CVE Vulnerabilities - 19 October 2026

The iWebShop 5 online store software (versions up to 5.16) has a flaw in its mobile password‑reset function that lets an attacker reset a user’s password by tampering with the user ID parameter. This ...

The dmDataLoad.php file in diem-project versions up to 5.1.3 uses a default password that can be triggered remotely. An attacker could gain access without knowing any credentials. Change the default p...

The search feature in iWebShop-5 versions up to 5.16 can be tricked into running unintended database commands, letting attackers read, change, or delete data. This can be done over the internet withou...

The MuPDF PDF viewer (versions up to 1.28.5) has a flaw in its signature‑locking code that can free the same piece of memory twice. An attacker who can send a crafted PDF could make the program stop w...

The login component of iWebShop-5 (versions up to 5.16) lets an attacker control where a user is redirected after signing in. This could be used to send customers to malicious websites, potentially le...

The password change page in iWebShop-5 (up to version 5.16) can be tricked into changing an administrator's password without their knowledge. An attacker could send a crafted request that makes the sy...

The Ticket module in Chamilo LMS versions up to 1.11.40, 2.0.3 and 3.0.1 can be tricked into executing unwanted code when a specially crafted project name is submitted. This could let a remote attacke...