A vulnerability was detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Impacted is the function sistem.php::simpan of the file application/modules/admin/controllers/sistem.php of the component Configuration Handler. The manipulation of the argument tipe/title/content_setting results in improper authorization. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.
A security vulnerability has been detected in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This issue affects the function error_reporting of the file index.php of the component HTTP Response. The manipulation leads to information disclosure. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability in the Gosub browser engine (gosub-engine) through version 0.1.0 and main before commit 46868b3 allows a remote attacker to cause a Denial of Service (DoS) via uncontrolled recursion. This occurs when rendering an SVG document with excessively deep nested elements, leading to stack exhaustion and application crash. The malicious SVG can be embedded in an IMG element's SRC attribute, requiring only that the victim visits a crafted web page.
A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. Affected by this issue is the function app_user_login_model.php::cekUserLogin of the file application/models/app_user_login_model.php of the component KCFinder File Manager. Such manipulation of the argument ADMIN_RS_KCFINDER leads to unrestricted upload. It is possible to launch the attack remotely. The exploit is publicly available and might be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-102910 is a SQL injection vulnerability in SourceCodester Online Reviewer Management System version 1.0. The flaw exists in the exam-delete.php file where the test_id parameter can be manipulated to perform SQL injection. This vulnerability can be exploited remotely without authentication. Public exploit code is available, increasing the risk of attacks. The vulnerability has a medium severity with a CVSS score of 6.9.
A path traversal vulnerability has been identified in FUJIFILM Business Innovation and Sharp multifunction printers (MFPs). This vulnerability could allow unauthorized access to files outside the intended directories on affected devices. No specific affected versions or detailed technical information are provided.
In September 2026, Mandiant and Google Threat Intelligence Group identified active exploitation of two zero-day vulnerabilities (CVE-2026-88772 and CVE-2026-88771) in Citrix NetScaler ADC and Gateway appliances. Exploitation of CVE-2026-88772 allows attackers to bypass authentication and execute root-level code by causing a heap memory corruption in the NetScaler Packet Processing Engine. Attackers deploy custom PHP web shells (WHIPSHOT) and a Python tunneler (SLAPSHOT) to maintain persistence, conduct internal reconnaissance, and steal credentials. Persistence techniques include modifying web server configurations to treat non-PHP files as executable scripts and setting the setuid bit on /bin/sh to maintain root privileges. Citrix has issued guidance and recommended updates to address these vulnerabilities. The campaign has targeted organizations in North America and Europe across multiple sectors since early September 2026.
The npm package 'booking-eligibility' version 1.0.0 contains a malicious postinstall script that attempts to execute a Windows Script Host (WSH) VBScript file named '4444.vbs' during installation. This script is not included in the package tarball, meaning the hook either fails or could execute attacker-supplied code if the file is provided by other means. The package's README falsely claims there are no installation scripts, misleading users about its behavior. The '4444.vbs' filename suggests a potential reverse-shell payload, indicating malicious intent. The package does not provide legitimate functionality to justify this behavior.
The npm package 'developmentstelemetry' contains malicious code that executes arbitrary code during installation. Its postinstall script runs a small stub that dynamically imports and executes a function from an unaudited third-party package 'originaldevelopmentstelemetry@1.2.2', which downloads and runs an update payload on the installer's machine. This behavior effectively hands control to the external package author during every 'npm install'.
The npm package 'booking-tasks' version 1.0.2 contains a malicious postinstall script that executes a VBScript payload on Windows systems. This payload decrypts and runs a PowerShell loader via process hollowing, enabling arbitrary code execution on the host. The package's declared functionality contradicts the presence of this malicious installation script, indicating the main module acts as a decoy. The payload uses multiple cryptographic primitives and chunked Base64 encoding to evade static detection.
The bfox-build-utils Python package (version 1.0.997) contains malicious code in its setup.py script that steals GitHub credentials during installation. It uses these credentials to clone the installer's repository, create a new branch, and inject a persistent attacker-controlled GitHub Actions workflow. This workflow executes on future pushes to the planted branch, enabling ongoing unauthorized actions. The package itself appears innocuous, with a minimal Python module and misleading branch and commit names to conceal the malicious behavior.
CVE-2026-103110 is a critical out-of-bounds write vulnerability in Pexip Infinity conferencing software. It affects versions before 38.2, as well as versions 39.0, 39.1, and 40.0. The flaw allows a remote attacker to execute arbitrary code remotely as an unprivileged user on a Pexip Infinity Conferencing Node without requiring user interaction or privileges.
A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/examproper/btn_functions.php. The manipulation of the argument access_code leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger memory corruption or a software abort resulting in a denial of service. A crafted media stream may result in a controlled abort during processing, and has the potential to achieve memory corruption.
Pexip Infinity before 38.2, plus 39.0, 39.1, and 40.0, is affected by improper input validation in the media implementation that allows a remote attacker to trigger a software abort resulting in a denial of service
Pexip Infinity versions before 38.2, as well as versions 39.0, 39.1, and 40.0, contain a vulnerability due to improper input validation in an internal service. This flaw allows an attacker with local access and the ability to run arbitrary code on a node to escalate privileges to root. Exploitation requires prior code execution or administrative OS access. The vulnerability has a high severity score of 7.8.
Pexip Infinity versions before 38.2, as well as versions 39.0, 39.1, and 40.0, contain an improper access control vulnerability in an internal API. This flaw allows an attacker with local access to one node in a Pexip Infinity installation to execute arbitrary code as an unprivileged user on another node. The vulnerability is classified as CWE-863 (Incorrect Authorization) and has a high severity with a CVSS score of 8.8.
Pexip Infinity before 38.2, plus 39.0, 39.1 and 40.0, is affected by improper input validation in the media implementation which allows a remote attacker to trigger a software abort resulting in a denial of service.
Pexip Infinity before 41.0 is affected by improper input validation in the signaling implementation which allows a remote attacker to trigger a software abort resulting in a denial of service. Exploitation of this issue requires accessing a gateway call from a WebRTC/API client.
The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink) in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the site operator to have enabled guest post submission via the [fpsm] shortcode, which registers a publicly accessible AJAX handler gated only by a nonce emitted on every page containing the shortcode.