SourceCodester Simple Online Food Ordering System version 1.0 contains a SQL injection vulnerability in the /admin/ajax.php?action=login2 endpoint. The vulnerability arises from improper handling of the 'email' parameter, allowing remote attackers to inject SQL commands. This flaw has been publicly disclosed, but no official patch or fix has been provided yet.
Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate privileges.
An Improper Input Validation vulnerability (CWE-74) exists in the CData JDBC driver integration within Google Cloud BigQuery Data Transfer Service versions prior to 2026-05-01. This flaw allows an authenticated attacker to execute remote code in the connector container and escalate privileges within the tenant project by using crafted JDBC connection string parameters. The vulnerability was patched on May 1, 2026, and no customer action is required.
CVE-2026-79804 is a SQL injection vulnerability in the SililaWijesinghe Food Ordering System affecting the /search.php file. The issue arises from manipulation of the search_box argument, allowing remote attackers to perform SQL injection. The product uses a rolling release model, so specific affected or fixed versions are not clearly defined. The vendor did not respond to early disclosure attempts. Public exploit code is available. The vulnerability has a CVSS score of 6.9, indicating medium severity.
CVE-2026-63621 is an improper input validation vulnerability in the Apache Camel Knative component. It allows unauthenticated attackers to inject internal Camel headers via structured-mode CloudEvent requests, potentially enabling server-side request forgery, path traversal, or message dispatch redirection. This issue affects multiple Apache Camel versions and is fixed in later releases.
A SQL injection vulnerability exists in itsourcecode Online Clinic Management System 1.0 within the Admin Login component's success/login.php file. The vulnerability allows remote attackers to manipulate the Username argument to execute unauthorized SQL commands. The vulnerability has a CVSS score of 7.3 (medium severity) and public exploit details have been disclosed. No patch or remediation information is currently available.
A SQL injection vulnerability exists in itsourcecode Real Estate Management System 1.0 within the search.php file. The issue arises from manipulation of the search, delivery_type, search_price, or property_type arguments. This vulnerability can be exploited remotely and has a CVSS score of 7.3, indicating a medium severity. No patch or remediation information is currently available, and no known exploits are reported in the wild.
CVE-2026-78185 is a SQL injection vulnerability in itsourcecode Sales and Inventory System version 1.0, specifically in the /pages/cust_edit.php file via manipulation of the ID argument. It allows remote attackers to inject SQL commands. The vulnerability has a medium severity with a CVSS score of 6.3. Exploit code is publicly available, but no vendor patch or remediation guidance has been provided.
CVE-2026-78199 is a SQL injection vulnerability in SourceCodester Simple Online Food Ordering System version 1.0. The flaw exists in the /fos/view_prod.php file where manipulation of the ID argument allows injection of SQL commands. This vulnerability can be exploited remotely without authentication. The exploit code is publicly available, increasing the risk of exploitation. The vulnerability has a CVSS score of 6.9, indicating a medium severity level.
SourceCodester Simple Online Food Ordering System version 1.0 contains a SQL injection vulnerability in the /fos/admin/ajax.php?action=add_to_cart endpoint. The flaw is due to improper handling of the pid parameter, allowing remote attackers to manipulate SQL queries. This vulnerability has a CVSS 3.1 base score of 7.3, indicating medium severity. No official patch or remediation guidance is currently available. Public exploit details have been disclosed, but no known exploits are reported in the wild.
CVE-2026-78171 is a medium severity SQL injection vulnerability in itsourcecode Sales and Inventory System version 1.0. It affects the /pages/processlogin.php file and can be exploited remotely without authentication by manipulating the User argument. No patch or remediation information is currently available, and no known exploits are reported in the wild.
CVE-2026-78143 is a SQL injection vulnerability in version 1.0 of the Barangay Resident Profiling Management System affecting the Resident Search functionality in the residents.php file. This flaw allows remote attackers to manipulate the Search argument to execute unauthorized SQL commands. The vulnerability has a CVSS 3.1 score of 7.3, indicating medium severity. There are no known exploits in the wild and no official patch or remediation information is currently available.
KEDA versions prior to 2.20.0 contain an injection vulnerability in the PostgreSQL scaler component. The vulnerability arises because connection strings are constructed from tenant-controlled parameters without sufficient escaping, allowing injection of additional connection parameters. This can enable an attacker with permissions to create or modify TriggerAuthentication or ScaledObject resources to redirect database connections, expose credentials, or disable TLS protections. The issue is fixed in version 2.20.0.
ProfilePress WordPress plugin versions before 4.17.1 contain a vulnerability where shortcodes are not stripped from two profile fields before rendering on public pages. This allows unauthenticated attackers to store shortcodes that execute when the page is viewed, potentially disclosing a user's email address, login, and registration date.
CVE-2026-59296 is a medium severity vulnerability in Spring Micrometer involving improper output neutralization for logs (CWE-117). It arises from using untrusted, non-normalized input directly in metrics data such as metric names, tag keys, or tag values. This can lead to injection issues affecting the integrity of logs or monitoring data. The affected versions include Micrometer 1.17.0, 1.16.0 through 1.16.6, 1.15.0 through 1.15.12, 1.14.0 through 1.14.16, and 1.9.18 and earlier. No known exploits are reported in the wild, and no official patch or remediation details are provided in the input data.
CVE-2026-55558 is a medium severity vulnerability in aiosmtplib, an asynchronous SMTP client. Prior to version 5.1.2, the SMTPProtocol.start_tls method improperly handles the server's 220 response by not clearing an internal buffer before starting the TLS handshake. This allows an active network attacker to inject attacker-controlled SMTP response lines that survive the TLS upgrade, causing desynchronization of SMTP command and response pairs. The issue affects connections using start_tls=True or opportunistic STARTTLS, but not those using use_tls=True. The vulnerability is fixed in version 5.1.2.
CVE-2026-76050 is a SQL injection vulnerability in SourceCodester Simple Online Food Ordering System version 1.0. The flaw exists in the /admin/ajax.php endpoint when handling the 'delete_menu' action, specifically through manipulation of the 'ID' parameter. This vulnerability can be exploited remotely without authentication. The exploit code has been publicly disclosed. The vulnerability has a medium severity rating with a CVSS score of 6.9.
CVE-2026-76049 is a SQL injection vulnerability in SourceCodester Simple Online Food Ordering System version 1.0. It affects the /admin/ajax.php?action=save_menu endpoint by allowing remote attackers to manipulate the ID parameter to execute unauthorized SQL commands. The vulnerability has a medium severity with a CVSS score of 6.9. Public exploit details have been disclosed, but no official patch or remediation is currently documented.
CVE-2026-75986 is a medium severity SQL injection vulnerability in code-projects Online Job Portal System version 1.0. It affects the Password Recovery component, specifically the /ForPass.php file, where manipulation of the txtUserName argument allows SQL injection. The vulnerability can be exploited remotely without authentication. Public exploit details have been disclosed.
WeasyPrint versions prior to 69.0 contain a CSS injection vulnerability due to unescaped HTML presentational-hint attribute values being embedded into CSS. This allows injection of additional CSS declarations and potentially server-side requests via injected url() values when rendering untrusted HTML with presentational hints enabled. The issue is fixed in version 69.0.