CVE Vulnerabilities - 1 October 2026

itsourcecode Leave Management System remote SQL injection risk

CVE-2026-103690

The Leave Management System version 1.0 lets an attacker send a specially crafted request to the leave controller page and cause the underlying database to run unintended commands. This can be done ov...

2.1

OpenConstructionERP AI module may leak data to wrong session

CVE-2026-103544 GHSA-wfpw-cv5v-64j5

Versions of OpenConstructionERP up through 14.8.1 have a problem in the AI provider component that can let data be shown to the wrong user session when someone manipulates a request. The flaw can be t...

2.1

itsourcecode Leave Management System remote SQL injection

CVE-2026-103543

The Leave Management System version 1.0 allows an attacker to send specially crafted data to the LEAVTID field in the controller.php file, causing the system to run unauthorized database commands. Thi...

2.1

Form Tools allows remote file upload

CVE-2026-103541

The Form Tools web application (versions up to 3.1.1) lets anyone send a file to the server through its Ajax handler without proper checks. This means an attacker could place malicious files on your s...

2.1

Form Tools client settings can be exploited remotely

CVE-2026-103540

Form Tools versions up to 3.1.1 let an attacker send specially crafted data to the client settings feature, which the system fails to clean properly. This could let a remote attacker insert unwanted c...

2.1

David-Crty Databasement allows unauthorized view of snapshots

CVE-2026-103534 GHSA-vx6q-v2gv-5fhv

The snapshot viewing feature in David-Crty Databasement (versions up to 1.7.1) does not properly check who can see snapshot data, so an attacker could see information they should not. This can be trig...

2.1

ZongXR SuperMarket allows unauthenticated instant purchases

CVE-2026-103539

The Instant Buy feature in ZongXR SuperMarket version 1.0.0.0 does not verify the user’s identity when the startBuy function is called. An attacker could remotely trigger a purchase by altering the Us...

2.1

Form Tools can be tricked into making external requests

CVE-2026-103542

The Form Tools software (up to version 3.1.1) has a flaw in its smart_fill function that lets an attacker cause the server to send its own web requests to other locations. This could expose internal d...

2.1

databasement API allows path traversal to read files

CVE-2026-103533 GHSA-x225-463f-pgww

The databasement product (versions up to 1.7.1) lets an attacker manipulate a request parameter to access files outside the intended directory. This could let a remote user view or retrieve sensitive ...

1.2

cri-tools allows unauthorized parent directory access

CLEANSTART-2026-CB13715

The cri-tools software can be tricked into reaching files outside its intended folder, potentially exposing sensitive system data. This could let attackers view or modify files they shouldn't. Update ...

3.8

HCL BigFix Service Management can leak data in error messages

CVE-2026-67172

The HCL BigFix Service Management system may include sensitive details in its error replies when it receives malformed requests. This extra information could help a malicious user plan additional atta...

3.7

HCL AION lacks security header, allowing script injection

CVE-2026-21833

HCL AION does not send a Content‑Security‑Policy header, which browsers use to block malicious scripts. Without this protection, web pages could be more vulnerable to cross‑site scripting attacks that...

3.7

Apache HTTP Server may run unintended scripts via redirect

CVE-2026-42356 DEBIAN-CVE-2026-42356 UBUNTU-CVE-2026-42356 ALPINE-CVE-2026-42356

Apache HTTP Server versions 2.4.60 through 2.4.68 can treat files that are redirected by certain CGI programs as executable scripts, even when they were not meant to run. This could allow an attacker ...

3.7

CGA-243q-fx62-984w

CGA-243q-fx62-984w

3.7

CGA-pqjv-qgv7-69q9

CGA-pqjv-qgv7-69q9

3.7

CGA-74wr-8wc2-88c5

CGA-74wr-8wc2-88c5

3.7

CGA-mfgg-v8h5-755x

CGA-mfgg-v8h5-755x

3.7

CGA-fg82-jfg3-3448

CGA-fg82-jfg3-3448

3.7

CGA-599j-r3p9-7mg8

CGA-599j-r3p9-7mg8

3.7

CGA-fc3h-p4vm-68h6

CGA-fc3h-p4vm-68h6

3.7

CGA-rj86-64fc-j89g

CGA-rj86-64fc-j89g

3.7

CGA-3ccp-mfgr-w2g2

CGA-3ccp-mfgr-w2g2

3.7

CGA-cvjm-f6p4-849v

CGA-cvjm-f6p4-849v

3.7

CGA-pghq-2p6q-cc8q

CGA-pghq-2p6q-cc8q

3.7

CGA-rgxw-63fq-82h3

CGA-rgxw-63fq-82h3

3.7