CVE-2026-105232: Improper Neutralization of Special Elements used in an SQL Command

A flaw has been found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The impacted element is an unknown function of the file delivery/deliverysignup.php of the component Registration Page. This manipulation of the...

metasploitable2-red-team-assessment

Red Team Assessment — Metasploitable 2 Type: Authorized P...

higernes

higernes Python으로 작성된 수동적 OSINT 툴킷. API 키도, 계정도, 어디에도 로깅도 없다. 핸들, 이메일, 도메인, IP, 전화번호 또는 해시를 지정하면 이미 공개된 정보를 파헤친다. 무엇을 하는가 6개의 모듈, 모두 공개 엔드포인트를 읽는다: 모듈| 얻을 수 있는 것 ---|--- username| 핸들을 약 700개 사이트WhatsMyName 데이터셋에 걸쳐 훑으며, 적중이 들어오는 대로 실시간 갱신 email| 구문, MX, 일회용 여부 검사, gravatar, 그다음 @ 앞부분을 username으로 ...

CVE-2026-105124

The W (vincent-peugnet/wcms) content management system, versions through 3.18.0 , is vulnerable to unauthenticated stored XSS . The root cause is the lack of input sanitization in the login user field and the visitor comment website field . Attackers can inject scripts via failed login attempts, ...

CVE-2026-105124 W (wcms) through 3.18.0 Unauthenticated Stored XSS via Login Username and Comments

W vincent-peugnet/wcms through 3.18.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the login user field and visitor comment website field. Attackers can submit failed logins rendered unescaped in the adminlog.php log viewer, or...

CVE-2026-105124 W (wcms) through 3.18.0 Unauthenticated Stored XSS via Login Username and Comments

W vincent-peugnet/wcms through 3.18.0 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts via the login user field and visitor comment website field. Attackers can submit failed logins rendered unescaped in the adminlog.php log viewer, or...

EUVD-2026-91949

The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code...

CVE-2026-96962

The Pie Register WordPress plugin (versions prior to 3.8.4.14 ) contains a vulnerability where it fails to restrict access to an invitation-code report . This flaw allows unauthenticated visitors to obtain the usernames and email addresses of all users who registered using a specific, known invit...

CVE-2026-96962: Exposure of Sensitive Information to an Unauthorized Actor

The Pie Register WordPress plugin before 3.8.4.14 does not restrict access to an invitation-code report, allowing unauthenticated visitors who know a valid invitation code to obtain the username and email address of every user who registered with that code...

PT-2026-104535

Name of the Vulnerable Software and Affected Versions The Pie Register WordPress plugin versions prior to 3.8.4.14 Description The plugin fails to restrict access to an invitation-code report. This allows unauthenticated visitors who possess a valid invitation code to retrieve the usernames and...

CVE-2026-104872 Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute

OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose,...

Vulnerability of endpoints /api/v1/user/orgs and /api/v1/users/{username}/orgs/{org}/permissions of the Git repository management system Gitea, allowing attackers to disclose sensitive information

The vulnerability of endpoints /api/v1/user/orgs and /api/v1/users/username/orgs/org/permissions in the Git repository management system Gitea is related to access control deficiencies. Exploiting this vulnerability could allow a malicious actor to disclose sensitive information...

CVE-2026-104872: Insertion of Sensitive Information into Log File

OpenTelemetry JavaScript Contrib provides instrumentation libraries for collecting telemetry from JavaScript applications. Prior to versions 0.66.0 of @opentelemetry/instrumentation-cassandra-driver, 0.65.0 of @opentelemetry/instrumentation-knex, 0.67.0 of @opentelemetry/instrumentation-mongoose,...

GO-2026-6619 Portainer CE allows username enumeration through authentication response timing in github.com/portainer/portainer

Portainer CE allows username enumeration through authentication response timing in github.com/portainer/portainer...

GO-2026-6558 Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle

Traefik: BasicAuth singleflight coalescing reintroduces an unauthenticated username-enumeration timing oracle. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports fr...

CVE-2026-103539

A weakness has been identified in ZongXR SuperMarket 1.0.0.0. This affects the function startBuy of the file instant-buy/src/main/java/com/supermarket/instantbuy/controller/InstantBuyController.java of the component Instant Buy. Executing a manipulation of the argument Username can lead to missin...

CVE-2026-103539 ZongXR SuperMarket Instant Buy InstantBuyController.java startBuy missing authentication

A weakness has been identified in ZongXR SuperMarket 1.0.0.0. This affects the function startBuy of the file instant-buy/src/main/java/com/supermarket/instantbuy/controller/InstantBuyController.java of the component Instant Buy. Executing a manipulation of the argument Username can lead to missin...

EUVD-2026-90496

A weakness has been identified in ZongXR SuperMarket 1.0.0.0. This affects the function startBuy of the file instant-buy/src/main/java/com/supermarket/instantbuy/controller/InstantBuyController.java of the component Instant Buy. Executing a manipulation of the argument Username can lead to missin...

Linux Distros Unpatched Vulnerability : CVE-2026-102586

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting XS...

CVE-2026-103539: Missing Authentication for Critical Function

A weakness has been identified in ZongXR SuperMarket 1.0.0.0. This affects the function startBuy of the file instant-buy/src/main/java/com/supermarket/instantbuy/controller/InstantBuyController.java of the component Instant Buy. Executing a manipulation of the argument Username can lead to missin...