CVE-2026-108813 is a medium severity SQL injection vulnerability in SEMCMS version 5.0. It affects an unknown function within the SEMCMS_Download.php file and can be exploited remotely without user interaction. The vulnerability allows an attacker with low privileges to perform SQL injection, potentially impacting data confidentiality and integrity. The vendor has not responded to the disclosure, and no patch or remediation is currently available. Public exploit code exists, but no active exploitation in the wild has been reported.
Improper Validation of Specified Quantity in Input vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Input Data Manipulation.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.
Authorization Bypass Through User-Controlled Key vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1.
Improper Validation of Specified Quantity in Input vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Input Data Manipulation.This issue affects Flexible Quantity – Measurement Price Calculator for WooCommerce: from n/a through 2.3.22.
CVE-2026-108812 is a medium severity vulnerability in SEMCMS version 5.0 involving improper authorization in the /admin/SEMCMS_User.php file. The flaw allows remote attackers to manipulate an unknown function leading to unauthorized access. The vulnerability has been publicly disclosed, but no vendor response or patch is currently available.
CVE-2026-108811 is an information disclosure vulnerability in WMCMS version 4.446.1257. It involves a weakness in an unknown function within the /index.php file, where manipulation of the path/file argument can lead to unauthorized information disclosure. The vulnerability can be exploited remotely without user interaction and requires low privileges. An exploit has been publicly disclosed. The CVSS 4.0 base score is 5.3, indicating medium severity.
CVE-2026-108810 is an information disclosure vulnerability in the JSON Schema Validation component of tsi-coop tsi-dpdp-cms versions 0.5.0, 0.5.1, and 0.5.2. The flaw arises from manipulation of the _func argument, allowing remote attackers to disclose information. A fixed version 0.5.3 has been released by the vendor to address this issue.
CVE-2026-93582 is an authentication bypass vulnerability in OTRS Community Edition versions 6.0.0 up to but not including 7.0.0. The issue arises because HTTP Basic Authentication modules accept the authenticated username from the HTTP_REMOTE_USER environment variable, which can be controlled by an attacker via crafted HTTP headers. This allows an unauthenticated attacker to impersonate any existing user without knowing their password, potentially accessing or modifying sensitive data with that user's privileges. OTRS 7 and later are not affected due to architectural changes and additional validation mechanisms.
CVE-2026-93581 is a vulnerability in OTRS software where user-controlled input is not properly neutralized in CSV exports. This allows attackers to inject spreadsheet formula characters into CSV files, which may be interpreted as formulas when opened in spreadsheet applications. Exploitation requires the victim to open the CSV file and potentially confirm security warnings. The vulnerability affects multiple OTRS versions prior to 2026.7.X and does not involve code execution on the server side.
OTRS suffers from a vulnerability where customer user identities are not enforced as unique across multiple configured CustomerUser backends. This allows an authenticated user with permission to create or modify customer users to create duplicate customer user records with the same email address in different backends. This can lead to customer-related information or email communications being associated with the wrong customer user. The vulnerability affects multiple OTRS versions prior to 2026.7.X and requires authenticated user permissions to exploit.
CVE-2026-78358 is a Cross-Site Request Forgery (CSRF) vulnerability in OTRS versions 6.x through 8.x and 2023.x through 2026.6.x. It allows unauthenticated remote attackers to cause an authenticated administrator's browser to perform unintended administrative actions, such as deleting DBUpdate log entries, by embedding crafted requests in malicious web pages. The vulnerability affects several administrative and export endpoints that do not validate ChallengeTokens, but no direct confidentiality impact has been demonstrated. The impact is limited to the deletion of existing DBUpdate log entries, potentially reducing availability of diagnostic and audit information.
CVE-2026-78357 is a critical vulnerability in OTRS software where previously issued authentication tokens (JWTs) are not invalidated immediately after a user account is deactivated or its password is changed. This allows an attacker with a previously obtained valid token to continue accessing the system with the privileges of the affected user until the token expires, which can be about 16 hours. The impact depends on the permissions of the compromised token, with agent tokens potentially granting broad access. The vulnerability affects multiple OTRS versions prior to 2026.7.X.
CVE-2026-78356 is a vulnerability in OTRS that allows unauthenticated remote users to access the Agent Frontend configuration endpoint. This exposure reveals internal application configuration details intended only for authenticated users, such as frontend routes, authorization groups, authentication settings, enabled features, and third-party integrations. The disclosed information does not include user credentials nor allow unauthorized configuration changes but may aid attackers in fingerprinting the system and planning further attacks. The issue affects multiple OTRS versions including 8.0.x, 2023.x, 2024.x, 2025.x, and 2026.x before 2026.7.x.
CVE-2026-78355 is a path traversal vulnerability in the OTRS SendSupportBundle functionality that allows an authenticated administrator to reference file paths outside the intended directory. This can lead to deletion of files accessible to the OTRS application process within the permissions of the web server or OTRS user. The vulnerability affects multiple OTRS versions prior to 2026.7.X. Exploitation requires valid administrative access, and direct arbitrary file disclosure to attackers has not been demonstrated.
CVE-2026-48212 is a stored cross-site scripting (XSS) vulnerability in OTRS software that allows an administrator to inject arbitrary JavaScript into custom pages. This script is then executed in the browsers of users who access those pages. The vulnerability affects multiple versions of OTRS, including 7.0.x, 8.0.x, and yearly releases from 2023 through 2026 prior to 2026.7.x. The CVSS score is 4.8, indicating a medium severity level.
CVE-2026-48211 is a Cross-Site Request Forgery (CSRF) vulnerability in OTRS software versions 6.0.0 through 2026.6.x. It allows an unauthenticated remote attacker to trick an authenticated administrator into deleting administrative Import/Export templates by exploiting the lack of ChallengeToken validation in the AdminImportExport::TemplateDelete action.
CVE-2026-108809 is a medium severity vulnerability in Eleveo Call Recording Software versions 10.0 through 10.3.0. It involves improper handling of the /auth/realms/default/protocol/openid-connect/logout endpoint, leading to session expiration. The vulnerability can be exploited remotely and requires low privileges with user interaction. The vendor has not responded to disclosure requests, and no patch or official remediation is currently available.
CVE-2026-108808 is a low-severity vulnerability in Eleveo Call Recording Software up to version 10.3.0. It involves the use of the GET request method with sensitive query strings in the JWT Token Handler component, specifically in the /auth/realms/default/protocol/openid-connect/logout endpoint. The vulnerability arises from manipulation of the id_token_hint argument, which may expose sensitive information via query strings. Exploitation is difficult and requires high complexity. The vendor has not responded to disclosure, and no official patch or remediation is currently available.
CVE-2026-109082 is an authentication bypass vulnerability in the Client-Initiated Backchannel Authentication (CIBA) implementation within the keycloak-services component of Red Hat Build of Keycloak. The flaw allows public clients to bypass authorization checks and trick users into approving login requests, potentially granting attackers full access to user accounts without requiring a client secret. The vulnerability has a medium severity with a CVSS score of 6.8.
CVE-2026-108807 is a SQL injection vulnerability in the krupalshah EmployeeRecruitmentSystem affecting the mysql_query function in source/adminregister.php's Registration Handler component. The vulnerability allows remote attackers to manipulate SQL queries. The product uses a rolling release model, and no specific affected versions are provided. The vendor no longer supports this product and did not respond to disclosure attempts. Exploit code has been publicly released. The CVSS 4.0 score is 6.9, indicating medium severity.