A security flaw has been discovered in code-projects Simple Content Management System 1.0. Affected by this issue is some unknown functionality of the file /web/index.php. Performing a manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.
ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the endpoint /SettingsIndividual.php in ChurchCRM 7.0.5. Authenticated users without any specific privileges can inject arbitrary SQL statements through the type array parameter via the index and thus extract and modify information from the database. This vulnerability is fixed in 7.1.0.
ChurchCRM is an open-source church management system. Prior to 7.1.0, an SQL injection vulnerability was found in the endpoint /SettingsUser.php in ChurchCRM 7.0.5. Authenticated administrative users can inject arbitrary SQL statements through the type array parameter via the index and thus extract and modify information from the database. This vulnerability is fixed in 7.1.0.
CVE-2026-5575 is a medium severity SQL injection vulnerability in SourceCodester/jkev Record Management System version 1.0. The vulnerability exists in the Login component's index.php file, where manipulation of the Username argument can lead to SQL injection. The vulnerability can be exploited remotely without authentication. Although an exploit is publicly available, there is no confirmed patch or official remediation at this time.
A security vulnerability has been detected in halex CourseSEL up to 1.1.0. Affected by this vulnerability is the function check_sel of the file Apps/Index/Controller/IndexController.class.php of the component HTTP GET Parameter Handler. The manipulation of the argument seid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
A vulnerability was identified in itsourcecode Online Enrollment System 1.0. This affects an unknown function of the file /sms/user/index.php?view=edit&id=10 of the component Parameter Handler. Such manipulation of the argument USERID leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used.
A path traversal vulnerability (CWE-22) exists in phpMyFAQ versions prior to 4.1.1 in the MediaBrowserController::index() method. The vulnerability arises because the user-supplied filename parameter is concatenated with the base upload directory path without proper validation, allowing directory traversal sequences like .. / to bypass restrictions. The input sanitization only encodes HTML special characters and does not prevent traversal sequences. Additionally, the endpoint lacks CSRF token validation, making it susceptible to CSRF attacks. This vulnerability has been patched in version 4.1.1.
CVE-2026-5334 is a medium severity SQL injection vulnerability in itsourcecode Online Enrollment System version 1.0. The issue exists in the parameter handling of the /enrollment/index.php? view=edit&id=3 endpoint, specifically through manipulation of the 'deptid' argument. This vulnerability allows remote attackers to inject SQL commands. Although an exploit is publicly available, there are no known exploits observed in the wild. No patch or official remediation information is currently provided.
A vulnerability was identified in SourceCodester Leave Application System 1.0. Impacted is an unknown function of the file /index.php?page=manage_user of the component User Information Handler. Such manipulation of the argument ID leads to authorization bypass. The attack can be executed remotely. The exploit is publicly available and might be used.
A vulnerability was determined in code-projects Student Membership System 1.0. The impacted element is an unknown function of the file /admin/index.php of the component Admin Login. This manipulation of the argument username/password causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.
CVE-2026-30556 is a reflected Cross-Site Scripting (XSS) vulnerability in SourceCodester Sales and Inventory System 1.0. It occurs in the index.php file via the "msg" parameter, which does not properly sanitize user input. This allows remote attackers to inject arbitrary web scripts or HTML through a crafted URL, potentially impacting confidentiality and integrity. The vulnerability has a medium severity with a CVSS score of 6.1. No official patch or remediation information is currently available.
A flaw has been found in itsourcecode Free Hotel Reservation System 1.0. Impacted is an unknown function of the file /admin/mod_room/index.php?view=edit. Executing a manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used.
WWBN AVideo is an open source video platform. In versions up to and including 26.0, three `list.json.php` endpoints in the Scheduler plugin lack any authentication check, while every other endpoint in the same plugin directories (`add.json.php`, `delete.json.php`, `index.php`) requires `User::isAdmin()`. An unauthenticated attacker can retrieve all scheduled tasks (including internal callback URLs and parameters), admin-composed email messages, and user-to-email targeting mappings by sending simple GET requests. Commit 83390ab1fa8dca2de3f8fa76116a126428405431 contains a patch.
A security flaw has been discovered in itsourcecode Payroll Management System up to 1.0. This affects an unknown function of the file /index.php. Performing a manipulation of the argument page results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks.
A vulnerability was identified in itsourcecode Free Hotel Reservation System 1.0. The impacted element is an unknown function of the file /admin/mod_amenities/index.php?view=editpic. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit is publicly available and might be used.
CVE-2026-4875 is a medium-severity vulnerability in itsourcecode Free Hotel Reservation System version 1.0. It involves an unrestricted file upload issue in the /admin/mod_amenities/index.php? view=add endpoint, where manipulation of the 'image' argument allows remote attackers to upload files without restriction. The vulnerability has been publicly disclosed, but no known exploits in the wild have been reported. No official patch or remediation guidance is currently available from the vendor.
CVE-2026-4842 is a medium severity SQL injection vulnerability in itsourcecode Online Enrollment System version 1.0. The vulnerability exists in the Parameter Handler component, specifically in the /sms/grades/index.php file when handling the 'deptid' argument. This flaw allows remote attackers to manipulate SQL queries via the deptid parameter. The vulnerability has been publicly disclosed, but no known exploits are currently reported in the wild. No patch or official remediation information is available at this time.
A weakness has been identified in itsourcecode Online Enrollment System 1.0. This vulnerability affects unknown code of the file /sms/user/index.php?view=add of the component Parameter Handler. Executing a manipulation of the argument Name can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
CVE-2026-30655 is a medium severity SQL injection vulnerability in the esiclivre/esiclivre application version 0.2.2 and earlier. It affects the resetaSenha() function in the Solicitante component, specifically via the cpfcnpj parameter in /reset/index.php. This flaw allows unauthenticated remote attackers to execute unauthorized SQL queries, potentially exposing sensitive information. The vulnerability does not require user interaction or authentication and has a CVSS score of 6.5. No known exploits are currently reported in the wild. Organizations using affected versions of esiclivre should prioritize patching or mitigating this issue to prevent data leakage.
A vulnerability has been found in itsourcecode Free Hotel Reservation System 1.0. This affects an unknown part of the file /hotel/admin/mod_users/index.php?view=edit&id=8 of the component Parameter Handler. The manipulation of the argument account_id leads to sql injection. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.