CVE-2026-7716 is a medium severity SQL injection vulnerability in the code-projects Gym Management System In PHP version 1.0. The flaw exists in the /index.php file where manipulation of the 'day' argument can lead to SQL injection. This vulnerability can be exploited remotely without user interaction or elevated privileges. Although the exploit code has been made public, there is no official patch or remediation available yet.
CVE-2026-7506 is a medium severity SQL injection vulnerability found in SourceCodester Hotel Management System version 1.0. The issue exists in the /index.php/reservation/check file where the room_type parameter can be manipulated to perform SQL injection. This vulnerability can be exploited remotely without authentication. The exploit has been publicly disclosed, but no official patch or remediation guidance is currently available from the vendor.
PhpSpreadsheet's SpreadsheetML XML reader does not validate the ss:Index row attribute against the maximum allowed row count, allowing an attacker to set an extremely large row index. This causes the internal cachedHighestRow to inflate to about 1 billion, leading to CPU exhaustion when iterating rows. The vulnerability enables denial of service by exhausting server CPU resources with a small crafted XML file. The flaw affects multiple versions of PhpSpreadsheet prior to fixed releases. A patch is available that adds validation to limit the row index to the maximum allowed value.
A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This vulnerability affects unknown code of the file /index.php?action=register of the component Registration. The manipulation of the argument student_id/full_name/section/username results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used.
A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. The impacted element is the function Customer of the file /index.php?page=customer. The manipulation of the argument Name results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used.
CVE-2026-7294 is a cross-site scripting (XSS) vulnerability in SourceCodester Pizzafy Ecommerce System version 1.0. The vulnerability exists in the save_settings function within the /admin/index.php? page=save_settings file. It is caused by improper handling of the 'Name' argument, allowing an attacker to inject malicious scripts. The vulnerability can be exploited remotely and requires some user interaction. An exploit has been published, but there are no known exploits in the wild at this time. The CVSS 4.0 base score is 4.
A vulnerability was determined in SourceCodester Pharmacy Sales and Inventory System 1.0. The impacted element is the function supplier of the file /index.php?page=supplier. Executing a manipulation of the argument Name can lead to cross site scripting. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized.
CVE-2026-7269 is a cross-site scripting (XSS) vulnerability in SourceCodester Pharmacy Sales and Inventory System version 1.0. The vulnerability exists in an unknown function within the /index.php? page=product file, where manipulation of the ID argument can lead to XSS. The vulnerability can be exploited remotely and the exploit code has been publicly disclosed. The CVSS score is 4.8, indicating a medium severity level. No official patch or remediation guidance is currently available from the vendor. The system is not a cloud service, so remediation depends on vendor or user action.
A security vulnerability has been detected in SourceCodester Pizzafy Ecommerce System 1.0. The affected element is the function Category of the file pizza/index.php?page=category. The manipulation of the argument ID leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used.
CVE-2026-7200 is a cross-site scripting (XSS) vulnerability in SourceCodester Pharmacy Sales and Inventory System version 1.0. The issue exists in the /index.php? page=types file where manipulation of the ID argument allows remote attackers to inject malicious scripts. The vulnerability has a medium severity with a CVSS score of 5.3. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.
A vulnerability was detected in SourceCodester Pharmacy Sales and Inventory System 1.0. Impacted is an unknown function of the file /index.php?page=categories. Performing a manipulation of the argument ID results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used.
A vulnerability was found in GreenCMS up to 2.3. Affected is the function themeadd of the file /index.php?m=admin&c=custom&a=themeadd. The manipulation results in unrestricted upload. The attack can be launched remotely. The exploit has been made public and could be used. This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2026-7043 is a medium severity vulnerability in GreenCMS versions up to 2.3 that allows unrestricted file upload via the pluginAddLocal function in the /index.php? m=admin&c=custom&a=pluginadd endpoint. This vulnerability can be exploited remotely without user interaction and affects only unsupported versions of GreenCMS. No official patch or remediation is available from the maintainer. The vulnerability has been publicly disclosed, but there are no confirmed exploits in the wild at this time.
A vulnerability was identified in pagekit up to 1.0.18. Affected by this issue is some unknown functionality of the file /index.php/admin/system/update/download. The manipulation of the argument url leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was detected in JiZhiCMS up to 2.5.6. The impacted element is the function htmlspecialchars_decode of the file /index.php/admins/Sys/addcache.html. The manipulation of the argument sqls results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
SQL Injection vulnerability in Apartment Visitors Management System Apartment Visitors Management System V1.1 within the username parameter of the login page (index.php). This allows an unauthenticated attacker to manipulate backend SQL queries during authentication and retrieve sensitive database contents.
A vulnerability was detected in EyouCMS up to 1.7.1. This issue affects the function edit_adminlogo of the file application/admin/controller/Index.php. Performing a manipulation of the argument filename results in unrestricted upload. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A compromised Joomla website displayed suspicious product links unrelated to the business. Investigation revealed heavily obfuscated PHP code injected at the top of index.php that contacted external command-and-control servers to receive instructions and manipulate content. The malware acts as a remote loader, assembling strings from two-character chunks to evade signature-based detection. It contacts primary C2 cdn.erpsaz.com and fallback cdn.saholerp.com, sending server fingerprint data and receiving dynamic instructions. Based on responses, it redirects visitors, injects spam content, or serves fake SEO pages to search engines. This approach allows attackers to control compromised sites remotely without modifying local files again, enabling dynamic spam injection, visitor redirection, and search engine manipulation while remaining undetected for extended periods.
CVE-2026-37749 is a critical SQL injection vulnerability in CodeAstro Simple Attendance Management System v1.0. It allows remote unauthenticated attackers to bypass authentication by exploiting the username parameter in index.php. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available. There are no known exploits in the wild at this time.