CVE-2026-82613 is a medium severity SQL injection vulnerability in itsourcecode Online Medicine Delivery System version 1.0. It affects the loadResultList function in the Product Search Interface component, specifically in the /index.php?q=product file. The vulnerability allows remote attackers to manipulate the Search argument to perform SQL injection. Exploit code is publicly available, but no official patch or remediation guidance has been provided yet.
CVE-2026-82612 is a SQL injection vulnerability in itsourcecode Online Medicine Delivery System version 1.0. The flaw exists in the loadResultList function of the /index.php?q=single-item file on the Product Detail Page component. An attacker can remotely manipulate the ID argument to execute unauthorized SQL commands. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Public exploit code has been disclosed, but no known active exploitation in the wild has been reported. No official patch or remediation guidance is currently available from the vendor.
Arbitrary file write in /vfm-admin/index.php?section=translations&action=update in Veno File Manager Project 4.4.9 allows an authenticated user with the role of super administrator to overwrite any php file in the application via a specially crafted POST request to the affected endpoint.
Path traversal leading to Arbitrary File Read in /vfm-admin/index.php and /vfm-admin/ajax/streamvid.php in Veno File Manager Project 4.4.9 allows and authenticated attacker with super administrator role to disclose sensitive information via two specially crafted http requests (POST and GET) to the affected endpoints.
AVideo contains an information exposure vulnerability in feed/index.php that allows unauthenticated attackers to retrieve channel owner email addresses by providing a public channel name. This enables attackers to enumerate all creator email addresses via RSS elements, potentially facilitating account takeover attempts and phishing campaigns. The vulnerability affects version 0 of AVideo. The CVSS 4.0 score is 6.9, indicating medium severity.
A vulnerability was detected in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0. This affects the function add_grade of the file /index.php. Performing a manipulation of the argument student_id results in improper authorization. The attack can be initiated remotely.
Grav Flex Objects Plugin allows you to build custom collections of objects. Prior to 1.4.3, the Grav Flex Objects Admin Next API requireFlexPermission() method in classes/Api/FlexApiController.php returns without denying access when a directory blueprint omits config.admin.permissions. An authenticated account with only api.access can use the index, show, create, update, delete, export, and media handlers for a permission-less directory even though the core admin.flex-object. authorization fallback would deny the same actions. This issue is fixed in version 1.4.3.
phpMyFAQ versions before 4.1.7 have a missing authorization vulnerability in the admin API read endpoints related to LDAP, Elasticsearch, OpenSearch, and dashboard configuration. This flaw allows any authenticated user to access sensitive administrative data without proper permission checks. Exploitation can reveal LDAP server topology, bind account names, search bases, index statistics, and site analytics.
Grav CMS versions prior to 2.0.15 have a path traversal vulnerability in the static asset server component (index.php). The vulnerability arises from improper directory-boundary validation, allowing unauthenticated attackers to access files outside the intended asset directory by exploiting directory names that extend the base path string. This advisory is a duplicate and has been withdrawn in favor of GHSA-4v9q-p283-qc2m.
CVE-2026-75778 is a SQL injection vulnerability in code-projects Task Management System version 1.0. The flaw exists in the Operation::select_with_multiple_condition function within the /index.php file of the Login Form component. An attacker can remotely exploit this vulnerability by manipulating the email argument to execute arbitrary SQL commands. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Public exploit code is available, but no known active exploitation in the wild has been reported. No patch or remediation information is provided.
Grav versions before 2.0.15 have a path traversal vulnerability in the static asset server within index.php. The vulnerability arises from improper pathname limitation using string prefix matching rather than proper directory-boundary validation. This allows unauthenticated attackers to access files in sibling directories by exploiting directory names that extend the base path string.
CRM+ application versions up to and including 2025.6 from Brainformatik contain a critical SQL Injection vulnerability in the check conflict endpoint. This flaw allows unauthenticated attackers to perform time-based SQL injection via the index.php?module=Appointments&action=CheckConflictOfDates&ajaxSkipHeader=true endpoint, potentially leading to arbitrary code execution.
CVE-2026-19904 is a cross-site scripting (XSS) vulnerability in SourceCodester Online Book Store System version 1.0. It affects the System Settings Module, specifically the /admin/index.php?page=site_settings file. The vulnerability allows remote attackers to inject malicious scripts. Exploit code has been publicly disclosed.
A vulnerability was detected in opensourcepos Open Source Point of Sale up to 3.4.2. This affects the function Login::index of the file app/Config/Filters.php of the component Login Endpoint. The manipulation results in improper restriction of excessive authentication attempts. The attack may be launched remotely. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 0.1.3.6 via the (top-level script) function. This is due to the plugin stores its encrypted options file as options-{migrate_key}.txt in wp-content/instawpbackups/ without deploying an index.php or .htaccess to prevent directory listing, exposing the 40-character migrate_key on Apache servers with directory indexing enabled, which allows an attacker to derive the AES-256-CBC passphrase via SHA256(migrate_key), decrypt the options file to recover the api_signature. This makes it possible for unauthenticated attackers to get the database access details and api_signature. Exploitation requires the target WordPress site to be hosted on Apache with directory listing enabled (Options +Indexes) for the wp-content/instawpbackups/ directory, and time limited because it can only be exploited during the migration period.
A vulnerability has been found in DedeCMS up to 5.7.118 UTF8SP2. The affected element is the function _4_Setup of the file install/index.php of the component Installation Wizard. Such manipulation leads to file inclusion. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used.