VulDB Recent Entries

A vulnerability labeled as problematic has been found in BookStack up to 26.05.2. Affected by this issue is the function AttachmentController::getUpdateForm of the file app/Uploads/Controllers/AttachmentController.php of the component Attachment Edit Endpoint. The manipulation of the argument ID results in improper access controls. This vulnerability is cataloged as CVE-2026-86285. The attack may be launched remotely. Furthermore, there is an exploit available. It is advisable to implement a patch to correct this issue.

A vulnerability identified as problematic has been detected in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. Affected by this vulnerability is the function getOption of the file travel/src/main/java/com/controller/CommonController.java. The manipulation of the argument tableName/columnName leads to information disclosure. This vulnerability is listed as CVE-2026-86284. The attack may be initiated remotely. In addition, an exploit is available. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. To fix this issue, it is recommended to deploy a patch.

A vulnerability categorized as critical has been discovered in jaychouchannel Tourism-Management-System up to 8122bf020d91199eddfff3ee02d1632a70a9a132. Affected is an unknown function of the file travel/src/main/java/com/controller/CommonController.java of the component CommonDao. Executing a manipulation of the argument table/column/xColumn/yColumn can lead to sql injection. This vulnerability is tracked as CVE-2026-86282. The attack can be launched remotely. Moreover, an exploit is present. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. A patch should be applied to remediate this issue.

A vulnerability was found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. It has been rated as problematic. This impacts an unknown function. Performing a manipulation results in cross-site request forgery. This vulnerability is identified as CVE-2026-86281. The attack can be initiated remotely. Additionally, an exploit exists.

A vulnerability was found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. It has been declared as problematic. This affects an unknown function of the file cict_portal.sql. Such manipulation leads to cleartext storage of sensitive information. This vulnerability is referenced as CVE-2026-86280. It is possible to launch the attack remotely. Furthermore, an exploit is available.

A vulnerability was found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. It has been classified as critical. The impacted element is an unknown function of the file auth_process.php of the component Login. This manipulation causes session fixiation. The identification of this vulnerability is CVE-2026-86279. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

A vulnerability was found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 and classified as problematic. The affected element is an unknown function of the file manage_subjects.php. The manipulation of the argument msg/title/content results in cross site scripting. This vulnerability was named CVE-2026-86278. The attack may be performed from remote. In addition, an exploit is available.

A vulnerability has been found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 and classified as critical. Impacted is an unknown function of the file delete_exam.php. The manipulation of the argument ID leads to authorization bypass. This vulnerability is uniquely identified as CVE-2026-86277. The attack is possible to be carried out remotely. Moreover, an exploit is present.

A vulnerability, which was classified as critical, was found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This issue affects some unknown processing of the file db.php. Executing a manipulation can lead to hard-coded credentials. This vulnerability is handled as CVE-2026-86276. The attack can be executed remotely. Additionally, an exploit exists.

A vulnerability, which was classified as problematic, has been found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This vulnerability affects the function register of the file auth.php. Performing a manipulation of the argument role results in improper privilege management. This vulnerability is known as CVE-2026-86275. Remote exploitation of the attack is possible. Furthermore, an exploit is available.

A vulnerability classified as problematic was found in projeto-siga siga up to 11.0.2.10/11.0.2.13/11.1.1. This affects the function ExAutenticacaoController.autenticar of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExAutenticacaoController.java of the component Authentication Flow. Such manipulation of the argument cod/jwt leads to missing authorization. This vulnerability is traded as CVE-2026-86274. The attack may be launched remotely. Furthermore, there is an exploit available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability classified as critical has been found in projeto-siga siga up to 11.1.1. Affected by this issue is the function DownloadExterno.getUrl of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExUtilController.java of the component HTML-to-PDF Endpoint. This manipulation of the argument html causes server-side request forgery. This vulnerability appears as CVE-2026-86273. The attack may be initiated remotely. In addition, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability described as critical has been identified in THU-MAIC OpenMAIC up to 1.0.0. Affected by this vulnerability is an unknown functionality. The manipulation of the argument baseUrl results in server-side request forgery. This vulnerability is reported as CVE-2026-86259. The attack can be launched remotely. No exploit exists. Upgrading the affected component is recommended.

A vulnerability marked as problematic has been reported in Jupyter nbviewer up to 1.0.1. Affected is the function LocalFileHandler.can_show of the component LocalFileHandler. The manipulation leads to path traversal. This vulnerability is documented as CVE-2026-86258. The attack can be initiated remotely. There is not any exploit available.

A vulnerability labeled as critical has been found in Beijing Meite Software Technology U+Smart Enjoyment WebSite 18.6001.1096.1000. This impacts an unknown function of the file /Report/Upload/UploadFormImg.ashx. Executing a manipulation of the argument File can lead to unrestricted upload. This vulnerability is registered as CVE-2026-86272. It is possible to launch the attack remotely. Furthermore, an exploit is available.

A vulnerability identified as problematic has been detected in FluentCMS up to 0.0.5. This affects the function GetAccessible of the file src/Backend/FluentCMS.Services/Permissions/PermissionManager.cs. Performing a manipulation results in missing authorization. This vulnerability is cataloged as CVE-2026-86271. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability categorized as critical has been discovered in itsourcecode Sales and Inventory System 1.0. The impacted element is an unknown function of the file /pages/settings_edit.php. Such manipulation of the argument ID leads to sql injection. This vulnerability is listed as CVE-2026-86270. The attack may be performed from remote. In addition, an exploit is available.

A vulnerability was found in itsourcecode Sales and Inventory System 1.0. It has been rated as critical. The affected element is an unknown function of the file /pages/emp_edit1.php. This manipulation of the argument ID causes sql injection. This vulnerability is tracked as CVE-2026-86269. The attack is possible to be carried out remotely. Moreover, an exploit is present.

A vulnerability was found in itsourcecode School Management System 1.0. It has been declared as critical. Impacted is an unknown function of the file User_Login.php. The manipulation of the argument email results in sql injection. This vulnerability is identified as CVE-2026-86268. The attack can be executed remotely. Additionally, an exploit exists.

A vulnerability was found in itsourcecode Information System Society Membership System 1.0. It has been classified as critical. This issue affects some unknown processing of the file /society/check_student.php. The manipulation of the argument student_id leads to sql injection. This vulnerability is referenced as CVE-2026-86267. Remote exploitation of the attack is possible. Furthermore, an exploit is available.