A persistent cross-site scripting (XSS) vulnerability exists in GYM One gym management software versions prior to 1.4.1. The vulnerability occurs because the admin/users/index.php page renders user profile fields (firstname, lastname, email) without proper HTML encoding. An attacker able to store malicious script code in these fields can execute arbitrary scripts in an administrator's browser when they view the user list, potentially compromising administrator session data and privileges. This issue is fixed in version 1.4.1.
GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the search_name and search_email GET parameters into both the user-list query and the COUNT query used for pagination without prepared statements. An authenticated administrator can inject SQL through either search field to read data from arbitrary tables, including user information and password hashes. Depending on database permissions, the same injection may also permit filesystem writes. This issue is fixed in version 1.4.1.
ClipBucket v5 through 5.5.3-#206 has a reflected cross-site scripting (XSS) vulnerability in the admin_area/index.php file. This flaw allows attackers to inject malicious HTML via the val parameter when mode=add_todo is used. An attacker can trick a logged-in administrator into submitting a cross-site POST form that lacks CSRF protection, leading to script execution within the admin panel context. The vulnerability has a low CVSS score of 2.1 and does not appear to have known exploits in the wild.
CVE-2026-109620 is a medium severity SQL injection vulnerability in SourceCodester Online Reviewer System version 1.0. The flaw exists in the PDO::prepare function within the login/index.php file, allowing remote attackers to manipulate username or password parameters to execute SQL injection attacks. The vulnerability has been publicly disclosed, but no known exploits are currently reported in the wild. No official patch or remediation guidance is provided in the available data.
FrankenPHP is a modern application server for PHP. Prior to 1.12.5, the official FrankenPHP Debian and Alpine Docker images include a default /app/public/index.php that executes phpinfo(). A derived image that does not overwrite this placeholder serves the diagnostics page in production and can disclose environment variables used for secrets, PHP configuration directives, loaded extensions, software versions, and system paths. Images built using the documented pattern with their own /app/public/index.php are not affected, and already derived images must be rebuilt or supplied with an application index to remove the exposed placeholder. This issue is fixed in version 1.12.5.
CVE-2026-108811 is an information disclosure vulnerability in WMCMS version 4.446.1257. It involves a weakness in an unknown function within the /index.php file, where manipulation of the path/file argument can lead to unauthorized information disclosure. The vulnerability can be exploited remotely without user interaction and requires low privileges. An exploit has been publicly disclosed. The CVSS 4.0 base score is 5.3, indicating medium severity.
CVE-2026-108963 is a high-severity vulnerability in databasement before version 1.8.2 that allows authenticated users to perform remote code execution. The issue arises because databasement runs commands like mariadb-dump with a database name argument that can be controlled by any authenticated user. This argument injection can lead to indirect code execution, such as writing files to arbitrary locations like /app/public/index.php. The vulnerability is due to improper neutralization of argument delimiters (CWE-88).
CVE-2026-108566 is a cross-site scripting (XSS) vulnerability in InstantSoft icms2 affecting versions 2.18.0, 2.18.1, and 2.18.2. The flaw exists in the Private Message Handler component, specifically in the index function of templates/default/controllers/messages/index.tpl.php, where manipulation of the 'nickname' argument can lead to XSS. The vulnerability can be exploited remotely and requires user interaction. A patch identified by commit 3a1ec8fcb073a46d06a2ab83bc2bf68225834281 is available to address this issue. The CVSS 4.0 base score is 5.1, indicating a medium severity level.
CVE-2026-108541 is a SQL injection vulnerability in highwarden Super Store Finder versions 3.0 through 3.8. The flaw exists in an unknown function within /products/superstorefinder/index.php where the lat/lng parameters can be manipulated to execute SQL injection. Remote exploitation is possible. The vendor has released version 3.9 to fix this issue.
The Order Export & Order Import for WooCommerce plugin for WordPress up to version 2.7.8 is vulnerable to sensitive information exposure. Unauthenticated attackers can access exported order CSV files containing customer personally identifiable information (PII) such as names, addresses, emails, phone numbers, and order details. This occurs when protective .htaccess and index.php files are missing from the export directory, a state that can arise after uninstall/reinstall cycles, migrations, backup restores, or staging synchronizations. Export filenames are predictable based on timestamps, enabling brute-force access to files over HTTP without authentication.
CVE-2026-105388 is a medium severity SQL injection vulnerability in feelcrm-os version 1.0.0. It affects the Member Endpoint component, specifically the index function in MemberController.class.php, allowing remote attackers to manipulate the group_id argument to execute SQL injection. The vulnerability has a publicly available exploit, and the vendor has not yet responded or issued a patch.
A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function GroupController::index of the file App/Feelcrm/Index/Controller/GroupController.class.php of the component Department Search Endpoint. The manipulation of the argument keyword leads to cross site scripting. The attack can be initiated remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability has been found in feelec-yishu feelcrm-os 1.0.0. Affected by this vulnerability is the function IndexController::index of the file App/ThinkPHP/Common/functions.php of the component Crm Endpoint. Such manipulation of the argument redirect_url leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-104625 is a medium severity SQL injection vulnerability in CodeAstro Simple Loan Management System version 1.0. The flaw exists in an unknown function within /admin/index.php, where manipulation of the g_name argument allows SQL injection. The vulnerability can be exploited remotely without user interaction. Public exploit code has been released, increasing the risk of attacks. No patch or official remediation information is currently available.
CVE-2026-102845 is an information disclosure vulnerability in gedelumbung HospitalManagement affecting the error_reporting function in the index.php file of the HTTP Response component. The vulnerability can be exploited remotely and has publicly disclosed exploit code. The product uses a rolling release model, so specific affected or fixed versions are not available. The vendor has not yet responded to the issue report.
CVE-2026-39117 is a critical remote code execution vulnerability affecting AltumCode 66Uptime versions before 54.0.0 and the 66Uptime ping-servers plugin before 2.0.0. The flaw allows an unauthenticated attacker to execute arbitrary code via the index.php file. This vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. No official patch or remediation details are provided in the input data.
CVE-2026-7171 is a stored Cross-Site Scripting (XSS) vulnerability in the TPVEnlanube Cloud Web application. It affects the 'Apellido 1' parameter in the endpoint '/administrator/index.php?page=admin.user_add&user_id=45&option=com_virtuemart'. An authenticated attacker could exploit this flaw to inject malicious scripts that execute in the browsers of other users. The vulnerability has a medium severity rating with a CVSS score of 4.8. No patch or remediation information is currently provided.