LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 16.1.0 to before 27.0.3 and 28.0.1, While the frontend of the media module filters files that the user should not have access to, the backend was not applying access checks and it would be possible for someone who should not have access to a file to access it if they know the filename. This vulnerability is fixed in 27.0.3 and 28.0.1.
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. Prior to 27.0.3 and 28.0.1, a SQL injection has been identified in some code sections for the MRI feedback popup window of the imaging browser. Attackers can use SQL ingestion to access/alter data on the server. This vulnerability is fixed in 27.0.3 and 28.0.1.
Masteriyo LMS plugin for WordPress versions up to 2.1.7 contains an authorization bypass vulnerability due to insufficient webhook signature verification. The webhook endpoint processes unauthenticated requests and only verifies signatures if a webhook_secret is configured and the HTTP_STRIPE_SIGNATURE header is present. Since webhook_secret defaults to an empty string, attackers can send unauthenticated fake Stripe webhook events with arbitrary order_id values, marking orders as completed without payment and gaining unauthorized access to paid course content.
LearnPress – WordPress LMS Plugin versions up to 4.3.3 contain a stored cross-site scripting (XSS) vulnerability in the 'skin' attribute of the learn_press_courses shortcode. This occurs due to insufficient sanitization and escaping of the attribute value, which is directly used in HTML generation without proper escaping. Authenticated users with Contributor-level access or higher can exploit this to inject malicious scripts that execute when other users view the affected pages. The vulnerability has a CVSS score of 6.4, indicating medium severity.
A vulnerability was identified in code-projects Online Hotel Booking 1.0. Affected by this vulnerability is an unknown functionality of the file /booknow.php of the component Booking Endpoint. Such manipulation of the argument roomname leads to cross site scripting. It is possible to launch the attack remotely. The exploit is publicly available and might be used.
Open edX Platform enables the authoring and delivery of online learning at any scale. The view_survey endpoint accepts a redirect_url GET parameter that is passed directly to HttpResponseRedirect() without any URL validation. When a non-existent survey name is provided, the server issues an immediate HTTP 302 redirect to the attacker-controlled URL. Additionally, the same unvalidated URL is embedded in a hidden form field and returned in a JSON response after form submission, where client-side JavaScript performs location.href = url. This enables phishing and credential theft attacks against authenticated Open edX users. This vulnerability is fixed with commit 76462f1e5fa9b37d2621ad7ad19514b403908970.
CVE-2026-5682 is a medium severity vulnerability in the Meesho Online Shopping App for Android versions up to 27.3. It involves the use of a risky cryptographic algorithm in an unknown function within the /api/endpoint component com.meesho.supply. The vulnerability can be exploited remotely but requires a high level of complexity, making exploitation difficult. Although the exploit has been publicly disclosed, there are no known exploits in the wild. No official patch or remediation guidance has been provided yet.
CVE-2026-5666 is a medium-severity vulnerability in code-projects Online FIR System version 1.0. It involves insecure storage of sensitive information due to an issue in the SQL Database Backup File Handler component, specifically related to the /complaints.sql file. The vulnerability can be exploited remotely without authentication. Although the exploit is publicly available, there is no confirmed patch or official remediation at this time.
A security vulnerability has been detected in code-projects Online FIR System 1.0. Affected by this vulnerability is an unknown functionality of the file /Login/checklogin.php of the component Login. The manipulation of the argument email/password leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
CVE-2026-5650 is a medium severity vulnerability in code-projects Online Application System for Admission version 1.0. It involves insecure storage of sensitive information due to a flaw in an unknown function within the /enrollment/database/oas.sql file. The vulnerability can be exploited remotely without authentication or user interaction. Although an exploit has been made public, there is no confirmed patch or official remediation available at this time.
CVE-2026-5649 is a medium severity SQL injection vulnerability in version 1.0 of the code-projects Online Application System for Admission. The flaw exists in the processing of the /enrollment/admsnform.php endpoint, allowing remote attackers to manipulate SQL queries. The vulnerability has been publicly disclosed, but no official patch or remediation guidance is currently available from the vendor. Exploits have not been observed in the wild to date.
CVE-2026-5647 is a cross-site scripting (XSS) vulnerability in version 1.0 of code-projects Online Shoe Store. It affects the Add Product Page component, specifically the /admin/admin_feature.php file, where the product_name argument can be manipulated to execute XSS attacks. The vulnerability can be exploited remotely and requires user interaction with high privileges. No official patch or remediation guidance is currently available. The vulnerability has a medium severity rating with a CVSS score of 4.8.
CVE-2026-5636 is a medium severity SQL injection vulnerability in PHPGurukul Online Shopping Portal Project version 2.1. It affects the /cancelorder.php file where the 'oid' parameter is improperly handled, allowing remote attackers to inject SQL commands. The vulnerability is publicly known, but no official patch or remediation guidance has been provided yet. Exploitation could lead to unauthorized database queries or data manipulation.
CVE-2026-5635 is a medium severity SQL injection vulnerability in PHPGurukul Online Shopping Portal Project version 2.1. The flaw exists in the /categorywise-products.php file, specifically in the handling of the 'cid' parameter. This vulnerability allows remote attackers to manipulate the SQL query via the 'cid' argument, potentially leading to unauthorized database access or modification. The exploit code has been publicly released, increasing the risk of exploitation. No official patch or remediation guidance is currently available from the vendor. The vulnerability does not affect cloud services and is limited to the specified product version.
CVE-2026-5606 is a medium severity SQL injection vulnerability in PHPGurukul Online Shopping Portal Project version 2.1. The flaw exists in the /order-details.php file where the orderid parameter is improperly handled, allowing remote attackers to inject SQL code. This vulnerability could potentially allow unauthorized access or manipulation of the backend database. No official patch or remediation guidance is currently available from the vendor. Exploits in the wild are not known at this time.
CVE-2026-5580 is a medium severity SQL injection vulnerability in CodeAstro Online Classroom version 1.0. The issue exists in the /OnlineClassroom/addvideos.php file within the Parameter Handler component, where the 'videotitle' argument can be manipulated to perform SQL injection. This vulnerability can be exploited remotely without user interaction. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.
CVE-2026-5579 is a medium severity SQL injection vulnerability in CodeAstro Online Classroom version 1.0. It affects the parameter 'fname' in the file /OnlineClassroom/updatedetailsfromfaculty.php, allowing remote attackers to manipulate SQL queries. The vulnerability has been publicly disclosed but no official patch or remediation guidance is currently available. Exploitation requires low privileges and no user interaction. The impact includes potential unauthorized database access or modification. No known exploits in the wild have been reported yet.
CVE-2026-5578 is a medium severity SQL injection vulnerability in CodeAstro Online Classroom version 1.0. It affects the parameter 'deleteid' in the /OnlineClassroom/addassessment.php file, allowing remote attackers to manipulate this argument to perform SQL injection. The vulnerability has been publicly disclosed, but no official patch or remediation guidance has been provided by the vendor. Exploitation requires low privileges and no user interaction, with limited scope and impact as per the CVSS vector.
A vulnerability was found in PHPGurukul Online Shopping Portal Project 2.1. The impacted element is an unknown function of the file /payment-method.php of the component Parameter Handler. Performing a manipulation of the argument paymethod results in sql injection. It is possible to initiate the attack remotely. The exploit has been made public and could be used.
A flaw has been found in PHPGurukul PHPGurukul Online Shopping Portal Project up to 2.1. Impacted is an unknown function of the file /pending-orders.php of the component Parameter Handler. This manipulation of the argument ID causes sql injection. The attack is possible to be carried out remotely. The exploit has been published and may be used.