A security vulnerability has been detected in amirsanni mini-inventory-and-sales-management-system up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. Impacted is an unknown function of the file application/controllers/Items.php of the component Items Management Module. The manipulation of the argument itemName leads to cross site scripting. Remote exploitation of the attack is possible. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The vendor was contacted early about this disclosure but did not respond in any way.
A security flaw has been discovered in amirsanni Mini-Inventory-and-Sales-Management-System up to 81bf0b55f5933f3b0dbb1583204a612e06605b95. The impacted element is the function order_by of the file DB_query_builder.php of the component Database Query Builder. Performing a manipulation of the argument orderBy results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks. This product follows a rolling release approach for continuous delivery, so version details for affected or updated releases are not provided. The project maintainer confirms: "I stopped maintaining that project for a while now, so I'm not sure it's worth fixing." This vulnerability only affects products that are no longer supported by the maintainer.
CVE-2026-101061 is a server-side request forgery (SSRF) vulnerability affecting the universal-tool-calling-protocol python-utcp versions before 1.1.1. The flaw exists because the GraphQL plugin's prefix check can be bypassed with crafted URLs, and the WebSocket plugin lacks URL validation. This allows attackers to make the server connect to internal services or cloud metadata endpoints and potentially exfiltrate sensitive API keys and OAuth tokens. The vulnerability has a low CVSS score of 2.3 and requires user interaction and high attack complexity.
python-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in HttpCommunicationProtocol.call_tool that validates the initial tool URL but follows HTTP redirects without re-validating the target. Attackers controlling a tool endpoint can return a 302 redirect to internal services, allowing the UTCP client to reach cloud metadata endpoints or internal HTTP services and return their response bodies to the caller.
utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary endpoints. When a victim registers an attacker-controlled OpenAPI spec and invokes a generated OAuth2-protected tool, the library POSTs the victim's client_id and client_secret to the attacker-supplied token endpoint without URL validation.
CVE-2026-101058 is a Server-Side Request Forgery (SSRF) vulnerability in the python-utcp package (pip package utcp-http) versions before 1.1.12. The flaw allows an attacker who can serve a UTCP manual to a victim to cause the client to send requests to services bound to the victim's loopback interface (127.0.0.1). This occurs because the package does not verify if tool URLs declared in a UTCP manual fetched from a remote origin point to the loopback interface. The vulnerability affects the http, sse, and streamable_http protocols. Exploitation requires a loopback service that responds to unauthenticated requests with useful data. The issue is fixed in version 1.1.12, which rejects manuals fetched from non-loopback origins that declare loopback tool URLs.
CVE-2026-101057 is a vulnerability in the utcp-mcp plugin of python-utcp up to version 1.1.2 where it connects to HTTP and WebSocket MCP server URLs without enforcing secure URL validation. This allows cleartext transmission of the MCP handshake to non-secure HTTP servers, potentially exposing sensitive information to network interception. The vulnerability is limited by the fact that the server URLs are operator-configured and the OAuth2 authentication path is not invoked in affected versions. The issue is fixed in version 1.1.3 by validating server URLs before connection.
Parse Server versions >=8.0.2 <8.6.91 and >=9.0.0 <9.10.1-alpha.10 have an improper authentication vulnerability in their code-based authentication adapters. These adapters do not verify the client's authorization code with the external provider during login when authentication data is supplied with username and password. This allows a low-privileged authenticated user to link an arbitrary, unverified external provider identity to their account, potentially spoofing trusted identities. Additionally, attackers can pre-hijack accounts by claiming a provider ID before the legitimate user links it. Versions 8.6.91 and 9.10.1-alpha.10 fix this by verifying credentials on login and rejecting already linked provider IDs. Disabling affected adapters is a recommended workaround.
CVE-2026-101032 is a high-severity OS command injection vulnerability in the denisidoro navi tool. Versions up to and including 2.24.0 improperly neutralize special shell characters in cheatsheet variable values, allowing attackers to inject arbitrary shell commands via crafted file names in suggestion command directories. This can lead to execution of commands with the privileges of the victim user.
Parse Server is an open-source backend server. In versions >= 9.0.0 and < 9.10.1-alpha.8, and in versions < 8.6.89, LiveQuery evaluates the protectedFields class-level permission against an incompletely resolved caller identity: the subscriber's roles are not resolved, and when a subscription does not supply its own session token the event payload is redacted against an anonymous identity even though the read was authorized against the connected user. As a result, field masks defined for a role, for authenticated users, or for a specific user are not applied, so an authenticated subscriber can receive field values that the REST API correctly withholds and can use a masked field to filter or watch a subscription. Only classes with LiveQuery enabled that define protectedFields under a role:, authenticated, or per-user group are affected; masks under the public (*) group are applied correctly. The issue is fixed in 9.10.1-alpha.8 and 8.6.89. As a workaround, additionally define the affected field masks under the public (*) group, or disable LiveQuery for classes whose class-level permissions rely on role-scoped, authenticated, or per-user protectedFields groups.
Parse Server is an open source backend server. In versions prior to 8.6.90 and in versions from 9.0.0 prior to 9.10.1-alpha.9, the device token deduplication logic for installation records does not validate the type of client-supplied installation fields before using them to build database queries. An unauthenticated remote attacker who knows only the public application ID can submit non-string values in these fields to inject query operators, causing the deduplication cleanup — which runs with elevated privileges before class-level permissions are evaluated — to delete every device registration in the application or an attacker-chosen subset of them. No account, session token, master key, or user interaction is required. Deleted registrations cannot be recovered on the server, so push notifications cannot be delivered until every client re-registers. Any deployment that exposes the REST API to clients and uses push notifications is affected in its default configuration. Versions 8.6.90 and 9.10.1-alpha.9 fix the issue by rejecting non-string values with a client error and by scoping the deduplication cleanup to the calling application. No workaround other than upgrading is available.
The Knit Pay – Cashfree, Instamojo, Razorpay, PayPal and more plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 9.6.1.0. This is due to the `maybe_update_user_role()` function reading the target role directly from an attacker-controlled Gravity Forms entry field — configured via the feed's `user_role_field_id` — and passing it to `WP_User::set_role()` without validating the supplied value against an allowlist of permitted roles. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to administrator by tampering with the hidden role field value at form submission time. Exploitation is further enabled by the fact that $0 orders are synchronously marked as SUCCESS during form submission without requiring a real payment, and when no GF User Registration user can be resolved, the role assignment target falls back to `$lead['created_by']` — the currently authenticated submitter's own user ID — making any authenticated form submitter an eligible exploitation target.
A vulnerability has been found in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function echo of the file admin/fun/addLog.php. The manipulation of the argument reason/detail leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
A flaw has been found in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this vulnerability is an unknown functionality of the file example_lite.sql. Executing a manipulation can lead to use of default credentials. It is possible to launch the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-97648 is a cross-site request forgery (CSRF) vulnerability in the ningzichun student-management-system up to commit 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. The vulnerability allows remote attackers to perform unauthorized actions by tricking authenticated users into submitting forged requests. The affected function is unspecified. The vulnerability is publicly known and exploitable. No patch or vendor response has been reported yet.
A security vulnerability has been detected in ningzichun student-management-system up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. This impacts an unknown function of the file user/editLog.php. Such manipulation of the argument sid/addtime/type/reason/detail/logdate leads to authorization bypass. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-97646 is an authorization bypass vulnerability in the ningzichun student-management-system affecting the admin/fun/getStudent.php file. The vulnerability arises from manipulation of the sid argument, allowing remote attackers to bypass authorization controls. The issue was reported early to the project but remains unaddressed. Public exploit code is available. The vulnerability has a medium severity rating with a CVSS 4.0 base score of 6.9.
A vulnerability was found in SPON Communications IP Network Audio Device XC-9603 1.2.3_20181106 Build 107. This affects the function loadCfg of the file /ini/sys_cfg.txt of the component Configuration File Download. The manipulation results in information disclosure. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.