CVE-2024-51032

CVE-2024-51032 Description A Cross-site Scripting XSS vulnerability in managerecipient.php of Sourcecodester Toll Tax Management System 1.0 allows remote authenticated users to inject arbitrary web scripts via the "owner" input field. Vulnerability Type Cross Site Scripting XSS Vendor of Product...

CVE-2025-55579

CVE-2025-55579 - SolidInvoice Stored Cross-Site Scripting XSS in Tax Rates Summary SolidInvoice is vulnerable to a Stored Cross-Site Scripting XSS issue in the Tax Rates Feature. An authenticated attacker can inject arbitrary JavaScript into the application, which will then execute in users'...

CVE-2022-21661-Demo

This repository demonstrates a vulnerability in WordPress 5.8.2, in which missing sanitization in class-wp-tax-query.php can, in very specific situations, allow attackers to perform SQL injection. Note that successful exploitation requires developers to add vulnerable code to the WordPress...

CVE-2026-56826

Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only accesssetting could directly invoke destructive actions through the Livewire endpoint because...

CVE-2026-56826

The Shopper Headless e-commerce Admin Panel (versions 2.0.0 through 2.9.2 ) is vulnerable to missing function-level authorization. Four Livewire components in the Settings area—specifically ZoneShippingOptions, Zones izDetail, Taxes izDetail, and Taxes izTaxRates—perform destructive delete and ed...

Malicious code in crypto-tax-export (RubyGems)

Source: amazon-inspector d2481974cbcc361b29455129afea878124dafde18097efca0a87235df57f3bea The gem's native-extension build script ext/cryptotaxexport/extconf.rb runs during gem install. Before executing its payload it performs sandbox/analysis-evasion checks CI environment variables,...

MAL-2026-17782 Malicious code in crypto-tax-export (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2481974cbcc361b29455129afea878124dafde18097efca0a87235df57f3bea The gem's native-extension build script ext/cryptotaxexport/extconf.rb runs during gem install. Before executing its payload it performs...

CVE-2026-108700

1Panel-dev CordysCRM versions before 1.9.2 are vulnerable to a missing authorization flaw (CWE-862) within the /field/source/business-title endpoint. Authenticated users can perform a POST request to this endpoint without the required CONTRACT_BUSINESS_TITLE_READ permission. Successful exploitati...

EUVD-2026-96708

1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/business-title without permission checks. Users lacking CONTRACTBUSINESSTITLEREAD can retrieve organization invoicing entities,...

French Tax Data Theft Using Stolen Staff Passwords Went Undetected for Seven Weeks

An attacker used stolen passwords of staff at France's tax administration to take tax data on hundreds of thousands of taxpayers and businesses in June and July. Neither the tax administration nor France's national cybersecurity agency saw the data leave. The attack was not sophisticated, the...

PT-2026-98879

Name of the Vulnerable Software and Affected Versions InvoicePlane versions prior to 1.7.2 Description InvoicePlane exposes the delete and delete invoice tax functions within the Invoices module as state-changing routes that do not require a POST request or CSRF Cross-Site Request Forgery token...

Shopping privilege escalation through missing authorization in Settings components

Summary Four Livewire components in the Settings area expose destructive Filament actions delete / edit that perform no server-side authorization. Any authenticated user who can reach the Settings pages — i.e. holding only the coarse accesssetting permission, without being an admin and without an...

PT-2026-90542

Name of the Vulnerable Software and Affected Versions Shopper versions 2.0.0 through 2.9.1 Description Authenticated users with the access setting permission can perform unauthorized destructive actions via the Livewire endpoint. This occurs because four Livewire components in the Settings area d...

AiXamine: Unified Black-Box Evaluation of Cross-Dimensional Trade-Offs in LLM Safety, Security, and Privacy

The critical failure modes in deployed large language models LLMs are cross-dimensional: a model can score 99.3 in safety alignment while refusing one in three benign queries, or improve across every capability metric while losing 21 points in privacy. Existing evaluation frameworks that assess...

CVE-2026-70806

Vulnerability in the Oracle E-Business Tax product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle E-Business Tax...

EUVD-2026-61757

Vulnerability in the Oracle E-Business Tax product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle E-Business Tax...

CVE-2026-71101: Improper Access Control

Vulnerability in the Oracle HRMS US product of Oracle E-Business Suite component: US Payroll Tax Issues. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle HRMS US executes to...

CVE-2026-70806: Missing Authentication for Critical Function

Vulnerability in the Oracle E-Business Tax product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle E-Business Tax...

PT-2026-77801

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle E-Business Tax versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component of the Oracle E-Business Tax product allows a low-privileged attacker with access to the execution...

CVE-2026-72908 ERPNext: Possibility of SQL injection due to missing validation

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.109.0 and 16.20.0, the gettaxtemplate function in erpnext/accounts/doctype/taxrule/taxrule.py constructs an SQL WHERE clause from request-influenced postingdate and args values, allowing an authenticated low-privileg...