Threat Intelligence Database

CVE-2026-78057 is a medium severity SQL injection vulnerability in the sambitraj Student-Management-System affecting the Management Mutation Handler component. The flaw allows remote attackers to manipulate several input arguments (roll_no, name, father_name, class, mobile, email, password, remark) to perform SQL injection. The product uses a rolling release strategy, so specific affected versions are not provided. The vendor has not responded to the issue report, and no patch or remediation is currently available. Exploit code has been published but no known exploitation in the wild has been reported.

CVE-2026-78056 is a medium severity SQL injection vulnerability in the sambitraj Student-Management-System affecting the Dashboard component. The flaw allows remote attackers to manipulate the roll_no or teacher_name parameters to execute SQL injection attacks. The product uses a rolling release model, so specific affected versions are not available. The vulnerability was reported early, but the vendor has not yet responded or provided a fix. Public exploit code is available, but no confirmed exploitation in the wild has been reported.

CVE-2026-78055 is a cross-site scripting (XSS) vulnerability in SourceCodester Class and Exam Timetabling System version 1.0. The issue arises from improper handling of the 'course' argument in the /BSIT2.php file, allowing remote attackers to inject malicious scripts. The vulnerability has a medium severity score of 5.3 and requires user interaction for exploitation. There is no official patch or remediation guidance currently available.

CVE-2026-78136 is a high severity vulnerability in chirpmyradio CHIRP before commit 39178db. It involves an eval injection flaw in the _clean_tmode function within drivers/kenwood_itm.py, triggered by crafted CSV data. This improper neutralization of directives in dynamically evaluated code (CWE-95) can lead to high impact on confidentiality, integrity, and availability.

SourceCodester Class and Exam Timetabling System version 1.0 contains a cross-site scripting (XSS) vulnerability in an unspecified function within the /BSIS1.php file. The vulnerability arises from improper handling of the 'course' argument, allowing remote attackers to inject malicious scripts. Public exploit code is available, but no official patch or remediation has been confirmed. The CVSS 4.0 base score is 5.3, indicating a medium severity risk.

ThreatFox IOCs for 2026-08-22

CVE-2026-78051 is a medium severity vulnerability in alexta69 MeTube up to version 2026.06.10. It involves unauthorized access to files or directories via the Cookie File Handler component, specifically the /download/.metube/cookies.txt file. The vulnerability can be exploited remotely without authentication and has been publicly disclosed. Upgrading to version 2026.06.20 resolves the issue.

The WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels WordPress plugin contains a directory traversal vulnerability in the get_image_src_in_base64 function. This vulnerability affects all versions up to and including 4.9.8. Authenticated users with subscriber-level access or higher can exploit this flaw to read arbitrary files on the server. The contents of these files are base64-encoded and embedded into cached invoice HTML, which is then accessible through the plugin's Print/Download invoice endpoints. These endpoints require only a valid nonce and access key for access.

The Security Hardener WordPress plugin up to version 2.4.4 has a missing authorization vulnerability that allows authenticated users with Subscriber-level access to escalate privileges. The plugin overwrites REST API permission callbacks, removing critical capability checks, enabling attackers to create new Administrator accounts or reset Administrator passwords via REST endpoints. This vulnerability is active by default without special configuration.

The PPWP – Password Protect Pages WordPress plugin is affected by a PHP Object Injection vulnerability via deserialization of untrusted input in the 'post_protection_roles' parameter. This affects all versions up to and including 1.9.18. Exploitation requires authenticated access at Contributor level or higher. No direct impact occurs unless another plugin or theme with a PHP Object Injection POP chain is present, which could then enable actions such as arbitrary file deletion, sensitive data retrieval, or code execution.