A vulnerability was detected in DevaslanPHP project-management 1.2.1/1.2.2/1.2.3/1.2.4/2.0.0-beta1. This affects the function whereRaw of the file app/Filament/Widgets/Timesheet/ActivitiesReport.php of the component Timesheet Dashboard. Performing a manipulation of the argument filter results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-92842 is a medium severity heap-based buffer overflow vulnerability in PHP related to the convert.base64-encode, convert.quoted-printable-encode, and convert.quoted-printable-decode stream filters. The issue arises because the filters accept a line-break-chars option whose length is tracked separately from the string itself. The filter constructors duplicate the value using pestrdup(), which stops at the first NUL byte but retains the original length. This discrepancy allows the filter to read past the allocated buffer when emitting a line break, potentially leaking adjacent heap memory into the output.
CVE-2026-91768 is a vulnerability in the PHP FastCGI client access check for IPv6 addresses. The check incorrectly compares only the first 12 bytes of a 16-byte IPv6 address, effectively matching on a /96 prefix rather than the full address. This allows an attacker with an IPv6 address sharing the first 96 bits with an allowed client to bypass access restrictions and reach the FastCGI endpoint. The vulnerability has a medium severity with a CVSS score of 6.5.
A heap-based buffer overflow vulnerability exists in PHP's OpenSSL extension function php_openssl_matches_wildcard_name(). This occurs when a TLS server certificate presents a wildcard name whose literal characters are longer than the hostname being verified, causing an underflow in the length argument passed to memchr(). This can lead to reading memory beyond the allocated heap buffer. The vulnerability is reachable from any default PHP client stream since verify_peer_name is enabled by default.
CVE-2026-91769 is a vulnerability in PHP's OpenSSL stream peer verification where certificate validation incorrectly accepts certificates with a host name mismatch. Specifically, if a certificate includes subjectAltName (SAN) entries, PHP improperly falls back to validating the Common Name (CN) when no SAN matches, violating RFC 6125. This flaw allows a certificate trusted for one hostname to be used to impersonate another, potentially enabling man-in-the-middle attacks. The vulnerability has a medium severity with a CVSS score of 4.3. No affected versions or patch information are explicitly provided.
CVE-2026-91766 is a medium severity vulnerability in PHP where the http:// stream wrapper forwards sensitive headers such as Authorization, Cookie, and Proxy-Authorization unchanged when following redirects. This occurs even if the redirect target is a different host, port, or downgrades from HTTPS to HTTP, potentially exposing credentials to unintended servers.
CVE-2026-91765 is a high-severity vulnerability in the PHP SOAP XML parser where the cleanup_xml_node() function recurses without a depth limit. This allows an unauthenticated attacker to send a SOAP request with extremely deep nesting, causing stack exhaustion and crashing the SoapServer process. The unbounded recursion also affects the SOAP value decoder and WSDL node search helper.
The mysqlnd wire protocol parser reads fields out of server packets before checking that the packet still holds enough bytes for them. A malicious or compromised MySQL server can send a truncated packet and make the client read past the end of the packet buffer, which is undefined behaviour and can crash the process.
The SOAP HTTP client guards its response buffer growth with a check that relies on signed integer overflow, which is undefined behaviour and is not guaranteed to trigger. When the check is optimised away, a malicious SOAP server can make the client allocate a buffer far smaller than the data it then writes into it, producing a heap buffer overflow.
On Windows, PHP's filesystem and stream APIs do not reject reserved device names such as CON, PRN, AUX, NUL, COM1 to COM9, LPT1 to LPT9, CONIN$ and CONOUT$ when they appear as a component of a path. An attacker-controlled filename therefore reaches CreateFileW() and opens a device instead of the regular file the application expected, which can block or hang the request and exhaust worker processes.
CVE-2026-93682 is an out-of-bounds read vulnerability in the PHP HTTP stream wrapper. When following a redirect, if the Location header is empty, the code reads one byte beyond the allocated buffer. This byte influences the redirect target, allowing a malicious server to control whether the client is redirected to the host root or the current directory. The vulnerability has a medium severity with a CVSS score of 5.8.
phar_tar_number() parses the octal size field of a TAR header into a uint32_t with no overflow check. The field is 11 octal digits wide and holds values up to 0x1FFFFFFFF, so a size above 0xFFFFFFFF silently wraps. The parser then skips the wrong number of data blocks and interprets attacker-controlled file content as the next TAR header, which lets a crafted archive inject entries that PharData reports and extracts as if they were genuine.
react/http is an event-driven, streaming HTTP client and server implementation for ReactPHP. From 0.6.0 until 1.11.1, React\Http\Io\ChunkedDecoder could enter an infinite loop while processing a malformed Transfer-Encoding: chunked body because handleData required its buffer to shrink on every iteration. An incomplete terminal-chunk trailer without CRLF left the buffer unchanged after strpos returned false, and exactly two non-CRLF bytes after a completed non-terminal chunk bypassed both the error and wait guards. The affected decoder processes request bodies for React\Http\HttpServer and response bodies for React\Http\Browser, allowing a malicious client to freeze a server or a malicious or compromised server to freeze a client. A reverse proxy that normalizes inbound requests may protect the server direction but does not protect outbound Browser requests. This issue is fixed in version 1.11.1.
CVE-2026-90851 is a medium severity vulnerability in PHPGurukul Hostel Management System version 3.0. It involves improper access controls due to manipulation of the ID argument in the /admin/includes/checklogin.php file. This flaw allows remote attackers to potentially bypass access restrictions. Exploit code has been published, but no confirmed active exploitation in the wild is reported. No official patch or remediation details are provided.
CVE-2026-90850 is a cross-site scripting (XSS) vulnerability in PHPGurukul Hostel Management System version 3.0. The issue exists in the /admin/manage-students.php file and can be exploited remotely. The vulnerability allows an attacker to inject malicious scripts, potentially impacting users who interact with the affected functionality. The CVSS score is 4.8, indicating a medium severity level. No patch or remediation information is currently available.
CVE-2026-90846 is a SQL injection vulnerability in PHPGurukul Daily Expense Tracker System version 1.1. The flaw exists in the /dets/forgot-password.php file where the email/contactno parameter is improperly sanitized, allowing remote attackers to inject SQL commands. This vulnerability has been publicly disclosed and could be exploited remotely without authentication.
A flaw has been found in PHPGurukul Daily Expense Tracker System 1.1. This issue affects some unknown processing of the file /dets/includes/sidebar.php. Executing a manipulation of the argument FullName can lead to cross site scripting. The attack can be executed remotely. The exploit has been published and may be used.
A vulnerability was detected in PHPGurukul Daily Expense Tracker System 1.1. This vulnerability affects unknown code of the file /dets/index.php of the component Login. Performing a manipulation of the argument email results in sql injection. Remote exploitation of the attack is possible. The exploit is now public and may be used.
CVE-2026-90842 is a vulnerability in PHPGurukul Blood Donor Management System version 1.0 where certain password-related parameters are stored in cleartext on disk. This issue affects the file application/models/admin/Login_Model.php and can be triggered remotely. Exploitation requires a high level of complexity and is considered difficult. The vulnerability has a medium severity with a CVSS score of 6.3. Public exploit code is available, but no known active exploitation in the wild has been reported.
A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /application/controllers/admin/Report.php of the component Report Endpoint. The manipulation of the argument fromdate/todate results in sql injection. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.