CVE-2026-6336: Incorrect Authorization

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthorized user to view project import source information due to a missing authorization check...

PT-2026-65912

Name of the Vulnerable Software and Affected Versions kishan0725 Hospital Management System version 4.0 Description The software contains a SQL Injection flaw, which occurs when an application improperly handles user-supplied data in a database query, allowing an attacker to manipulate the query...

PT-2026-65923

Name of the Vulnerable Software and Affected Versions kishan0725 Hospital Management System version 4.0 Description An issue exists where the software is susceptible to SQL Injection, a technique that allows an attacker to interfere with the queries that an application makes to its database. This...

CVE-2025-69942

kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /hms/doctor/view-patient.php?viewid=1...

CVE-2025-69944

The kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection within the view-medhistory.php endpoint. The vulnerability is triggered via the viewid parameter, allowing for the improper neutralization of special elements used in an SQL command. Exploitation details are not provided...

CVE-2025-69944: Improper Neutralization of Special Elements used in an SQL Command

kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in the view-medhistory.php endpoint via the viewid parameter...

CVE-2025-69944

kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in the view-medhistory.php endpoint via the viewid parameter...

CVE-2025-69942

kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /hms/doctor/view-patient.php?viewid=1...

CVE-2026-66748 Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Field

Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows users with customfields manage permission to execute arbitrary Ruby code by supplying a malicious expression through the selecteval custom field type. Attackers can store an...

CVE-2026-66748 Camaleon CMS 2.1.1 - 2.9.1 Authenticated RCE via select_eval Custom Field

Camaleon CMS versions 2.1.1 through 2.9.1 contains an authenticated remote code execution vulnerability that allows users with customfields manage permission to execute arbitrary Ruby code by supplying a malicious expression through the selecteval custom field type. Attackers can store an...

CVE-2026-13871

An insufficient data validation flaw was found in the GuestView component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=497961376...

Zyxel VMG1312-B10D 5.13AAXA.8 - Local File Inclusion Detection

Zyxel VMG1312-B10D 5.13AAXA.8 is susceptible to local file inclusion. A remote unauthenticated attacker can send a specially crafted URL request containing "dot dot" sequences /../, conduct directory traversal attacks, and view arbitrary files. !/usr/bin/env python3 -- coding: utf-8 -- """Zyxel...

Tyto Sahi pro 7.x/8.x - Local File Inclusion Detection

Tyto Sahi Pro versions through 7.x.x and 8.0.0 are susceptible to a local file inclusion vulnerability in the web reports module which can allow an outside attacker to view contents of sensitive files. !/usr/bin/env python3 -- coding: utf-8 -- """Tyto Sahi Pro versions through 7.""" from...

Mitel MiCollab - Authentication Bypass Detection

A vulnerability in the NuPoint Unified Messaging NPM component of Mitel MiCollab through 9.8 SP1 FP2 9.8.1.201 could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input validation. A successful exploit could allow unauthorized access, enabling the...

Dashy <= 4.3.6 - Reflected XSS via Workspace Detection

Dashy versions up to 4.3.6 contain a reflected cross-site scripting vulnerability in the workspace view. The url query parameter is passed directly to an iframe src attribute without scheme validation, allowing an attacker to inject javascript: URIs that execute arbitrary JavaScript in the contex...

PrestaShop tshirtecommerce - Directory Traversal Detection

The Custom Product Designer tshirtecommerce module for PrestaShop allows HTTP requests to be forged using POST and GET parameters, enabling a remote attacker to perform directory traversal on the system and view the contents of code files. !/usr/bin/env python3 -- coding: utf-8 -- """The Custom...

WordPress Plugin Category Grid View Gallery 2.3.1 - Cross-Site Scripting Detection

A cross-site scripting vulnerability in includes/CatGridPost.php in the Category Grid View Gallery plugin 2.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ID parameter. !/usr/bin/env python3 -- coding: utf-8 -- """A cross-site scripting vulnerability in...

InterMapper - Exposure Detection

Detected unauthenticated InterMapper access, which could allow unauthorized users to view or interact with monitoring data without proper authentication. !/usr/bin/env python3 -- coding: utf-8 -- """Detected unauthenticated InterMapper access, which could allow unauthorized users to view or...

CVE-2026-18028

The "quick setup" view presented to users after they first create an event allows to set up the most critical parts of an event in just a few clicks. This view did not properly check that the user has permission to change configuration for the given event. An attacker could use a well-timed reque...

CVE-2026-18028

CVE-2026-18028 describes a missing authorization check in the "+quick setup+" view presented after creating an event. The flaw allows an attacker to send well-timed requests to perform privileged actions on events the user should not access, including creating products, quotas, configuring bank t...