CVE Vulnerabilities - 30 September 2026

The admin section of the AdithyaYelloju Restaurant Management System allows a user to change the ID value and gain access without proper permission. This can be done from anywhere on the internet, let...

The student list search function in openSIS-Classic (versions up to 9.3) allows specially crafted input to alter database queries. An attacker could use this to view, change, or delete data from the s...

The student‑search feature in openSIS‑Classic (versions up to 9.3) can be tricked into running unauthorized database commands. An attacker could change or view data from anywhere on the internet. Appl...

The openSIS-Classic school management system (versions up to 9.3) has a flaw in the Assignments page that lets an attacker send specially crafted data and run unauthorized database commands. This coul...

The github-mcp-server tool can run operating‑system commands that an attacker supplies through a file name parameter. This means a remote user could cause the server to execute unwanted actions, poten...

The HospitalManagement system’s login component can be tricked into accepting any file from an outside user. This means an attacker could place malicious files on the server and potentially run them. ...

The openSIS-Classic version up to 9.3 lets an attacker send specially crafted data to the Save Data Handler, causing the underlying database to run unintended commands. This can be done over the netwo...

The student information page in openSIS-Classic (versions up to 9.3) lets a remote user change the way data is stored, potentially letting an attacker alter or view the school database. This happens b...

The online leave management system's report page lets an attacker supply malicious start or end dates that are sent directly to the database. This could allow a remote user to view, change or delete d...

The HospitalManagement system’s configuration page lets anyone modify key settings without proper permission checks. This could let an attacker alter or delete important data from anywhere on the inte...

The data_galeri.php page in gedelumbung HospitalManagement lets a remote user delete files outside the intended folder by sending a specially crafted gbr value. This could let attackers remove or repl...

The Guest Book feature in gedelumbung HospitalManagement lets attackers insert malicious code through the name, email or message fields. This could cause unwanted pop‑ups, data theft, or other unwante...

The apcupsd program (up to version 3.14.14) used on Debian and related systems can accidentally include leftover memory data in the pages generated by its web interfaces. An attacker who visits those ...