#Web Application
All CosmicBytez Labs articles tagged #Web Application, across news, security advisories, how-to guides, and projects.
- Security
WWBN AVideo Brute-Force Rate Limit Bypass (CVE-2026-82644)
CVE-2026-82644 lets attackers skip login rate limiting on WWBN AVideo by spoofing a bot User-Agent, enabling unlimited password guessing.
- Security
CVE-2026-19384: SQL Injection in SourceCodester Simple Doctors Appointment System
A remotely exploitable SQL injection vulnerability in SourceCodester Simple Doctors Appointment System 1.0 allows unauthenticated attackers to manipulate...
- Security
CVE-2025-67403: Critical SQL Injection in CASAP Enrollment System update_class.php
A critical-severity SQL injection vulnerability (CVSS 9.8) in Sourcecodester CASAP Automated Enrollment System 1.0 allows unauthenticated remote attackers...
- Security
CVE-2025-67404: Critical SQL Injection in CASAP Enrollment System save_stud.php
A critical-severity SQL injection vulnerability (CVSS 9.8) in Sourcecodester CASAP Automated Enrollment System 1.0 allows unauthenticated attackers to...
- Security
CVE-2026-15488: Unrestricted File Upload in shiroiAdmin Enables Remote Code Execution
A high-severity unrestricted file upload vulnerability in shiroiAdmin versions 1.1 and 1.3 allows unauthenticated remote attackers to upload PHP webshells...
- Security
CVE-2026-2342: ValeApp Stored Cross-Site Scripting (CVSS 9.3)
A critical stored XSS vulnerability in OceanicSoft's ValeApp allows attackers to inject persistent JavaScript payloads that execute in every victim's...
- Security
CVE-2024-6228: WordPress WANotifier Plugin Local File Inclusion
A local file inclusion vulnerability in the WANotifier WordPress plugin (before v2.6) allows any authenticated subscriber-level user to include and...
- Security
CVE-2026-14770: SQL Injection in SourceCodester Class and Exam Timetabling System
A high-severity SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to manipulate backend database...
- Security
CVE-2026-13485: SQL Injection in SourceCodester Class and Exam Timetabling System
A high-severity SQL injection vulnerability in SourceCodester's Class and Exam Timetabling System 1.0 allows unauthenticated remote attackers to...
- Security
CVE-2026-13486: SQL Injection in SourceCodester Class and Exam Timetabling System (preview6.php)
A second high-severity SQL injection vulnerability in SourceCodester Class and Exam Timetabling System 1.0 targets /preview6.php via the...
- Security
CVE-2026-11334: SQL Injection in College Management System
A high-severity SQL injection vulnerability (CVSS 7.3) in CollegeManagementSystem allows attackers to manipulate the department_code parameter in…
- Security
CVE-2026-10263: SQL Injection in SourceCodester Computer Repair Shop Management System
A CVSS 7.3 SQL injection vulnerability in SourceCodester's Computer Repair Shop Management System v1.0 allows remote attackers to extract sensitive data via…
- Security
CVE-2026-10110: SQL Injection in Student Details Management System 1.0
A remotely exploitable SQL injection vulnerability in code-projects Student Details Management System 1.0 allows attackers to manipulate database queries...
- Security
CVE-2018-25362: Twitter-Clone SQL Injection via follow.php
Twitter-Clone 1 contains a high-severity SQL injection vulnerability in follow.php that allows attackers to extract sensitive database information through.
- Security
CVE-2026-9525: SQL Injection in itsourcecode Electronic
A remotely exploitable SQL injection vulnerability in the admin panel of itsourcecode Electronic Judging System 1.0 allows attackers to manipulate database.
- News
Highly Critical Drupal Core Flaw Exposes PostgreSQL Sites
Drupal has released emergency security updates for CVE-2026-9082, a highly critical vulnerability in Drupal Core that allows remote code execution,...
- Security
CVE-2026-37431: Beauty Parlour Management System SQL
A critical unauthenticated SQL injection vulnerability in Beauty Parlour Management System v1.1 allows attackers to dump the entire backend database via a...
- Security
CVE-2026-41462: ProjeQtor Unauthenticated SQL Injection in Login
A critical unauthenticated SQL injection vulnerability in ProjeQtor project management software allows attackers to inject arbitrary SQL via the login...
- Security
CVE-2026-7002: SQL Injection in KLiK SocialMediaWebsite
CVE-2026-7002 is a CVSS 7.3 SQL injection vulnerability in KLiK SocialMediaWebsite up to version 1.0.1, exploitable remotely via the c_id parameter in the...
- Security
SocialEngine Unauthenticated SQL Injection via Activity
A critical SQL injection vulnerability in SocialEngine versions 7.8.0 and prior allows unauthenticated remote attackers to execute arbitrary SQL queries...
- Security
CVE-2026-39918: Vvveb CMS Unauthenticated PHP Code
Vvveb CMS versions prior to 1.0.8.1 allow unauthenticated attackers to inject arbitrary PHP code through the installation endpoint's unsanitized subdir...
- Security
CVE-2026-37749: SQL Injection Auth Bypass in CodeAstro
A critical SQL injection vulnerability in CodeAstro Simple Attendance Management System v1.0 allows unauthenticated remote attackers to bypass login...
- Security
CVE-2026-5637: SQL Injection in projectworlds Car Rental
A remotely exploitable SQL injection vulnerability (CVE-2026-5637) has been disclosed in projectworlds Car Rental System 1.0. The flaw exists in...
- Security
CVE-2026-5534 — SQL Injection in itsourcecode Online
A high-severity SQL injection vulnerability in itsourcecode Online Enrollment System 1.0 allows remote unauthenticated attackers to manipulate the USERID...
- Security
CVE-2026-5540 — SQL Injection in code-projects Simple
A high-severity SQL injection vulnerability in code-projects Simple Laundry System 1.0 allows remote unauthenticated attackers to manipulate the firstName...
- Security
Apache Struts Critical RCE via OGNL Injection Returns
A new critical OGNL injection vulnerability in Apache Struts allows unauthenticated remote code execution, reminiscent of the 2017 Equifax breach vector....