A vulnerability was identified in SourceCodester Online Leave Management System 1.0. This issue affects some unknown processing of the file /admin/?page=reports. The manipulation of the argument date_start/date_end leads to sql injection. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.
A vulnerability was determined in SourceCodester Online Reviewer Management System 1.0. This issue affects some unknown processing of the file /reviewer_0/admins/assessments/examproper/questions-view.php. Executing a manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.
A vulnerability was identified in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/examproper/btn_functions.php. The manipulation of the argument access_code leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and might be used.
CVE-2026-100739 is a medium severity SQL injection vulnerability in the mathurvishal CloudClassroom-PHP-Project affecting the viewresult.php file. The vulnerability arises from manipulation of the 'seno' argument, allowing remote attackers to perform SQL injection. The vendor has not responded to disclosure attempts, and no patch or fixed version information is available due to the product's rolling release model. Exploit code is publicly available, but no confirmed exploitation in the wild has been reported.
A security vulnerability has been detected in mathurvishal CloudClassroom-PHP-Project up to 5dadec098bfbbf3300d60c3494db3fb95b66e7be. This impacts an unknown function of the file updatedetailsfromstudent.php. The manipulation of the argument eno leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2026-95832 is a critical vulnerability in the kitty terminal emulator affecting versions from 0.47.3 up to but not including 0.49.0. It involves improper neutralization of special elements in output used by a downstream component, allowing an attacker to execute arbitrary shell commands with the privileges of the user running the terminal. The flaw arises because unrecognized field names in color control escape code queries are echoed back without proper sanitization, enabling command injection. This vulnerability builds on a previous fix (CVE-2026-54057) but still allows sufficient characters to compose malicious commands. The exploit leverages the pseudoterminal master interface and can be triggered remotely via SSH data handling before credential checks. The CVSS 4.0 base score is 9.3, indicating critical severity.
ViewSonic vCast software, used in ViewBoard smartboards, contains multiple unauthenticated vulnerabilities that can be chained by a remote attacker with network access to fully compromise the device. These include screen content exfiltration via unauthenticated API endpoints, unprivileged APK installation through an unauthenticated download endpoint, and arbitrary input injection via exposed network services. No vendor fix is currently available. Interim mitigations include network segmentation and monitoring.
Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring Your Own Key) deployment model, users configure their own LLM credentials to any OpenAI-compatible endpoint. Most open-source and self-deployed model providers (vLLM, SGLang, Ollama, LM Studio, text-generation-webui, etc.) do not filter special-token literals from user content in their default configurations. Those literals are parsed into structural role-boundary token IDs, meaning an attacker string planted in a target web page forges a new operator turn the model treats as authoritative, bypassing Decepticon's agent guardrails and resulting in arbitrary command execution inside the Kali Linux sandbox. Version 1.1.17 patches the issue.
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Media Image Deletion in Easy Store extension 1.0.0-3.0.0 - The media deletion endpoint (administrator/index.php?option=com_easystore&task=media.deleteImage) parsed the ids parameter as a comma-separated string and imploded it directly into raw SQL IN (...) clauses in Media.php and MediaModel.php without integer casting or parameterization. An authenticated administrator or attacker with access to an admin session could inject arbitrary SQL statements.
Joomla Extension - joomshaper.com - Authenticated, Privileged SQL Injection in Coupon Bulk Update in Easy Store extension 1.0.0-3.0.0 - The coupon bulk update task (administrator/index.php?option=com_easystore&task=coupon.couponBulkUpdate) took input IDs and directly concatenated them into raw SQL IN (...) clauses in ProductCoupon.php and CouponsModel.php without sanitization or parameterization. An authenticated administrator could manipulate the query through injected SQL syntax. Resolved by strictly casting all IDs to integers (array_map('intval', ...)) and adopting parameterized ->whereIn() query construction.
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to manipulate database queries due to improper neutralization of special elements in a boolean expression.
IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to RAG poisoning via unauthenticated runbook upsert (CWE-74) in the FTM AI agent server (api.vectordb.runbooks.js:51). An unauthenticated attacker can insert malicious runbook content into the agent's vector database to steer AI-driven MCP tool calls, potentially triggering unauthorized payment actions or exfiltrating payment data.
The Ninja Tables WordPress plugin before 5.2.17 does not restrict shortcode expansion to administrator-authored table rows which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes executed on a public page, and to permanently break that page, by submitting an ordinary form entry.
The GTranslate WordPress plugin before 5.0.1 does not remove shortcodes from the content of outgoing emails before expanding them which, in a non-default configuration, allows unauthenticated users to have arbitrary shortcodes registered on the site executed server side.
The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes.
The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbitrary shortcodes registered on the site.
The WP Photo Album Plus WordPress plugin is vulnerable to remote code execution via the wppa_image_magick function in all versions up to 9.2.09.002. The vulnerability arises from improper sanitization of the multipart upload filename before it is concatenated into an ImageMagick command executed with exec(). The use of escapeshellcmd() on the entire command does not prevent argument injection because spaces remain as separators, allowing authenticated users with subscriber-level access or higher to execute arbitrary code on the server.
CVE-2026-87701 is a critical injection vulnerability in Microsoft Azure Cosmos DB that allows an authorized attacker to elevate privileges over a network by exploiting improper neutralization of special elements in output used by a downstream component. This vulnerability has a high CVSS score of 9.6 and has been officially fixed by Microsoft. The service is cloud-hosted, and Microsoft manages the remediation.
CVE-2026-90999 is a critical vulnerability in Functional Software, Inc.'s Sentry Seer that involves improper input validation. This flaw allows an unauthenticated attacker to submit malicious telemetry data that is subsequently executed as code by a privileged automation agent. The attacker does not need access to the victim's Sentry account, source repository, or infrastructure to exploit this issue.