CVE Notifier

CVE-2026-90600 CWE-89 6.3

itsourcecode Sales and Inventory System inv_edit1.php sql injection

A vulnerability has been found in itsourcecode Sales and Inventory System 1.0. This impacts an unknown function of the file /pages/inv_edit1.php. The manipulation of the argument ID leads to sql injection. The attack can…

cve.org itsourcecode:Sales · and · Inventory 13 Sep 2026

CVE-2026-90599 CWE-352 4.3

Rizwan17 inventory-management-system process.php cross-site request forgery

A flaw has been found in Rizwan17 inventory-management-system up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. This affects an unknown function of the file includes/process.php. Executing a manipulation can lead to cross-…

cve.org Rizwan17:inventory-management-system 13 Sep 2026

CVE-2026-90598 CWE-639 6.3

jaygajera17 E-commerce-project-springBoot UserController.java UserController.updateUser authorization

A vulnerability was detected in jaygajera17 E-commerce-project-springBoot up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. The impacted element is the function UserController.updateUser of the file UserController.java. Pe…

cve.org jaygajera17:E-commerce-project-springBoot 13 Sep 2026

CVE-2026-90597 CWE-89 6.3

itsourcecode Sales and Inventory System sup_edit1.php sql injection

A security vulnerability has been detected in itsourcecode Sales and Inventory System 1.0. The affected element is an unknown function of the file /pages/sup_edit1.php. Such manipulation of the argument ID leads to sql i…

cve.org itsourcecode:Sales · and · Inventory 13 Sep 2026

CVE-2026-90596 CWE-190 6.5

embedded-graphics image_raw.rs new/bytes_per_row integer overflow

A weakness has been identified in embedded-graphics up to 0.8.2 on 32-bit. Impacted is the function ImageRaw::new/bytes_per_row of the file src/image/image_raw.rs. This manipulation causes integer overflow. The attack is…

cve.org n/a:embedded-graphics 13 Sep 2026

CVE-2026-90595 CWE-862 6.3

wxiaoqi Spring-Cloud-Platform OnlineController.java OnlineController.getOnlineInfo authorization

A security flaw has been discovered in wxiaoqi Spring-Cloud-Platform 1.0/2.2/3.0. This issue affects the function OnlineController.getOnlineInfo of the file aceModules/ace-admin/auth/controller/OnlineController.java. The…

cve.org wxiaoqi:Spring-Cloud-Platform 13 Sep 2026

CVE-2026-90594 CWE-862 6.3

wxiaoqi Spring-Cloud-Platform Permission Service PermissionService.java PermissionService.checkUserPermission authorization

A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0. This vulnerability affects the function PermissionService.checkUserPermission of the file /rpc/service/PermissionService.java of the component …

cve.org wxiaoqi:Spring-Cloud-Platform 13 Sep 2026

CVE-2026-90593 CWE-190 7.3

embedded-graphics image_raw.rs draw_sub_image integer overflow

A vulnerability was determined in embedded-graphics up to 0.8.2. This affects the function ImageRaw::draw_sub_image of the file src/image/image_raw.rs. Executing a manipulation of the argument width can lead to integer o…

cve.org n/a:embedded-graphics 13 Sep 2026

CVE-2026-90584 CWE-770 5.3

TooTallNate Java-WebSocket Fragmentation Draft_6455.java processFrameContinuousAndNonFin allocation of resources

A weakness has been identified in TooTallNate Java-WebSocket up to 1.6.1. The impacted element is the function processFrameContinuousAndNonFin of the file Draft_6455.java of the component Fragmentation Handler. Executing…

cve.org TooTallNate:Java-WebSocket 13 Sep 2026

CVE-2026-89050 CWE-? 4.3

Quads Ads Manager for Google AdSense < 3.0.5 - Subscriber+ Ad-Selling Payment Bypass via Unverified Success Return URL

The Quads Ads Manager for Google AdSense WordPress plugin before 3.0.5 does not verify payment completion with the configured payment gateway before marking an ad-selling order as paid, allowing users who can place an or…

WPScan Unknown:Quads · Ads · Manager 13 Sep 2026

CVE-2026-88802 CWE-? 7.5

MDJM Event Management and Mobile Events Manager - Unauthenticated Arbitrary Post Deletion

The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or the type of the record before permanently deleting the post i…

WPScan Unknown:MDJM · Event · Management 13 Sep 2026

CVE-2026-88793 CWE-? 8.8

YouTube Embed 10.0 - 10.3 - Unauthenticated Stored XSS via youram_server

The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a nonce it prints on every front-end page, and does not escape the stored data bef…

WPScan Unknown:YouTube · Embed 13 Sep 2026