Logo
Retour à la veille

CVE-2026-92366

Publié : 16 septembre 2026
Modifié : 16 septembre 2026
Lien officiel NVD
Score CVSS
7.3
HIGH

Description détaillée

A vulnerability was determined in code-projects Matrimonial System 1.0. This affects an unknown part of the file /search.php of the component Regular Search. This manipulation of the argument sex/mothertongue/maritialstatus/country/state/religion/agemin/agemax causes sql injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Références et Patchs

https://code-projects.org/https://github.com/KaranParelkar/Matrimonial_system_search_sqli/blob/main/sqli%20sex%20parameter/Readme.mdhttps://github.com/KaranParelkar/Matrimonial_system_search_sqli/blob/main/sqli_mothertongue_parameter/Readme.mdhttps://vuldb.com/cve/CVE-2026-92366https://vuldb.com/submit/935075https://vuldb.com/submit/935112https://vuldb.com/submit/935144https://vuldb.com/submit/935583https://vuldb.com/submit/935715https://vuldb.com/submit/935749https://vuldb.com/submit/935795https://vuldb.com/submit/935924https://vuldb.com/vuln/405452https://vuldb.com/vuln/405452/cti

Dernières Vulnérabilités

CVE-2026-92603

ContiNew Admin through 4.1.0 contains an authorization bypass vulnerability in the personal message delete endpoint that allows authenticated users to delete other users' messages and announcements. Attackers can supply arbitrary message identifiers in the IdsReq parameter to remove any message row and purge all recipients' read receipts without ownership validation.

VOIR DÉTAILS

CVE-2026-92602

TDuck survey form through version 5.3 fails to validate webhook URLs or verify form ownership in the WebhookConfigController. Authenticated attackers can attach webhooks to other users' forms and exfiltrate submissions to arbitrary external or internal addresses.

VOIR DÉTAILS

CVE-2026-92601

Guns through 8.3.5 contains an improper access control vulnerability in SysNoticeController where requiredPermission defaults to false and is not overridden by any action methods. Authenticated users without assigned roles can exploit this to create, edit, delete, publish and retract system-wide notices affecting arbitrary users and departments.

VOIR DÉTAILS