CVE-2026-116639 is a cross-site scripting (XSS) vulnerability in the MD-MAFUJUL-HASAN Online-Payroll-Management-System affecting an unknown function in chat.php. The vulnerability arises from manipulation of the 'ID' argument and can be exploited remotely. The product uses a rolling release model, so no specific affected or fixed versions are available. The issue was reported early to the project, but no response or fix has been provided yet. Public exploit code is available. The CVSS 4.0 score is 5.1, indicating medium severity.
CVE-2026-116605 is a vulnerability in SourceCodester Online Food Ordering System version 1.0. It involves client-side enforcement of security controls that should be enforced server-side in the order.php file, specifically through manipulation of the price/title argument. The vulnerability can be exploited remotely and public exploit code is available. The CVSS 4.0 score is 6.9, indicating a medium severity level.
A vulnerability has been found in SourceCodester Online Food Ordering System 1.0. The affected element is an unknown function of the file admin/delete_admin.php. The manipulation of the argument ID leads to missing authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVE-2026-116603 is a medium severity vulnerability in SourceCodester Online Food Ordering System version 1.0. It involves an unrestricted file upload flaw in the admin/add_food.php script, where manipulation of the 'image' argument allows remote attackers with high privileges to upload files without restriction. Exploit code has been published, but there is no indication of active exploitation in the wild. No patch or official fix information is currently available.
A vulnerability was detected in SourceCodester Online Food Ordering System 1.0. This issue affects the function unlink of the file admin/delete.php. Performing a manipulation of the argument image_name results in path traversal. The attack is possible to be carried out remotely. The exploit is now public and may be used.
A security vulnerability has been detected in itsourcecode Online Book Store 1.0. This vulnerability affects unknown code of the file /book.php. The manipulation of the argument bookisbn leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.
CVE-2026-116482 is a cross-site scripting (XSS) vulnerability in the subhajitkhan online-clinic-management-system affecting the patientregistration.php file. The flaw arises from improper sanitization of the pat_name argument, allowing remote attackers to inject malicious scripts. The vulnerability has been publicly disclosed, and exploit code may be available. The product does not use versioning, so specific affected or fixed versions are not identified.
A long-running malware campaign has infected 953 online stores, primarily Magento-based, with loader code that selectively serves malicious payloads to real visitors to evade detection. The campaign began in July 2025 and has used multiple domains for its JavaScript loader, with recent activity observed as late as October 2026. The loader performs visitor fingerprinting and has been delivered through exploitation of known Magento vulnerabilities and backdoors. Store owners are advised to check for loader code, vulnerabilities, backdoors, rogue admin accounts, and to apply the latest patches and security measures.
The Online Payments with iK Pay Gateway WordPress plugin before 3.0.4 does not properly verify the authenticity of its payment gateway callback on a default installation, allowing unauthenticated attackers to forge a successful payment notification and mark arbitrary orders as paid without any payment being made, and to mark arbitrary unprocessed orders as failed.
CVE-2026-116101 is a medium severity SQL injection vulnerability in itsourcecode Online Cake Ordering System version 1.0. The flaw exists in an unknown function within the /deletetransac.php file, where manipulation of the ID parameter allows an attacker to perform SQL injection remotely. Public exploit code is available for this vulnerability.
CVE-2026-116057 is a medium-severity vulnerability in KodCloud KodExplorer up to version 4.19. It involves an unrestricted file upload issue in the Online Editor Save Endpoint component, specifically in the file app/controller/editor.class.php. The vulnerability allows remote attackers to upload files without proper restrictions by manipulating the path/filestr argument. Public exploit code has been disclosed, but no vendor response or patch is currently available.