Overview of incoming advisories.
2019 results found
The MemberDash plugin for WordPress contains a critical Insecure Direct Object Reference (IDOR) vulnerability in all versions up to and including 1.8.5. The flaw exists in the 'id' parameter due to missing validation on a user-controlled key during registration. Unauthenticated attackers can exploit this vulnerability to change the password of any WordPress user, including administrators, by supplying an arbitrary user ID. This allows complete account takeover without any notification being sent to the victim. The vulnerability requires no authentication, making it trivially exploitable by remote attackers. The impact is severe as it enables full compromise of WordPress sites running the affected plugin version. Site administrators are advised to update to a patched version immediately.
View original advisory →A SQL injection vulnerability has been identified in SourceCodester Class and Exam Timetabling System version 1.0. The vulnerability exists in the /delete_user_account.php file, where manipulation of the 'ID' argument allows SQL injection attacks. The flaw can be exploited remotely without requiring physical access to the target system. A public exploit has already been disclosed, increasing the risk of active exploitation. The vulnerability affects an unknown functionality within the targeted file. Attackers could potentially manipulate database queries to gain unauthorized access or extract sensitive data. The issue has been documented in VulDB and tracked under CVE-2026-86210. Users of the affected system are advised to apply patches or mitigations promptly.
View original advisory →CVE-2026-86242 affects Bifrost HTTP transport versions before 2.0.0, allowing unauthenticated remote code execution via a malicious plugin submission to POST /api/plugins when management authentication is disabled (the default configuration). The vulnerability arises because the shared-object loader accepts HTTP URLs as plugin paths, downloads them as .so files, and loads them via Go's plugin.Open, executing any Init function as the Bifrost process user. On dynamically linked builds (DYNAMIC=1), this results in full unauthenticated RCE. On the published statically linked Docker image, the attack is limited to server-side request forgery (SSRF) since plugin.Open fails. Attack complexity is rated High due to constraints around matching Go version, OS, architecture, and linkage. The 1.6.x branch through 1.6.11 does not contain the fix. The fix is available in version 2.0.0 of the HTTP transport.
View original advisory →A SQL injection vulnerability has been identified in the Mstfakts College-Management-System, specifically in the mysqli_query function within the file Front-end/university.php under the Search Handler component. The vulnerability is triggered by manipulating the book_name or book_author arguments, allowing an attacker to perform SQL injection remotely. A public exploit is available, increasing the risk of exploitation. The product uses a rolling release model, so no specific version information is disclosed for affected or patched releases. The vendor was notified via a GitHub issue report but has not yet responded. The vulnerability has been catalogued in VulDB and NVD. No patch or mitigation has been confirmed at this time, leaving users exposed.
View original advisory →A SQL injection vulnerability has been identified in code-projects Content Management System version 1.0. The flaw exists in the /login.php file where manipulation of the user_name parameter allows SQL injection attacks. The vulnerability can be exploited remotely without authentication. A public exploit has already been released, increasing the risk of active exploitation. The issue stems from insufficient input validation on the user_name argument. Attackers could potentially bypass authentication or extract sensitive database information. The vulnerability has been assigned CVE-2026-86168 and is listed in the NVD database. Users of the affected CMS version are advised to apply patches or mitigations immediately.
View original advisory →A SQL injection vulnerability has been identified in SourceCodester Class and Exam Timetabling System version 1.0. The vulnerability exists in the mysqli_query function within the file /admin/modal_add_course.php, where manipulation of the 'course' argument leads to SQL injection. The attack can be executed remotely without requiring physical access to the system. A public exploit is already available, increasing the risk of active exploitation. The vulnerability affects the administrative interface of the timetabling application. Attackers could potentially access, modify, or delete database contents. Given the public availability of the exploit and remote exploitability, this poses a significant risk to any organization using this software.
View original advisory →A buffer overflow vulnerability has been identified in the Tenda HG10 router (firmware version 300001138). The flaw exists in the formWanRedirect function within the /boaform/formWanRedirect file, part of the Boa Web Server component. An attacker can exploit this vulnerability by manipulating the 'if' argument to trigger a buffer overflow condition. The attack can be launched remotely without requiring physical access to the device. A public exploit has already been disclosed, increasing the risk of active exploitation. This vulnerability poses a significant risk to users of the affected Tenda HG10 device. The issue has been catalogued in VulDB and the National Vulnerability Database. IoT and home networking devices such as this are commonly targeted due to limited patch adoption by end users.
View original advisory →A SQL injection vulnerability has been identified in SourceCodester Online Voting System version 1.0. The flaw exists in the /ajax.php?action=save_user file, where manipulation of the 'ID' argument allows for SQL injection attacks. The vulnerability can be exploited remotely without requiring physical access to the system. A public exploit has already been published and is available for use by threat actors. The issue affects an unknown function within the identified file. This type of vulnerability can allow attackers to read, modify, or delete database contents, potentially compromising the integrity of voting data. The vulnerability has been catalogued in VulDB and NVD databases. Given the sensitive nature of online voting systems, exploitation could have significant implications for election integrity.
View original advisory →The HivePress Authentication plugin for WordPress (versions up to and including 1.1.4) contains a critical authentication bypass vulnerability via the access_token parameter. The flaw exists in the authenticate_user function's Facebook authenticator, which forwards attacker-supplied access tokens to the Facebook Graph API and blindly trusts the returned email and ID without validating the application ID or audience. No /debug_token verification is performed, and the token's app_id is never compared against the configured hp_facebook_app_id. This allows unauthenticated attackers to impersonate any WordPress user, including administrators, if the victim's email is linked to a Facebook account. Exploitation requires the attacker to obtain a valid Facebook access token for the victim. A patch has been committed to the plugin repository addressing the missing token validation logic.
View original advisory →A SQL injection vulnerability has been identified in SourceCodester Class and Exam Timetabling System version 1.0. The vulnerability exists in the mysqli_query function within the file /admin/modal_add_product.php. An attacker can exploit this vulnerability by manipulating the 'fname' argument to execute arbitrary SQL commands. The attack can be carried out remotely without requiring physical access to the system. A public exploit has already been disclosed, increasing the risk of active exploitation. The vulnerability affects the database interaction layer of the application, potentially exposing sensitive data. This issue is tracked under CVE-2026-86224 and has been documented on NVD, VulDB, and GitHub.
View original advisory →A SQL injection vulnerability has been identified in SourceCodester Class and Exam Timetabling System version 1.0. The vulnerability exists in the mysqli_query function within the file /admin/modal_add_room.php. An attacker can manipulate the room_name argument to inject malicious SQL code. The attack can be executed remotely without requiring physical access to the target system. A public exploit is already available, increasing the risk of active exploitation. The vulnerability affects the database layer of the application, potentially allowing unauthorized data access or manipulation. Users of this system are advised to apply patches or mitigations immediately given the public availability of the exploit.
View original advisory →A vulnerability was identified in Tenda CP3 firmware version 27.5.57.101 affecting the function sub_2F77E8 in the file Apis/system.c within the Network Configuration Management component. The flaw allows attackers to perform OS command injection through manipulation of the affected function. The attack can be initiated remotely without requiring physical access to the device. This type of vulnerability is particularly dangerous as it can allow full system compromise via arbitrary command execution. The affected product is a networking device manufactured by Tenda, a Chinese networking hardware company. No patch or mitigation details are mentioned in the article. The vulnerability has been assigned CVE-2026-86151 and is tracked in both NVD and VulDB databases.
View original advisory →OpenMAIC versions before 1.0.1 contain a Server-Side Request Forgery (SSRF) vulnerability that bypasses validation in non-production builds. Unauthenticated attackers can supply arbitrary provider URLs through the x-base-url header or baseUrl parameter. This allows attackers to reach cloud instance metadata services and access sensitive cloud credentials. The vulnerability exists due to environment-gated URL validation being skipped outside of production environments. The fix was introduced in OpenMAIC version 1.0.1. The issue affects the image generation API route and middleware components. Exploitation could lead to exposure of sensitive cloud infrastructure credentials and metadata. No authentication is required to exploit this vulnerability, increasing its severity.
View original advisory →A SQL injection vulnerability has been identified in rabindralamsal's inventory-management-system version 1.0.0. The flaw exists in the index.php file within the Login component, where manipulation of the username and/or password arguments can lead to SQL injection. The vulnerability is remotely exploitable, meaning an attacker does not need local access to the system. A public exploit has already been published, increasing the risk of active exploitation. The affected product is a web-based inventory management application. No authentication is required to exploit the vulnerability, as it resides in the login functionality. This represents a significant risk to organizations running this software version.
View original advisory →CVE-2022-51009 affects PocketMine-MP versions before 4.7.2, where improper exception handling in the adhocore/json-comment library leads to a denial-of-service vulnerability. Attackers can exploit this by sending malformed login or skin packets containing invalid JSON geometry data. This triggers an unhandled RuntimeException that causes the game server to crash. The vulnerability requires no authentication, making it trivially exploitable by any network-reachable attacker. The fix was introduced in PocketMine-MP version 4.7.2. A patch commit is available on GitHub along with a published security advisory. The issue highlights risks associated with insufficient input validation and exception handling in third-party library integrations. Server operators are advised to upgrade immediately to mitigate the risk of targeted denial-of-service attacks.
View original advisory →The Frontend Admin by DynamiApps plugin for WordPress (versions up to and including 3.29.12) contains a critical authentication bypass vulnerability allowing unauthenticated attackers to perform full account takeover. The flaw resides in the pre_update_value function, which lacks capability or ownership checks, and in ActionPost::conditions_logic(), which short-circuits its authorization gate when the post ID is non-numeric (e.g., 'user_1'). This allows unauthenticated form submissions to be routed to arbitrary user records. An attacker can overwrite any user's registered email address, including administrators, and then exploit WordPress's native password-reset flow to fully compromise the targeted account. No authentication is required to exploit this vulnerability. A patch was released in changeset 3664865. The vulnerability is tracked by Wordfence and published on NVD.
View original advisory →A SQL injection vulnerability has been identified in SourceCodester Class and Exam Timetabling System version 1.0. The vulnerability exists in the /delete_user.php file, where manipulation of the 'ID' argument allows SQL injection attacks. The vulnerability can be exploited remotely without requiring physical access to the system. A public exploit has already been released, increasing the risk of active exploitation. The affected product is a web-based academic scheduling application. Attackers could leverage this flaw to manipulate or extract database contents. The vulnerability is tracked as CVE-2026-86209 and has been published on NVD and VulDB. No patch or mitigation details are currently provided in the advisory.
View original advisory →A SQL injection vulnerability has been identified in SourceCodester Online Voting System version 1.0. The vulnerability exists in the /ajax.php?action=delete_voting file, where manipulation of the 'ID' argument allows for SQL injection attacks. The attack can be launched remotely without requiring physical access to the target system. A public exploit has been disclosed and is available for use, increasing the risk of exploitation. The vulnerability affects an unknown function within the identified file. Attackers could potentially manipulate the database through this injection point. The issue has been assigned CVE-2026-86160 and is tracked in multiple vulnerability databases including NVD and VulDB.
View original advisory →A SQL injection vulnerability was identified in SourceCodester Online Voting System version 1.0. The flaw exists in the /ajax.php?action=login file, where manipulation of the Username argument allows an attacker to perform SQL injection. The attack can be executed remotely without requiring physical access. The exploit has been publicly disclosed, increasing the risk of active exploitation. This vulnerability affects the login functionality of the web-based voting application. Successful exploitation could allow attackers to bypass authentication or extract sensitive database information. The vulnerability was reported and tracked under CVE-2026-86162.
View original advisory →A denial-of-service vulnerability exists in h3 versions prior to 2.0.1-rc.18, affecting the setChunkedCookie() and deleteChunkedCookie() functions. The library fails to validate the chunk count parsed from user-controlled cookie values, allowing attackers to send a crafted cookie header with an extremely large chunk count. This triggers an O(n²) cleanup loop that can hang the server process indefinitely. The vulnerability is exploitable remotely without authentication by simply sending a malicious HTTP cookie header. The issue has been addressed in h3 version 2.0.1-rc.18. Affected users should upgrade immediately to mitigate the risk of service disruption.
View original advisory →