Threat Intelligence Database

A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::addNewUser of the file include/database.php of the component Registration Form. Performing a manipulation of the argument branch results in sql injection. The attack is possible to be carried out remotely. The exploit is now public and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The project was informed of the problem early through an issue report but has not responded yet.

A security vulnerability has been detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is the function Session::checkLogin of the file include/session.php of the component Session Handler. Such manipulation of the argument cookname/cookid leads to incorrect comparison. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-108968 is a SQL injection vulnerability in SourceCodester Performance Indicator System version 1.0. It exists in an unknown function within the file /opils/staff/sales_history.php, where manipulation of the ID argument allows injection of SQL commands. The vulnerability can be exploited remotely without authentication. Public exploit code is available, increasing the risk of attack. The CVSS 4.0 base score is 6.9, indicating a medium severity level.

CVE-2026-108967 is a SQL injection vulnerability in SourceCodester Performance Indicator System version 1.0. The flaw exists in the /opils/staff/edit_credit.php file, where manipulation of the 'credit' parameter allows injection of SQL commands. This vulnerability can be exploited remotely without authentication. Public exploit code is available, increasing the risk of attacks. The vulnerability has a medium severity rating with a CVSS score of 6.9.

CVE-2026-108966 is a SQL injection vulnerability in SourceCodester Performance Indicator System version 1.0. The vulnerability exists due to improper handling of the 'Category' argument in the /opils/staff/product.php file, allowing remote attackers to inject SQL code. An exploit is publicly available, but no official patch or fix has been indicated.

Exoproc is a TypeScript-based engine designed for Windows x64 that enables thread redirection and memory manipulation in external processes without using traditional DLL injection or creating remote threads. It supports native Windows processes and JVM instances, allowing interaction with Java classes and methods externally. The tool is intended for educational, security research, and malware analysis purposes, providing advanced instrumentation capabilities while explicitly disclaiming use for unauthorized exploitation.

This is a description of a local homelab environment designed for practicing system administration, networking, and offensive security techniques. The lab simulates an enterprise network with multiple VLANs, a perimeter firewall, Active Directory domain, and attacker platforms. It is intended as a training and testing environment rather than a vulnerability or active threat.

SourceCodester Performance Indicator System version 1.0 contains a SQL injection vulnerability in the /opils/staff/edit_quantity.php file. The vulnerability arises from improper handling of the 'pqty' parameter, allowing remote attackers to manipulate SQL queries. This flaw has a CVSS 4.0 base score of 6.9, indicating medium severity. The vulnerability has been publicly disclosed, but no official patch or fix has been provided yet. Exploitation requires no privileges or user interaction, but the impact is limited to low confidentiality, integrity, and availability impacts.

Perforce Helix Authentication Service (HAS) versions 2022.1 through 2025.2 include a vulnerability where the default SCIM bearer token is not replaced during installation, allowing unauthorized access to the SCIM API. This can be exploited to perform user and group operations. Additionally, a related prototype pollution vulnerability in the scim-patch dependency can be triggered via crafted SCIM PATCH requests, leading to application state corruption, service disruption, and potentially remote code execution in certain Node.js environments. The issue was fixed in version 2026.1 released on July 17, 2026.

CVE-2026-108964 is a SQL injection vulnerability in SourceCodester Performance Indicator System version 1.0. The flaw exists in the /opils/admin/addproduct.php file, where manipulation of the prodcategory argument allows remote attackers to perform SQL injection. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. Exploit code has been publicly disclosed, but no known active exploitation in the wild has been reported. No official patch or remediation guidance is currently available.