Latest CVE Feed

Vulnerabilities published in the last 30 days. Filter by severity, exploit status, or attack vector.

Score
Vulnerability
Published
5.3 MEDIUM
CVE-2026-84169 — UPI QR Code Payment Gateway <= 1.4.3 - Unauthenticated Cross-Order Payment-Status Forgery

The UPI QR Code Payment Gateway WordPress plugin through 1.4.3 does not verify that a payment-confirmation request actually belongs to the order and customer it claims to confirm, allowing unauthenti…

Remote | Authorization
Oct 05, 2026 Oct 06, 2026
Oct 05, 2026
Oct 06, 2026
5.9 MEDIUM
CVE-2026-78371 — File Uploads Addon for WooCommerce 1.7.2 - 1.7.5 - Unauthenticated Customer Uploaded File…

The File Uploads Addon for WooCommerce WordPress plugin before 1.7.6 does not verify that the person requesting a customer-uploaded file is the customer who uploaded it, allowing unauthenticated atta…

Remote | Authorization
Oct 05, 2026 Oct 06, 2026
Oct 05, 2026
Oct 06, 2026
5.9 MEDIUM
CVE-2026-13607 — File Uploads Addon for WooCommerce <= 1.7.6 - Unauthenticated Direct File Access

The File Uploads Addon for WooCommerce WordPress plugin through 1.7.6 stores customer-uploaded files in a publicly web-accessible uploads directory and the access restriction it generates is ineffect…

Remote | Information Disclosure
Oct 05, 2026 Oct 06, 2026
Oct 05, 2026
Oct 06, 2026
6.5 MEDIUM
CVE-2026-105306 — Keycloak-services: keycloak-services: token introspection audience bypass via dynamic cli…

A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the registration process fails to filter security-sensitive cl…

single_sign-on build_of_keycloak | Remote | Misconfiguration
Oct 05, 2026 Oct 06, 2026
Oct 05, 2026
Oct 06, 2026
5.7 MEDIUM
CVE-2026-105302 — Keycloak-services: keycloak-services: user session note mapper exposes upstream idp acces…

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contai…

single_sign-on build_of_keycloak | Remote | Information Disclosure
Oct 05, 2026 Oct 06, 2026
Oct 05, 2026
Oct 06, 2026
3.7 LOW
CVE-2026-105237 — linlinjava litemall Login Endpoint AdminAuthController.java excessive authentication

A vulnerability was detected in linlinjava litemall up to 1.8.0. This affects an unknown part of the file litemall-admin-api/src/main/java/org/linlinjava/litemall/admin/web/AdminAuthController.java o…

litemall | Remote | Authentication
Oct 05, 2026 Oct 06, 2026
Oct 05, 2026
Oct 06, 2026
7.5 HIGH
CVE-2026-105233 — kishor-23 food-waste-management-system Login Flow login.php session fixiation

A vulnerability has been found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This affects an unknown function of the fil…

food-waste-management-system | Remote | Authentication
Oct 05, 2026 Oct 06, 2026
Oct 05, 2026
Oct 06, 2026
7.5 HIGH
CVE-2026-105232 — kishor-23 food-waste-management-system Registration deliverysignup.php sql injection

A flaw has been found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The impacted element is an unknown function of the f…

food-waste-management-system | Remote | Injection
Oct 05, 2026 Oct 07, 2026
Oct 05, 2026
Oct 07, 2026
7.5 HIGH
CVE-2026-105231 — kishor-23 food-waste-management-system Admin Registration signup.php sql injection

A vulnerability was detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The affected element is an unknown function o…

food-waste-management-system | Remote | Injection
Oct 05, 2026 Oct 06, 2026
Oct 05, 2026
Oct 06, 2026
7.5 HIGH
CVE-2026-105230 — kishor-23 food-waste-management-system deliverymyord.php sql injection

A security vulnerability has been detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Impacted is an unknown function…

food-waste-management-system | Remote | Injection
Oct 05, 2026 Oct 06, 2026
Oct 05, 2026
Oct 06, 2026
7.5 HIGH
CVE-2026-105229 — kishor-23 food-waste-management-system User Registration Endpoint signup.php sql injection

A weakness has been identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This issue affects some unknown processing …

food-waste-management-system | Remote | Injection
Oct 05, 2026 Oct 06, 2026
Oct 05, 2026
Oct 06, 2026
5.8 MEDIUM
CVE-2026-105226 — osCommerce osCommerce2 Newsletter Management newsletters.php include code injection

A security flaw has been discovered in osCommerce osCommerce2 up to 2.3.4.1. This vulnerability affects the function include of the file admin/newsletters.php of the component Newsletter Management. …

oscommerce2 | Remote | Injection
Oct 05, 2026 Oct 07, 2026
Oct 05, 2026
Oct 07, 2026
5.8 MEDIUM
CVE-2026-105225 — osCommerce osCommerce2 Payment payment.php include code injection

A vulnerability was identified in osCommerce osCommerce2 up to 2.3.4.1. This affects the function include of the file includes/classes/payment.php of the component Payment Page. Such manipulation of …

oscommerce2 | Remote | Injection
Oct 05, 2026 Oct 06, 2026
Oct 05, 2026
Oct 06, 2026
4.0 MEDIUM
CVE-2026-105188 — code-projects Human Resource Management System Live Event History liveEventHistory.php cr…

A vulnerability was found in code-projects Human Resource Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /views/admin/liveEventHistory.php of the compon…

human_resource_management_system | Remote | Cross-Site Scripting
Oct 05, 2026 Oct 06, 2026
Oct 05, 2026
Oct 06, 2026
6.5 MEDIUM
CVE-2026-105187 — itsourcecode Online Admission System key.php sql injection

A vulnerability has been found in itsourcecode Online Admission System 1.0. Affected is an unknown function of the file /admin/key.php. The manipulation of the argument ID leads to sql injection. The…

online_admission_system | Remote | Injection
Oct 05, 2026 Oct 06, 2026
Oct 05, 2026
Oct 06, 2026
6.5 MEDIUM
CVE-2026-105186 — itsourcecode Online Admission System new.php sql injection

A flaw has been found in itsourcecode Online Admission System 1.0. This impacts an unknown function of the file /new.php. Executing a manipulation of the argument schedid can lead to sql injection. T…

online_admission_system | Remote | Injection
Oct 05, 2026 Oct 06, 2026
Oct 05, 2026
Oct 06, 2026
7.5 HIGH
CVE-2026-105185 — itsourcecode Online Admission System examinee.php sql injection

A vulnerability was detected in itsourcecode Online Admission System 1.0. This affects an unknown function of the file /admin/examinee.php. Performing a manipulation of the argument ID results in sql…

online_admission_system | Remote | Injection
Oct 05, 2026 Oct 06, 2026
Oct 05, 2026
Oct 06, 2026
7.5 HIGH
CVE-2026-105184 — itsourcecode Online Admission System creteria.php sql injection

A security vulnerability has been detected in itsourcecode Online Admission System 1.0. The impacted element is an unknown function of the file /admin/creteria.php. Such manipulation of the argument …

online_admission_system | Remote | Injection
Oct 05, 2026 Oct 06, 2026
Oct 05, 2026
Oct 06, 2026
7.5 HIGH
CVE-2026-105183 — itsourcecode Online Admission System confirm.php sql injection

A weakness has been identified in itsourcecode Online Admission System 1.0. The affected element is an unknown function of the file /admin/confirm.php. This manipulation of the argument schedid cause…

online_admission_system | Remote | Injection
Oct 05, 2026 Oct 06, 2026
Oct 05, 2026
Oct 06, 2026
7.5 HIGH
CVE-2026-105182 — SourceCodester Online Reviewer Management System btn_functions.php update sql injection

A security flaw has been discovered in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/activities/btn_functions.php?ac…

online_reviewer_management_system | Remote | Injection
Oct 05, 2026 Oct 06, 2026
Oct 05, 2026
Oct 06, 2026
Showing 20 of 17430 Results