CVE-2026-77681 is a medium severity vulnerability in CodeAstro Online Job Portal version 1.0. It involves an unrestricted file upload issue in the /users/update-profile.php script triggered by manipulation of the Name argument. The vulnerability can be exploited remotely without user interaction. Public exploit code is available, but there are no known active exploitations in the wild. No patch or official remediation information is provided.
CVE-2026-76998 is a SQL injection vulnerability in SourceCodester Simple Online Food Ordering System version 1.0. The flaw exists in the /admin/ajax.php?action=delete_category endpoint where manipulation of the ID parameter allows SQL injection. This vulnerability can be exploited remotely without authentication. Public exploit code has been disclosed. The CVSS 4.0 base score is 6.9, indicating a medium severity risk.
CVE-2026-76997 is a SQL injection vulnerability in SourceCodester Simple Online Food Ordering System version 1.0. The vulnerability exists in the /admin/ajax.php?action=save_category endpoint, where manipulation of the ID parameter allows remote attackers to perform SQL injection. The exploit code is publicly available. The vulnerability has a medium severity rating with a CVSS score of 5.3.
CVE-2026-76996 is a medium severity SQL injection vulnerability in SourceCodester Simple Online Food Ordering System version 1.0. The flaw exists in the /fos/admin/view_order.php file where the ID parameter can be manipulated to perform SQL injection attacks remotely. Exploit code has been publicly released, increasing the risk of exploitation. No official patch or remediation guidance is currently provided.
A vulnerability was identified in SourceCodester Simple Online Food Ordering System 1.0. This issue affects some unknown processing of the file /admin/ajax.php?action=save_menu. The manipulation of the argument img leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.
CVE-2026-76050 is a SQL injection vulnerability in SourceCodester Simple Online Food Ordering System version 1.0. The issue exists in the /admin/ajax.php file when handling the delete_menu action via the ID parameter. This vulnerability allows remote attackers to manipulate the ID argument to execute unauthorized SQL commands. The exploit code has been publicly disclosed. The vulnerability has a CVSS 4.0 base score of 6.9, indicating a medium severity level.
CVE-2026-76049 is a SQL injection vulnerability in SourceCodester Simple Online Food Ordering System version 1.0. The flaw exists in the /admin/ajax.php?action=save_menu endpoint where manipulation of the ID parameter allows remote attackers to execute SQL injection. The vulnerability has a CVSS score of 6.9 (medium severity) and public exploit details have been disclosed. No official patch or remediation information is provided.
SourceCodester Simple Online Food Ordering System version 1.0 contains a SQL injection vulnerability in the /admin/ajax.php?action=login endpoint. The vulnerability arises from improper sanitization of the Username parameter, allowing remote attackers to manipulate SQL queries. An exploit for this vulnerability has been published. The CVSS 4.0 base score is 6.9, indicating a medium severity level.
CVE-2026-75986 is a SQL injection vulnerability in the code-projects Online Job Portal System version 1.0. It affects an unknown function in the /ForPass.php file related to the Password Recovery component. The vulnerability allows remote attackers to manipulate the txtUserName argument to perform SQL injection. The exploit has been publicly disclosed. The vulnerability has a medium severity with a CVSS 4.0 base score of 6.9.
CVE-2026-70747 is a vulnerability in Oracle Customers Online, part of Oracle E-Business Suite's Customer Tab component. It affects versions 12.2.3 through 12.2.15. The flaw allows a low privileged attacker with network access via HTTP to compromise the system, potentially leading to a full takeover. The CVSS 3.1 base score is 8.8, indicating high severity with impacts on confidentiality, integrity, and availability. Oracle has included this vulnerability in its August 2026 Critical Security Patch Update, which contains numerous security fixes across multiple products.
Microsoft says some users are experiencing issues searching in Microsoft 365 apps, including Outlook on the web, Outlook desktop, SharePoint Online, and OneDrive. [...]
A weakness has been identified in code-projects Online Shopping System 1.0. Impacted is an unknown function of the file offersmail.php. Executing a manipulation of the argument email can lead to cross site scripting. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.
The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via bookly_speed_up_update_addons AJAX action in all versions up to, and including, 27.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injection point is the bookly_speed_up_update_addons AJAX action, which is registered as wp_ajax_nopriv_* and therefore reachable without authentication; the payload is stored verbatim in the bookly_log.details column when a request is submitted without a valid signature, and executes when an administrator later views the Diagnostics → Logs page.
The Platnosci Online Blue Media (Autopay) plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the 'bm_woocommerce_css_editor_content' POST parameter. This is due to the Css_Editor::handle_save() method being wired to the WordPress 'init' hook by Settings_Manager::init_once() with no capability check, no nonce verification, and no sanitization on the input — the raw $_POST value is written to the 'woocommerce_bluemedia_settings' option via update_option(), then later echoed directly inside a <style> block on the WooCommerce checkout page by Css_Frontend::print_to_wp_head() with no output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (the checkout page).
The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 27.7 via the appointment() method of the Mobile Staff Cabinet API (resource=appointment, action=bookly_mobile_staff_cabinet) in frontend/modules/mobile_staff_cabinet/api/handlers/Handler1_0.php. This is due to the handler loading an Appointment by the attacker-supplied params[id] without verifying that the appointment's staff_id matches the authenticated staff member, whereas sibling operations (deleteAppointment, saveAppointment, appointments list) correctly scope to $this->staff->getId() when $this->role === ROLE_STAFF. This makes it possible for authenticated attackers, with staff-level mobile cabinet access (any valid access_key token bound to a Staff entity), to read appointment details — including the internal note and the full customer_appointments collection (customer full_name, email, phone, notes, custom_fields, extras, payment_total, payment_type, payment_status) — belonging to other staff members by enumerating sequential appointment IDs.
A weakness has been identified in code-projects Online Shopping System 1.0. This affects an unknown part of the file /checkout_process.php. Executing a manipulation of the argument total_count can lead to sql injection. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks.