A vulnerability was identified in PHPGurukul Blood Donor Management System 1.0. Affected is the function __construct of the file /application/controllers/admin/Dashboard.php of the component Admin Controllers. The manipulation leads to improper authentication. The attack can be initiated remotely. The exploit is publicly available and might be used.
A weakness has been identified in PHPGurukul Small CRM 4.0. This impacts the function unserialize of the file /crm/login.php of the component Login Success Handler. This manipulation of the argument geopluginURL causes deserialization. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is said to be difficult. The exploit has been made available to the public and could be used for attacks.
A weakness has been identified in PHPGurukul Bank Locker Management System 1.0. Affected is an unknown function of the file /blms/banker/add-locker-form.php. This manipulation of the argument addressproof causes unrestricted upload. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.
CVE-2026-90518 is a medium severity vulnerability in PHPGurukul Bank Locker Management System version 1.0. It involves improper access controls due to manipulation of the UserType argument in the sidebar.php file. This flaw can be exploited remotely without user interaction and requires low privileges. Public exploit code is available.
A vulnerability was identified in PHPGurukul Bank Locker Management System 1.0. This affects an unknown function of the file /blms/view-assign-locker.php. The manipulation of the argument ltid leads to authorization bypass. The attack may be initiated remotely. The exploit is publicly available and might be used.
CVE-2024-58382 is a high-severity vulnerability in thephpleague commonmark versions before 2.6.0. It involves inefficient algorithmic complexity in Markdown parsing, allowing attackers to cause denial of service by submitting specially crafted Markdown inputs that trigger worst-case polynomial time performance. This can exhaust CPU resources and PHP-FPM processes when multiple requests are sent in parallel.
CVE-2026-86435 is a denial of service vulnerability in thephpleague commonmark's Footnote extension. Versions from 1.5.0 up to but not including 2.8.4 fail to deduplicate footnote definitions, allowing attackers to craft documents with duplicate footnotes that cause quadratic output expansion. This results in excessive memory and CPU consumption, potentially exhausting server resources.
Thephpleague commonmark versions 2.0.0 up to but not including 2.8.4 contain a denial of service vulnerability due to inefficient algorithmic complexity in the UniqueSlugNormalizer::normalize() function. This vulnerability occurs when certain extensions are registered, allowing an attacker to cause excessive CPU consumption by forcing many headings to collapse to the same base slug. The issue was patched in version 2.9.0.
CVE-2026-86433 is a denial of service vulnerability in thephpleague commonmark's Attributes extension affecting versions from 1.5.0 up to but not including 2.8.4. The vulnerability arises from an inefficient quadratic-time algorithm in AttributesListener::findTargetAndDirection(), which can be exploited by unauthenticated attackers submitting repeated attribute blocks to exhaust server resources and cause parsing delays exceeding 5 seconds.
CVE-2026-86432 is a denial of service vulnerability in thephpleague commonmark's XmlRenderer component. Versions from 2.0.0 up to but not including 2.8.4 are affected. The vulnerability arises because the XmlRenderer emits indentation proportional to the depth of every XML tag, which can be exploited by providing deeply nested Markdown or AST structures. This causes quadratic memory consumption and output amplification, potentially exhausting server resources.
A cross-site scripting (XSS) vulnerability exists in thephpleague/commonmark versions 2.7.0 up to but not including 2.9.1. The flaw occurs in the AttributesExtension where a form feed character prefix in attribute names bypasses filtering, allowing malicious event handlers and javascript: URIs to be injected. This can lead to script execution when untrusted Markdown is rendered with the AttributesExtension enabled. The issue is fixed in version 2.9.1.
CVE-2026-86430 affects thephpleague commonmark versions before 2.9.1 and involves multiple denial of service vulnerabilities. These vulnerabilities arise from inefficient algorithmic complexity in processing fenced code blocks, reference link label lookups, and emphasis delimiter sequences. Attackers can exploit these flaws by submitting specially crafted Markdown input that causes excessive CPU consumption, leading to denial of service conditions.
Thephpleague/commonmark library versions 1.5.0 up to but not including 2.9.1 contain a vulnerability causing quadratic parsing complexity in the SmartPunctExtension and AttributesExtension. These extensions are not enabled by default. An unauthenticated attacker can exploit this by submitting crafted Markdown documents to cause excessive CPU usage and denial of service. The issue is fixed in version 2.9.1.
Thephpleague commonmark versions from 1.5.0 up to but not including 2.10.0 contain a denial of service vulnerability due to inefficient algorithmic complexity in the AttributesExtension. This flaw allows attackers to submit Markdown with many distinct attribute names, causing quadratic-time processing that consumes excessive CPU resources and disrupts legitimate requests.
Twig versions from 1.0.0 up to but not including 3.27.0 contain a vulnerability where the SecurityPolicy::checkMethodAllowed() function unconditionally allows all method calls on instances of Twig\Markup and its subclasses. This flaw allows sandboxed templates to access every public method of Markup-derived objects, bypassing configured method restrictions. The issue was fixed in version 3.27.0.
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.5 and 5.7.5, packages/panels/src/Auth/Pages/Login.php presents the multi-factor authentication challenge before evaluating canAccessPanel(). For an account that canAccessPanel() denies, submitting the correct password renders the MFA challenge while an incorrect password returns the generic authentication failure, allowing an unauthenticated attacker to confirm whether a candidate password is valid for that account. When email-based MFA is configured, the correct-password path also sends a login code to the account holder. The issue applies only to accounts that have MFA enabled and are denied panel access. Authentication is not bypassed because canAccessPanel() still runs after the challenge, and no session is created. This issue is fixed in versions 4.12.5 and 5.7.5.
Filament is a collection of full-stack components for accelerated Laravel development. From 4.0.0 until 4.12.6 and 5.7.6, packages/panels/src/Auth/MultiFactor/App/AppAuthentication.php uses AppAuthentication::verifyCode() with a used-code cache key derived from both the app authentication secret and the submitted TOTP code. This isolates the newest accepted timestep by code instead of by secret, allowing a previously issued app-based MFA code to be accepted after a newer code has already been used. Reuse of the exact same code was already prevented, but another code inside the accepted time window remained usable. An attacker who obtains the target account's password and one app-based MFA code can use that code for the remainder of the configured window, which is approximately four minutes with the default settings, even after the legitimate account holder logs in with a newer code. Email-based MFA is not affected. This issue is fixed in versions 4.12.6 and 5.7.6.
CVE-2026-62993 is a Server-Side Request Forgery (SSRF) vulnerability in the Smarty PHP template engine affecting versions prior to 4.5.7 and 5.8.2. The issue arises from improper validation of URLs in the {fetch} function, allowing an attacker to bypass trusted URI checks via open redirects on trusted hosts. This can lead to SSRF attacks where internal endpoints are accessed by the server. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. It is fixed in Smarty versions 4.5.7 and 5.8.2.
CVE-2026-82424 is a SQL injection vulnerability in PHPGurukul Student Information System version 1.0. The vulnerability exists in the /student_edit1.php file where manipulation of the ID argument can lead to SQL injection. This flaw allows remote attackers to potentially execute unauthorized SQL commands. The vulnerability has a medium severity rating with a CVSS score of 5.3. No official patch or remediation guidance is currently available.