297113 matches found
CVE-2026-49400 October CMS: PHP Object Injection via Backend Widget Session Storage
October System provides the system module for October Content Management System. Prior to versions 3.7.17 and 4.2.21, the backend SessionMaker trait stored widget session state as base64serialize... and consumed it with unserialize without an allowedclasses restriction. Any code path that could...
CVE-2026-49400
October System provides the system module for October Content Management System. Prior to versions 3.7.17 and 4.2.21, the backend "SessionMaker" trait stored widget session state as "base64serialize..." and consumed it with "unserialize" without an "allowedclasses" restriction. Any code path that...
CVE-2026-90805 subhajitkhan online-clinic-management-system doctorlogin.php sql injection
A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown part of the file doctorlogin.php. Executing a manipulation of the argument docmail/docpswd can lead to sql injection. The attack can be executed remotely...
CVE-2026-90805 subhajitkhan online-clinic-management-system doctorlogin.php sql injection
A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown part of the file doctorlogin.php. Executing a manipulation of the argument docmail/docpswd can lead to sql injection. The attack can be executed remotely...
CVE-2026-90805 subhajitkhan online-clinic-management-system doctorlogin.php sql injection
A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown part of the file doctorlogin.php. Executing a manipulation of the argument docmail/docpswd can lead to sql injection. The attack can be executed remotely...
CVE-2026-90805
A SQL injection vulnerability exists in the doctorlogin.php file of subhajitkhan online-clinic-management-system (a GitHub-hosted project). By manipulating the doc_mail and doc_pswd arguments, an unauthenticated remote attacker can inject SQL commands. The CVSS 3.1 score is 7.3 (High) with low im...
EUVD-2026-77681
A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. This affects an unknown part of the file doctorlogin.php. Executing a manipulation of the argument docmail/docpswd can lead to sql injection. The attack can be executed remotely...
Deserialization of Untrusted Data
Overview october/system is a System module for October CMS. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the SessionMaker process. An attacker can execute arbitrary PHP code by injecting a crafted serialized payload into the widget. session key, which i...
CVE-2026-46696
October System provides the system module for October Content Management System. Versions prior to 3.7.17 and 4.2.21 have a vulnerability in the Twig sandbox security policy that allowed a chained bypass when "cms.safemode" is enabled. The Laravel session store was exposed to Twig with unrestrict...
CVE-2026-90795
A vulnerability was determined in itsourcecode Loan Management System 1.0. The impacted element is an unknown function of the file navbar.php. Executing a manipulation of the argument page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicl...
CVE-2026-57124
PraisonAI is a multi-agent teams system. Prior to 4.6.59, the default UI host applications expose POST /api/mcp/connect without mandatory authentication and accept caller-controlled command and args values that PraisonAIUI passes to StdioMCPClient to start a local process. Because the UI commands...
UBUNTU-CVE-2026-90995
A flaw was found in SSSD System Security Services Daemon. A local attacker with privileges to connect to the PAM Pluggable Authentication Modules responder socket can send a specially crafted protocol request. If the pamappservices configuration is enabled and the service item is omitted from the...
CVE-2026-90995
A flaw was found in SSSD System Security Services Daemon. A local attacker with privileges to connect to the PAM Pluggable Authentication Modules responder socket can send a specially crafted protocol request. If the pamappservices configuration is enabled and the service item is omitted from the...
Access Control Bypass
Overview october/system is a System module for October CMS. Affected versions of this package are vulnerable to Access Control Bypass in the cms.safemode process. An attacker can gain unauthorized access to sensitive database information and impersonate other backend users by chaining method call...
EUVD-2026-77616
A vulnerability was identified in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/company/index.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used...
CVE-2026-90796 itsourcecode Leave Management System index.php sql injection
A vulnerability was identified in itsourcecode Leave Management System 1.0. This affects an unknown function of the file /module/company/index.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used...
CVE-2026-90795 itsourcecode Loan Management System navbar.php cross site scripting
A vulnerability was determined in itsourcecode Loan Management System 1.0. The impacted element is an unknown function of the file navbar.php. Executing a manipulation of the argument page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicl...
CVE-2026-90795
itsourcecode Loan Management System 1.0 contains a cross-site scripting (XSS) vulnerability in navbar.php , triggered by manipulation of the page argument. The attack can be launched remotely over the network with no authentication required , though user interaction is needed to execute the scrip...
EUVD-2026-77582
A vulnerability was determined in itsourcecode Loan Management System 1.0. The impacted element is an unknown function of the file navbar.php. Executing a manipulation of the argument page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicl...
CVE-2026-90795 itsourcecode Loan Management System navbar.php cross site scripting
A vulnerability was determined in itsourcecode Loan Management System 1.0. The impacted element is an unknown function of the file navbar.php. Executing a manipulation of the argument page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicl...