CVE-2026-108967

Publié : 13 octobre 2026

Modifié : 13 octobre 2026

Score CVSS

7.3

HIGH

Description détaillée

A security flaw has been discovered in SourceCodester Performance Indicator System 1.0. Impacted is an unknown function of the file /opils/staff/edit_credit.php. The manipulation of the argument credit results in sql injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Références et Patchs

https://github.com/hubdk01/cve/issues/9 https://vuldb.com/cve/CVE-2026-108967 https://vuldb.com/submit/999145 https://vuldb.com/vuln/416785 https://vuldb.com/vuln/416785/cti https://www.sourcecodester.com/

Dernières Vulnérabilités

CVE-2026-89271

The WP-BusinessDirectory WordPress plugin through 4.0.2 does not restrict the type or destination of files saved by an unauthenticated upload handler, allowing unauthenticated attackers to write files with arbitrary content to arbitrary locations, though not to execute code on a default server configuration.

VOIR DÉTAILS

CVE-2026-89269

The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that executes in the session of any user viewing the testimonials, including administrators.

VOIR DÉTAILS

CVE-2026-54870

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpweaver Weaver Xtreme Theme Support weaverx-theme-support allows Stored XSS.This issue affects Weaver Xtreme Theme Support: from n/a through 7.0.1.

VOIR DÉTAILS