A vulnerability was detected in itsourcecode Hospital Management System 1.0. This impacts an unknown function of the file /viewadmin.php. The manipulation of the argument delid results in sql injection. The attack may be performed from remote. The exploit is now public and may be used.
Ninja Forms WordPress plugin versions before 3.14.10 allow unauthenticated attackers to execute arbitrary shortcodes via user-supplied query-string input used to pre-populate form fields. This occurs because the plugin does not prevent such input from being processed as shortcodes when embedded on public pages.
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in the CSS scrubber in rrrene html_sanitize_ex allows an unauthenticated remote attacker to inject CSS at-rules, including an import of a remote stylesheet, into a page served to other users. HtmlSanitizeEx.Scrubber.CSS.scrub/1 applies its property and value allowlist through a Regex.replace over substrings matching a property: value declaration pattern, so input that does not match that pattern is never inspected and is copied to the output unchanged. @import url(//attacker.example/style.css); survives, while the same URL inside a background: url(...) declaration is removed.
Element boundaries are resolved before the scrubber runs, so injected content does not escape the <style> element and no script executes.
This issue affects html_sanitize_ex: from 0.3.1 before 1.4.5 and from 1.5.0-rc.0 before 1.5.4.
SourceCodester Computer Repair Shop Management System 1.0 contains a SQL injection vulnerability in the /classes/Master.php?f=delete_product endpoint. The vulnerability allows remote attackers to manipulate the ID parameter, potentially leading to unauthorized data access or modification. The vulnerability has a CVSS score of 7.3, indicating a medium severity level. No patch or official remediation has been provided yet. Public exploit details have been disclosed, but no known exploitation in the wild has been reported.
When a proxy server is configured with `customUrl.enabled`, the component accepts user-supplied input within forwarded HTTP headers without enforcing expected validation constraints. A malicious actor can manipulate these headers to influence the URL construction process, leading to an open redirect vulnerability. Additionally, unsanitized header values are written to application logs.
An attacker can exploit this to force redirection to arbitrary malicious domains, potentially enabling phishing attacks. Furthermore, they can inject forged entries into application logs, impacting the reliability of security logs and potentially hindering incident investigation.
hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent() and URLSearchParams, allowing path traversal and query parameter injection. This issue is fixed in version 0.5.2.
A critical injection vulnerability (CVE-2026-54680) exists in kube-logging logging-operator versions prior to 6.6.0. The Fluentd configuration renderer writes certain CRD strings directly into configuration files without proper escaping, allowing an attacker with permission to create Flow resources to inject malicious Fluentd <match **> blocks. This can lead to arbitrary command execution within the Fluentd aggregator. The issue is resolved in version 6.6.0.
CVE-2026-54666 is a high-severity vulnerability in swagger-typescript-api prior to version 13.12.2. The issue arises because OpenAPI path keys are passed into JavaScript template literals without proper escaping, allowing attacker-controlled input containing ${...} to be executed when the generated API client method is called. This improper neutralization of special elements leads to potential code injection. The vulnerability is fixed in version 13.12.2.
CVE-2026-54664 is a high severity code injection vulnerability in the swagger-typescript-api tool prior to version 13.12.2. The vulnerability arises because enum values from an OpenAPI specification are passed without proper escaping to template rendering code, allowing attacker-controlled input to inject executable code into generated TypeScript modules. This code executes when the generated module is imported. The issue is fixed in version 13.12.2.
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, templates/base/http-clients/axios-http-client.ejs interpolates servers[0].url from src/code-gen-process.ts into the HttpClient constructor without escaping, allowing an attacker-controlled OpenAPI spec to inject code that executes when new HttpClient() or new Api() is constructed. This issue is fixed in version 13.12.2.
swagger-typescript-api generates API clients for Fetch or Axios from OpenAPI specifications. Prior to 13.12.2, src/code-gen-process.ts createApiConfig copies servers[0].url into apiConfig.baseUrl, and templates/base/http-clients/fetch-http-client.ejs interpolates apiConfig.baseUrl into the generated HttpClient baseUrl field without escaping, allowing an attacker-controlled OpenAPI spec to inject TypeScript static field code that executes when the generated fetch client module is imported. This issue is fixed in version 13.12.2.
CVE-2026-18085 is a medium severity vulnerability in BlackBerry UEM Management Console versions 12.23.0 QF8 and earlier. It involves improper input validation that could allow arbitrary file download and potential denial of service. The vulnerability is related to improper neutralization of special elements in output (CWE-74). No official patch or remediation guidance is currently available from the vendor.
CVE-2026-16154 is a SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0/1.php, specifically in the /edit_room1.php file. Manipulating the ID argument remotely can exploit this flaw. The vulnerability has been publicly disclosed but no official patch or fix information is provided.
CVE-2026-54159 is a critical vulnerability in the PrestaShop ps_facetedsearch module versions 3.0.0 up to but not including 4.0.4. The module improperly handles slider filter values from the URL without sufficient validation, leading to unsafe deserialization of user-controlled data. This allows an unauthenticated attacker to inject a malicious serialized PHP object into the internal cache, which upon deserialization writes an arbitrary PHP file to the server. The malicious file can be used as a webshell to execute commands remotely. The issue is fixed in version 4.0.4.
Jupyter Enterprise Gateway launches remote Jupyter Notebook kernels across distributed clusters like Apache Spark, Kubernetes, and Docker Swarm. In versions prior to 3.3.0, the server interpolates untrusted environment variables (e.g., KERNEL_XXX) into Kubernetes manifests without YAML-aware escaping, enabling YAML injection attacks. Attackers can inject new fields, overwrite critical fields (e.g., duplicate securityContext keys, where the last one prevails), and inject document boundaries (--- for new documents, ... for end-of-document) to generate multiple resources, potentially creating arbitrary types, such as privileged pods. The Jinja2 template for the Kubernetes manifest contains several kernel_xxx variables, such as kernel_working_dir that are used when rendering the manifest and are all vectors for YAML injection. This issue has been fixed in version 3.3.0.
bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). Prior to BunkerWeb 1.6.12 and BunkerWeb PRO 0.57, authenticated Host header handling in the BunkerWeb UI and API improperly validated and neutralized user-controlled input in a configuration-dependent path, allowing a low-privileged authenticated user to escalate privileges and affect confidentiality, integrity, and availability of the BunkerWeb instance. This issue is fixed in BunkerWeb version 1.6.12 and BunkerWeb PRO version 0.57.
A flaw has been found in H3C SecPath F1000-C8300 up to 20260522. This impacts an unknown function of the file /webui/?g=log_fw_nbc_mail_jsondata. Executing a manipulation of the argument subject can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure and confirmed the existence of the vulnerability. A technical fix is planned to be released.
A vulnerability was detected in SourceCodester Simple and Nice Shopping Cart Script 1.0. This vulnerability affects unknown code of the file /admin/userproductdeletequery.php. Performing a manipulation of the argument user_id results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.
A security flaw has been discovered in code-projects Online Job Portal up to 1.0. The impacted element is an unknown function of the file /Admin/DeleteUser.php. Performing a manipulation results in sql injection. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.