online Scheduling and Appointment Booking System WordPress plugin before 28.2 does not verify that the requester owns the AI booking-assistant conversation named in its unauthenticated conversation actions, allowing any unauthenticated visitor to read another visitor's assistant messages and ...

CVE-2026-93923: Improper Neutralization of Input During Web Page Generation

SiYuan through 3.8.4 fails to escape heading style attributes when rendering outline and bookmark dock HTML, allowing stored cross-site scripting. Attackers can supply crafted notebooks or call administrative endpoints to inject malicious style values that execute in the Electron renderer with fu...

PT-2026-95761

Name of the Vulnerable Software and Affected Versions VikRentItems Flexible Rental Management System WordPress plugin versions prior to 1.2.4 Description Unauthenticated users can perform SQL injection attacks because the plugin fails to sanitize and escape certain parameters before incorporating...