CVE Vulnerabilities - 19 October 2026

The iWebShop 5 online store software (versions up to 5.16) has a flaw in its mobile password‑reset function that lets an attacker reset a user’s password by tampering with the user ID parameter. This ...

The dmDataLoad.php file in diem-project versions up to 5.1.3 uses a default password that can be triggered remotely. An attacker could gain access without knowing any credentials. Change the default p...

The search feature in iWebShop-5 versions up to 5.16 can be tricked into running unintended database commands, letting attackers read, change, or delete data. This can be done over the internet withou...

The MuPDF PDF viewer (versions up to 1.28.5) has a flaw in its signature‑locking code that can free the same piece of memory twice. An attacker who can send a crafted PDF could make the program stop w...

The login component of iWebShop-5 (versions up to 5.16) lets an attacker control where a user is redirected after signing in. This could be used to send customers to malicious websites, potentially le...

The password change page in iWebShop-5 (up to version 5.16) can be tricked into changing an administrator's password without their knowledge. An attacker could send a crafted request that makes the sy...

The Google Analytics component used by the diem project does not correctly verify security certificates. This weakness could allow a remote attacker to spoof secure connections and potentially interce...

The Ticket module in Chamilo LMS versions up to 1.11.40, 2.0.3 and 3.0.1 can be tricked into executing unwanted code when a specially crafted project name is submitted. This could let a remote attacke...

The Administrative Console in the diem Project does not properly check the data entered into the dm_command field. An attacker could send a specially crafted command that causes a web browser to run u...

The version‑check component of the diem Project contains a flaw in a JavaScript file (dmAdminCtrl.js) that lets an attacker insert malicious code into web pages. This can be triggered from a remote lo...