104 matches found
CVE-2026-100371
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, an authorization guard to Users::changepassword, was added to address a previous authorization flaw that allowed a secondary administrator usertype=1, userid != 1 to directly chan...
CVE-2026-100371: Incorrect Authorization
InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. In version 1.7.2, an authorization guard to Users::changepassword, was added to address a previous authorization flaw that allowed a secondary administrator usertype=1, userid != 1 to directly chan...
CVE-2026-90789
A weakness has been identified in itsourcecode Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /login.php. Executing a manipulation of the argument useremail can lead to sql injection. The attack may be launched remotely. The exploit has been made...
EUVD-2026-77526
A weakness has been identified in itsourcecode Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /login.php. Executing a manipulation of the argument useremail can lead to sql injection. The attack may be launched remotely. The exploit has been made...
CVE-2026-90789
itsourcecode Leave Management System 1.0 is affected by a SQL injection vulnerability in /login.php . By manipulating the user_email parameter, an unauthenticated remote attacker can inject SQL commands. The CVSS 3.1 score is 7.3 (HIGH) with low impact on confidentiality, integrity, and availabil...
CVE-2026-90789 itsourcecode Leave Management System login.php sql injection
A weakness has been identified in itsourcecode Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /login.php. Executing a manipulation of the argument useremail can lead to sql injection. The attack may be launched remotely. The exploit has been made...
CVE-2026-90789 itsourcecode Leave Management System login.php sql injection
A weakness has been identified in itsourcecode Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /login.php. Executing a manipulation of the argument useremail can lead to sql injection. The attack may be launched remotely. The exploit has been made...
CVE-2026-90789: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in itsourcecode Leave Management System 1.0. Affected by this issue is some unknown functionality of the file /login.php. Executing a manipulation of the argument useremail can lead to sql injection. The attack may be launched remotely. The exploit has been made...
CVE-2026-32821 API Collection Impersonation Via user_email And Missing Object- Level Authorization
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any authenticated API user who has their own access token can ask the...
CVE-2026-32821 API Collection Impersonation Via user_email And Missing Object- Level Authorization
dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any authenticated API user who has their own access token can ask the...
CVE-2026-8787: Improper Privilege Management
The Firebase Support & Chat Management plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.1.1. This is due to the firebaseauth function authenticating the request as the WordPress user whose email is supplied in the useremail POST parameter without...
CVE-2026-4235
A weakness has been identified in itsourcecode Online Enrollment System 1.0. This issue affects some unknown processing of the file /sms/login.php. This manipulation of the argument useremail causes sql injection. The attack is possible to be carried out remotely. The exploit has been made...
CVE-2026-4235: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in itsourcecode Online Enrollment System 1.0. This issue affects some unknown processing of the file /sms/login.php. This manipulation of the argument useremail causes sql injection. The attack is possible to be carried out remotely. The exploit has been made...
CVE-2019-25542
Netartmedia Real Estate Portal 5.0 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the useremail parameter. Attackers can send POST requests to index.php with malicious payloads in the useremail field to...
Netartmedia Real Estate Portal SQL注入漏洞
Netartmedia Real Estate Portal is a real estate transaction website system operated by the Bulgarian company Netartmedia. Version 5.0 of Netartmedia Real Estate Portal has a SQL injection vulnerability. This vulnerability stems from the useremail parameter, which allows for SQL injections,...
CVE-2019-25542: Improper Neutralization of Special Elements used in an SQL Command
Netartmedia Real Estate Portal 5.0 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the useremail parameter. Attackers can send POST requests to index.php with malicious payloads in the useremail field to...
EUVD-2026-5726
A flaw has been found in SourceCodester Online Class Record System 1.0. Affected by this issue is some unknown functionality of the file /admin/login.php. This manipulation of the argument useremail causes sql injection. The attack may be initiated remotely. The exploit has been published and may...
CVE-2026-2087: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in SourceCodester Online Class Record System 1.0. Affected by this issue is some unknown functionality of the file /admin/login.php. This manipulation of the argument useremail causes sql injection. The attack may be initiated remotely. The exploit has been published and may...
