A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown part of the file changebookingstatus.php of the component submit2 Handler. Such manipulation of the argument username[]/timestamp[]/status[] leads to missing authorization. The attack may be performed from remote. The exploit is publicly available and might be used. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-109524 is a medium severity vulnerability in the girishsaraf Online-Appointment-Booking-System up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5. It involves missing authorization in the Admin/showdoctor.php file within the Admin Display Pages component. The vulnerability can be exploited remotely without authentication or user interaction. The project uses a rolling release model, so specific affected or fixed versions are not provided. The issue was reported early but has not yet been addressed by the vendor. Public exploit details are available, but no known exploitation in the wild has been confirmed.
CVE-2026-109523 is a medium severity SQL injection vulnerability in the girishsaraf Online-Appointment-Booking-System. It affects an unknown functionality in the Admin/getclinic.php file's AJAX endpoint, where the city/cid argument can be manipulated to perform SQL injection. The vulnerability can be exploited remotely without authentication. The product uses a rolling release model, so specific affected or fixed versions are not available. The vendor has been informed but has not yet responded or issued a patch. Exploit code has been publicly disclosed.
CVE-2026-109522 is a medium severity SQL injection vulnerability in the girishsaraf Online-Appointment-Booking-System. It affects an unknown function in the Admin/deleteclinic.php file within the Admin CRUD Endpoint. The vulnerability arises from improper handling of the cid/did arguments, allowing remote attackers to perform SQL injection. The product uses a rolling release model, so specific affected or fixed versions are not provided. The issue was reported early to the project but has not yet been addressed. Public exploit details have been disclosed, but no known exploits are currently observed in the wild.
A vulnerability was detected in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown function of the file changebookingstatus.php. Performing a manipulation of the argument dateselected results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.
Ahold Delhaize, a Dutch-Belgian grocery giant, took some of its systems offline in response to a detected cyberattack within its network. The company stated that stores remain open and customer service is not affected, but deliveries and online orders were impacted in Belgium, the Netherlands, and the US. The incident's relation to a recent cyberattack on European supermarkets is unclear. Previous cyberattacks on Ahold Delhaize in 2024 and 2025 involved ransomware and data breaches affecting millions of individuals. The company is actively assessing and mitigating the issue.
CVE-2026-108970 is a medium severity SQL injection vulnerability in the itsmeravitejak Online-Examination-System. It affects the function MySQLDB::addNewUser in include/database.php within the Registration Form component. The vulnerability allows remote attackers to manipulate the 'branch' argument to perform SQL injection. The product uses a rolling release strategy, so specific affected versions are not provided. The issue was reported early but remains unpatched, and exploit code is publicly available.
A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is the function Session::checkLogin of the file include/session.php of the component Session Handler. Such manipulation of the argument cookname/cookid leads to incorrect comparison. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-108959 is a medium severity SQL injection vulnerability in itsourcecode Online Cake Ordering System version 1.0. The flaw exists in the /addtransacdetail.php file where manipulation of the ID argument allows remote attackers to perform SQL injection. The vulnerability has been publicly disclosed but no official patch or fix information is provided.
A vulnerability was identified in code-projects Online Reviewer System 1.0. The affected element is an unknown function of the file /reviewer/system/system/admins/manage/users/btn_functions.php of the component User Update Handler. Such manipulation leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used.
CVE-2026-108948 is a medium severity vulnerability in code-projects Online Reviewer System 1.0. It involves manipulation of the usertype_id argument in the User Profile Update Handler component, leading to dynamically-determined object attributes. The vulnerability can be exploited remotely without user interaction. Public exploit details have been disclosed. No patch or remediation information is currently available.
CVE-2026-108937 is a medium-severity vulnerability in code-projects Online Ticket Reservation System version 1.0. It involves file and directory information exposure via the /database/medallion.sql file. The vulnerability can be exploited remotely without authentication or user interaction. Public exploit code is available, but no known active exploitation in the wild has been reported.
CVE-2026-108928 is a medium severity SQL injection vulnerability in itsourcecode Online Admission System version 1.0. The flaw exists in the /admin/sum.php file where manipulation of the ID parameter allows remote attackers to execute SQL injection attacks. The vulnerability has been publicly disclosed, but no official patch or fix information is currently available.
CVE-2026-42709 is a high-severity unauthenticated cross-site scripting (XSS) vulnerability in the RadiusTheme Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin, affecting versions up to 6.0.5. This vulnerability allows attackers to inject malicious scripts during web page generation without authentication. The flaw is categorized under CWE-79, indicating improper neutralization of input. No specific affected versions or patch information is provided in the available data.
This report investigates alleged cyberattacks targeting Discord communities focused on powerscaling discussions, centering on the Noblesse server linked to creator ZetaSolos. The incidents include mass bans, automated disruptions, and retaliation claims such as doxxing and extortion against moderators. Broader allegations involve coordinated raids, mass-reporting campaigns, social engineering, account compromises, harassment, and extortion. The investigation compiles available evidence but notes that not all claims are independently verified. It highlights the security risks faced by online communities from compromised accounts and inadequate security practices. The report encourages server owners and moderators to secure accounts, review permissions, and preserve evidence. No specific software vulnerability or exploit code is detailed, and no patch or remediation status is provided.
The Online Scheduling and Appointment Booking System – Bookly WordPress plugin is affected by a PHP Object Injection vulnerability through deserialization of untrusted input in the 'value' parameter. This affects all versions up to and including 28.2. The vulnerability requires authenticated attackers with custom-level access or higher. No known exploit gadget chains are currently available. The vulnerability has a high severity rating with a CVSS score of 7.2.
LifterLMS – WP LMS for eLearning, Online Courses, & Quizzes plugin for WordPress versions up to and including 10.2.1 contains a PHP Object Injection vulnerability via deserialization of untrusted input. This vulnerability requires authenticated users with edit_course capability roles, such as Instructor or Administrator, and is exploitable during lesson creation when a temporary lesson ID triggers a custom metadata path. Exploitation depends on the presence of a PHP Object Injection POP chain in other installed plugins or themes. Without such a POP chain, the vulnerability has no impact. If a POP chain is present, attackers may delete files, retrieve sensitive data, or execute code.
CVE-2026-103365 is a medium severity vulnerability in the Bookly Online Scheduling and Appointment Booking System WordPress plugin up to version 28.4. It allows unauthenticated attackers to access sensitive customer information by exploiting an endpoint that improperly validates requests and uses attacker-supplied identifiers to retrieve personal data. This exposure includes customer names, emails, phone numbers, and internal notes when certain placeholders are used in the booking form's Details step.
The Bookly plugin for WordPress up to version 28.4 contains an authorization bypass vulnerability due to insecure direct object reference via user-controlled parameters. Authenticated users with subscriber-level access or higher can exploit this flaw to overwrite the WordPress account binding of any Bookly staff record, including administrators, leading to privilege escalation. Exploitation requires the attacker to be linked to at least one Bookly staff record, which is enabled by default on fresh installs with a specific option active.
This content discusses which certifications currently satisfy the Department of Defense (DoD) CSSP Analyst requirement under DoD 8140/8570. It highlights conflicting information from various online sources regarding acceptable certifications such as CEH, CySA+, GCIA, GCIH, SCYBER, and CFR. The author seeks clarification from individuals familiar with the DoD requirements and notes difficulty accessing official DoD information due to CAC access issues.