Search: t-online.de

A vulnerability was detected in Devs Palace ERP Online up to 4.0.0. This affects an unknown function of the file /inventory/customer-save. The manipulation results in cross site scripting. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A security vulnerability has been detected in Devs Palace ERP Online up to 4.0.0. The impacted element is an unknown function of the file /inventory/supplier-save. The manipulation leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A weakness has been identified in Devs Palace ERP Online up to 4.0.0. The affected element is an unknown function of the file /inventory/purchase_return_save. Executing a manipulation can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

SourceCodester SUP Online Shopping version 1.0 contains a SQL injection vulnerability in the /admin/replymsg.php file via the msgid parameter. This flaw allows remote attackers to manipulate SQL queries without requiring authentication or user interaction. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No official patch or remediation guidance is currently available, and no known exploits have been observed in the wild. The vulnerability disclosure includes a public exploit, which may increase risk if not addressed.

SourceCodester SUP Online Shopping version 1.0 contains a SQL injection vulnerability in the /admin/message.php file via the seenid parameter. This vulnerability can be exploited remotely without authentication. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. No official patch or remediation guidance is currently available from the vendor. Exploits are publicly available, but there are no confirmed reports of exploitation in the wild at this time.

CVE-2026-8129 is a medium severity SQL injection vulnerability in SourceCodester SUP Online Shopping version 1.0. The vulnerability exists in an unknown function within the wishlist.php file, where manipulation of the delwlistid argument can lead to SQL injection. This flaw can be exploited remotely without authentication. The exploit has been publicly disclosed, but no official patch or remediation guidance is currently available from the vendor.

CVE-2026-8128 is a medium severity SQL injection vulnerability in SourceCodester SUP Online Shopping version 1.0. The flaw exists in an unknown function within the /admin/viewmsg.php file, where manipulation of the 'msgid' parameter allows remote attackers to perform SQL injection. The vulnerability is exploitable remotely without authentication. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.

CVE-2026-8097 is a medium severity SQL injection vulnerability in CodeAstro Online Classroom version 1.0. The flaw exists in the /askquery.php file where the squeryx parameter can be manipulated to perform SQL injection attacks remotely. The vulnerability has been publicly disclosed, but no official patch or remediation guidance is currently available from the vendor. Exploits have not been observed in the wild to date.

CodeAstro Online Classroom 1.0 contains a SQL injection vulnerability in an unknown function within the /OnlineClassroom/facultylogin file. The vulnerability arises from improper handling of the 'fid' argument, allowing remote attackers to manipulate SQL queries. Exploit code has been published, but there is no indication of active exploitation in the wild. The vulnerability has a medium severity rating with a CVSS score of 6.3.

CodeAstro Online Classroom 1.0 contains a SQL injection vulnerability in the /OnlineClassroom/addnewstudent endpoint. The vulnerability arises from improper handling of the 'fname' parameter, allowing remote attackers with low privileges to manipulate SQL queries. Exploit code has been publicly disclosed. The vulnerability has a medium severity rating with a CVSS score of 6.3.

CodeAstro Online Classroom 1.0 contains a SQL injection vulnerability in the /OnlineClassroom/studentdetails endpoint via the deleteid parameter. This vulnerability allows remote attackers with low privileges to manipulate SQL queries, potentially impacting confidentiality, integrity, and availability. Public exploit code has been disclosed. No patch or remediation information is currently available.

CodeAstro Online Classroom 1.0 contains a SQL injection vulnerability in the /OnlineClassroom/studentlogin endpoint. The flaw arises from improper handling of the 'sid' argument, allowing remote attackers to manipulate SQL queries. Exploit code is publicly available, increasing the risk of exploitation. The vulnerability has a medium severity rating with a CVSS score of 6.3.

A vulnerability was determined in CodeAstro Online Classroom 1.0. This impacts an unknown function of the file /OnlineClassroom/facultydetails. This manipulation of the argument deleteid causes sql injection. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Tegsoft Management and Information Services Trade Limited Company Online Support Application allows Reflected XSS. This issue affects Online Support Application: from V3 through 31122025.