Koha's guided report builder (reports/guided_reports.pl) reads the CGI parameter and, for each value, a dynamically-named parameter, and concatenates both directly into an SQL ORDER BY clause with no allowlist or validation. Since ORDER BY columns cannot be bound via prepared-statement placeholders, this requires an explicit allowlist, which does not exist.
CVE-2026-16022 is an OS command injection vulnerability in @oblique/cli version 15.4.0. The vulnerability arises because the CLI constructs shell commands using string concatenation and executes them with execSync(), inserting a user-controlled project name without proper sanitization. This allows an attacker to execute arbitrary operating system commands by supplying a crafted project name when invoking the CLI.
CVE-2026-0516 is a medium severity vulnerability in SonicWall SonicOS involving improper neutralization of HTTP headers. This flaw allows a remote attacker to manipulate the Host header, potentially redirecting firewall management users to arbitrary web domains. No specific affected versions or patches have been disclosed yet.
The Stock-Inventory-Management-System application's login.php assigns raw username/password values to and builds its authentication query by directly concatenating those session values into a SQL statement with no parameterization or escaping. The same script additionally contains hardcoded administrative credentials (admin/neola) in a post-login conditional check, providing a second, independent full-authentication-bypass path.
The raster Rust crate's crop function (src/editor.rs) clamps the crop width/height against source dimensions but only clamps the offset_x/offset_y parameters against 0, never against the source width/height.
The Backup Migration plugin for WordPress contains a command injection vulnerability in all versions up to and including 2.1.5.1. This flaw arises from improper sanitization of the 'file' POST parameter in the restoreBackup() AJAX handler, allowing authenticated users with administrator or equivalent privileges to execute arbitrary OS commands as the web-server user. This vulnerability bypasses WordPress hardening constants that normally restrict code execution from the admin UI. It is a partial regression of a previous vulnerability (CVE-2023-7002) where similar mitigations were not applied consistently.
Groundhogg CRM plugin for WordPress up to version 4.5.2 has an authorization bypass vulnerability via its REST API endpoint. Authenticated users with the view_contacts capability but without view_others_contacts can access any contact record, including sensitive personal information and user capabilities. This occurs because the endpoint lacks proper object-level ownership checks.
The Seraphinite Accelerator WordPress plugin contains a reflected cross-site scripting (XSS) vulnerability via the 'seraph_accel_prep' parameter in versions up to and including 2.29.15. This occurs because of improper input handling and insufficient output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with a crafted link.
The Material Dashboard plugin for WordPress up to version 1.4.10 contains a missing authorization vulnerability in the amd_ajax_target_task_manager() function. This flaw allows unauthenticated attackers to enumerate, execute, and delete scheduled tasks via the public_amd_ajax_handler AJAX action, potentially exposing personally identifiable information (PII). The vulnerability is tracked as CVE-2026-6079 with a high severity rating.
Dokan plugin for WordPress versions up to and including 5.0.2 contains a missing authorization check vulnerability in its CustomersController REST API. This flaw allows authenticated users with Vendor/Seller-level access or higher to read, modify, or delete any WordPress user account, including administrators. Exploiting this vulnerability by setting the password parameter on an administrator's account can lead to full site takeover.
Atals-Livre contains a SQL injection vulnerability that allows attackers to manipulate database queries by passing unsanitized input through a GET parameter to the supp() deletion helper function. Attackers can inject malicious SQL syntax via the vulnerable GET parameter to perform unauthorized database operations including data deletion and extraction.
Atlas-Livre contains an improper access control vulnerability in the admin controllers under Espace_admin/controleur/ that allows unauthenticated attackers to bypass session-based authentication guards by sending raw HTTP requests that ignore redirects. Attackers can invoke destructive admin actions such as record deletion by requesting controller endpoints with GET parameters like supp, because the PHP header() redirect is never followed by an exit or die call, allowing all subsequent code including database operations to execute regardless of session state.
Koha's reports/issues_stats.pl (the circulation statistics report) builds its calculation query in sub calculate by concatenating several user-controlled request parameters directly into the SQL string. The PeriodTypeSel, PeriodDaySel, and PeriodMonthSel parameters are interpolated raw into single-quoted equality and function-comparison fragments, and the Filter slots plus the Line and Column identifiers are likewise interpolated with no whitelist and no placeholder binding.
Koha's reports/bor_issues_top.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. An authenticated staff user holding the reports module permission can inject arbitrary SQL and read any table reachable by the Koha database user, including borrowers (password hashes, two-factor secrets, personal data), api_keys, and sessions.
Koha's reports/issues_avg_stats.pl builds dynamic SQL in sub calculate by concatenating several user-controlled request parameters directly into the query string. The Line and Column parameters are not validated against any whitelist and land verbatim in identifier positions (SELECT DISTINCTROW, GROUP BY, ORDER BY), and each Filter slot is concatenated raw into single-quoted LIKE, BETWEEN, and comparison fragments with no bound parameters.
Koha's reports/catalogue_stats.pl builds dynamic SQL in sub calculate by interpolating the user-controlled Line and Column request parameters directly into identifier positions of the query (SELECT DISTINCTROW, GROUP BY, ORDER BY) with no whitelist validation.
Koha's reports/acquisitions_stats.pl builds its per-cell statistics query in sub calculate by interpolating the user-controlled Filter request parameters directly into WHERE fragments covering aqbasket.closedate, aqorders.datereceived, aqbooksellers.name, items.homebranch, items.ccode, biblioitems.itemtype, aqbudgets.budget_code, aqorders.sort1, and aqorders.sort2.
A security flaw has been discovered in langgenius dify up to 1.14.2. This issue affects the function jinja2.Template of the file api/core/helper/code_executor/jinja2/jinja2_transformer.py of the component Jinja2 Handler. The manipulation results in improper neutralization of special elements used in a template engine. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Telenia Software TVox versions 26.5.3 and earlier 26.x, as well as 24.9.21 and earlier 24.x, contain a privilege escalation vulnerability. This flaw allows an attacker with access to the apache user account to execute arbitrary commands as root by exploiting an insecure sudoers configuration. The sudoers file grants the apache user passwordless execution of /bin/nice, which can be leveraged to run commands with root privileges. The vulnerability has a high severity rating with a CVSS score of 8.5.
Telenia Software TVox versions 26.5.3 and earlier 26.x, as well as 24.9.21 and earlier 24.x versions, contain an OS command injection vulnerability in the action_audio.php script. Authenticated attackers can exploit this flaw by passing a crafted pid parameter when the action parameter is set to checkProcess, allowing execution of arbitrary OS commands with apache user privileges.