A vulnerability was found in UNION HospitalManagementSystem up to 9ef91ed6007314b6473110ed699dff76d158f61d. Affected is an unknown function of the file patient_info.php. Performing a manipulation of the argument patient_id results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.
Missing Authorization vulnerability in WP ManageNinja LLC Fluent Forms Pro Add On Pack fluentformpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent Forms Pro Add On Pack: from n/a through 6.2.13.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikki Blight QR Redirector qr-redirector allows Stored XSS.This issue affects QR Redirector: from n/a through 2.0.5.
OpenAM versions before 16.1.3 contain a server-side request forgery (SSRF) vulnerability. This flaw allows attackers who can register or modify OAuth 2.0 clients to make OpenAM fetch internal resources via an unvalidated jwks_uri parameter. Exploitation can lead to unauthenticated internal resource access and potential denial of service by exhausting request threads.
OpenAM versions prior to 16.1.3 have an improper authorization vulnerability that allows delegated administrators with specific session-destroy privileges to terminate sessions outside their authorized realms. This occurs because the realm checks rely on the requester's realm rather than the target session's realm, enabling cross-realm session destruction.
OpenAM versions prior to 16.1.3 have an authorization bypass vulnerability in the sessions REST endpoint. This flaw allows attackers with delegated RealmAdmin privileges to query session information across tenant boundaries by specifying another realm in the _queryFilter parameter. Sensitive data such as usernames, universal IDs, and session handles can be disclosed. The vulnerability has a medium severity score of 6.9 (CVSS 4.0).
OpenAM versions before 16.1.3 have an improper authorization vulnerability in their OAuth2 Provider implementation. Specifically, PKCE enforcement is only applied to authorization requests with response_type exactly equal to 'code'. Hybrid OpenID Connect flows that include 'code token', 'code id_token', or 'code token id_token' do not have this enforcement, allowing intercepted authorization codes to be redeemed by attackers with any non-empty code_verifier.
OpenAM versions before 16.1.3 contain an open redirect vulnerability in the /oauth2/connect/endSession endpoint. This flaw allows unauthenticated attackers to supply an unverified id_token_hint, enabling redirection to any registered post-logout URI. The vulnerability can be exploited for phishing attacks that leverage the trust of the OpenAM host. The issue is classified as low severity with a CVSS 4.0 score of 2.3.
OpenAM versions before 16.1.3 have an email content injection vulnerability that allows unauthenticated attackers to manipulate notification emails sent via the forgotPassword and register actions. Attackers can control the subject and message fields, enabling phishing attacks from the organisation's configured From address or use the register function to relay emails to arbitrary recipients. This vulnerability has a medium severity rating with a CVSS score of 5.3.
OpenAM versions prior to 16.1.3 contain a latent cross-site scripting (XSS) vulnerability. This flaw involves improper neutralization of input during web page generation, where the SAML message, relay state, and target URL are inserted unencoded into a cookie bounce auto-submit page. Exploitation requires the cookieHashRedirectEnabled setting to be enabled. However, an unrelated HTTP 500 error currently prevents exploitation in released versions.
OpenAM versions prior to 16.1.3 have a vulnerability in the legacy JAX-RPC SOAP interface that allows unauthenticated remote attackers to instantiate arbitrary classes. This flaw enables attackers to send SOAP requests with unverified session identifiers and chosen class names, potentially crashing the server, probing the classpath, or achieving code execution via gadget chains. The vulnerability has a high severity score of 8.8 (CVSS 4.0).
OpenAM versions before 16.1.3 have a reflected cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject malicious scripts via crafted parameters on the OAuth2 authorization error page. Exploitation requires tricking users into visiting a specially crafted URL, enabling script execution in the context of the OpenAM origin. This can lead to actions within existing user sessions or redirection to phishing sites.
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Privilege Escalation via Contact Identity Rebinding in all versions up to, and including, 4.9 The vulnerability exists because the `create_contact` function in the v3 REST endpoint (`POST /gh/v3/contacts`) is gated solely by the `add_contacts` capability and forwards the full request payload — including the security-bearing `user_id` column — into the upsert path of `Contacts_DB::add()`, which bypasses the ownership guard that `Contacts_DB::update()` enforces, allowing an attacker to rebind any existing contact record to an arbitrary WordPress user ID. This makes it possible for authenticated attackers with Sales Representative-level access and above to upsert their own contact row to point to an Administrator's user ID, then invoke the v4 email-test endpoint (`POST /gh/v4/emails/test`) — also accessible to the Sales Representative role via the `send_emails` capability — to generate an `{auto_login_url}` one-time permissions key bound to the rebound contact, and consume that link to call `wp_set_auth_cookie()` and gain a fully authenticated session as the WordPress Administrator.
The postgresql-operator charm runs a Prometheus postgres_exporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover the password, which grants read-only pg_monitor access to PostgreSQL. This is fixed in the dev track (14/edge) in revisions 1189 (arm64) and 1190 (amd64), and in the stable track (14/stable) in revisions 1216 (arm64) and 1217 (amd64).
An information exposure vulnerability in Canonical MAAS prior to versions 3.4.10, 3.5.14, 3.6.5, 3.7.3, and 3.8.0 allows an unauthenticated attacker to retrieve the RPC secret in plaintext via the vendor data metadata endpoint. If a target machine was deployed with the 'register as rack' option enabled, an attacker who obtains or infers the machine's system ID can query the preseed/metadata server to leak the secret.
Missing Authorization vulnerability in AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System (LMS) allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects Learning Management System (LMS): through 2026-09-18.
CVE-2026-53964 is a high-severity vulnerability in adfinis document-merge-service prior to version 9.1.0. It allows remote code execution via server-side template injection in XLSX templates processed by the xltpl library using a non-sandboxed Jinja environment. The flaw enables execution of user-supplied code with the privileges of the document-merge-server user, potentially compromising the container. This issue has been fixed in version 9.1.0.
CVE-2026-55251 is a code injection vulnerability in the netbox-community devicetype-library repository. The issue arises because the continuous integration (CI) workflow executed code from pull requests before any maintainer review, allowing an unprivileged contributor to run arbitrary code on the CI runner by modifying certain configuration files. This vulnerability has been patched by commit f41fc1e.
Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a victim who activates an untrusted link to navigate a frame to /_capacitor_http_interceptor_. The native proxy can fetch an attacker-selected URL and return the response as a document at the application's own origin, allowing script in that response to access same-origin storage, cookies, and registered Capacitor plugin capabilities. Applications remain affected when CapacitorHttp is disabled because affected releases serve the proxy path regardless of that setting. This issue is fixed in versions 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1.
CVE-2026-101890 is a stored cross-site scripting (XSS) vulnerability in the Prime Mover WordPress plugin before version 2.2.1. It allows attackers to inject arbitrary JavaScript code via an unescaped site_title value in a package's footprint.json file. The malicious script executes in an administrator's browser when viewing the Prime Mover Packages list, without requiring package restoration.