tsecurity.de - News Radar & Live Feeds

Fixing PostgreSQL Permission Errors in Laravel PHPUnit Tests

Sun, 18 Oct 2026 08:01:00 +0200

Introduction When writing automated tests in Laravel, configuring the testing environment correctly is just as important as writing the tests themselves. While setting up a feature test for a menu-category API in my Laravel POS project, I encountered a PostgreSQL permission error that prevented Laravel from creating the migrations table. The error... Weiterlesen

CVE-2026-104198 | ZoneMinder up to 1.36.62 Token Authentication web/includes/auth.php validateToken user information disclosure (Nessus ID 366874)

Sun, 18 Oct 2026 05:02:11 +0200

A vulnerability labeled as problematic has been found in ZoneMinder up to 1.36.62. Affected is the function validateToken of the file web/includes/auth.php of the component Token Authentication. Executing a manipulation of the argument User can lead to information disclosure. This vulnerability is tracked as CVE-2026-104198. The attack can be... Weiterlesen

CVE-2026-111866 | nemoTyrant manong up to 7c9e5228e133b9267ad3a415833bc9bb53193bb4 func.php cache/del_cache/arr2sql sql injection (EUVD-2026-103376)

Sun, 18 Oct 2026 05:02:08 +0200

A vulnerability was found in nemoTyrant manong up to 7c9e5228e133b9267ad3a415833bc9bb53193bb4. It has been classified as critical. This impacts the function cache/del_cache/arr2sql of the file func.php. This manipulation causes sql injection. This vulnerability appears as CVE-2026-111866. The attack may be initiated remotely. There is no available... Weiterlesen

CVE-2026-111906 | thorsten phpMyFAQ up to 4.1.8/4.2.0-alpha Elasticsearch/OpenSearch Administration API cross-site request forgery (EUVD-2026-103314)

Sun, 18 Oct 2026 05:02:07 +0200

A vulnerability classified as problematic was found in thorsten phpMyFAQ up to 4.1.8/4.2.0-alpha. Impacted is an unknown function of the component Elasticsearch/OpenSearch Administration API. Executing a manipulation can lead to cross-site request forgery. The identification of this vulnerability is CVE-2026-111906. The attack may be launched... Weiterlesen

CVE-2026-111905 | thorsten phpMyFAQ up to 4.1.8/4.2.0-alpha {userId} userId resource injection (EUVD-2026-103315)

Sun, 18 Oct 2026 05:02:06 +0200

A vulnerability categorized as problematic has been discovered in thorsten phpMyFAQ up to 4.1.8/4.2.0-alpha. Affected is an unknown function of the file /admin/api/user/data/{userId}. Executing a manipulation of the argument userId can lead to improper control of resource identifiers. This vulnerability appears as CVE-2026-111905. The attack may... Weiterlesen

CVE-2026-111904 | thorsten phpMyFAQ 4.2.0-alpha Open Question Controller /api/v4.0/open-questions OpenQuestionController information disclosure (EUVD-2026-103316)

Sun, 18 Oct 2026 05:02:05 +0200

A vulnerability has been found in thorsten phpMyFAQ 4.2.0-alpha and classified as problematic. Impacted is the function OpenQuestionController of the file /api/v4.0/open-questions of the component Open Question Controller. The manipulation leads to information disclosure. This vulnerability is listed as CVE-2026-111904. The attack may be initiated... Weiterlesen

CVE-2026-111903 | thorsten phpMyFAQ 4.2.0-alpha SvgSanitizer cross site scripting (EUVD-2026-103317)

Sun, 18 Oct 2026 05:02:05 +0200

A vulnerability classified as problematic has been found in thorsten phpMyFAQ 4.2.0-alpha. This issue affects the function SvgSanitizer. Performing a manipulation results in cross site scripting. This vulnerability was named CVE-2026-111903. The attack may be initiated remotely. There is no available exploit. It is recommended to upgrade the... Weiterlesen

CVE-2026-111894 | thorsten phpMyFAQ up to 4.1.8/4.2.0-alpha cleanUpContent cross site scripting (EUVD-2026-103325)

Sun, 18 Oct 2026 05:02:05 +0200

A vulnerability was found in thorsten phpMyFAQ up to 4.1.8/4.2.0-alpha. It has been declared as problematic. Impacted is the function FaqHelper::cleanUpContent of the component FAQ. The manipulation results in cross site scripting. This vulnerability is reported as CVE-2026-111894. The attack can be launched remotely. No exploit exists. It is... Weiterlesen

CVE-2026-111893 | Thorsten phpMyFAQ 4.2.0-alpha GroupController category-restrictions saveCategoryRestrictions categoryIds privileges management (EUVD-2026-103326)

Sun, 18 Oct 2026 05:02:05 +0200

A vulnerability was found in Thorsten phpMyFAQ 4.2.0-alpha and classified as problematic. This vulnerability affects the function GroupController::saveCategoryRestrictions of the file /admin/api/group/category-restrictions of the component GroupController. Executing a manipulation of the argument categoryIds can lead to improper privilege... Weiterlesen

CVE-2026-111892 | thorsten phpMyFAQ up to 4.2.0-alpha.2 Rate Limiting allocation of resources (EUVD-2026-103327)

Sun, 18 Oct 2026 05:02:05 +0200

A vulnerability described as critical has been identified in thorsten phpMyFAQ. This affects an unknown function of the component Rate Limiting. Executing a manipulation can lead to allocation of resources. The identification of this vulnerability is CVE-2026-111892. The attack may be launched remotely. There is no exploit available. Upgrading the... Weiterlesen

CVE-2026-111891 | thorsten phpMyFAQ up to 4.2.0-alpha.2 Group Permission API updatePermissions privileges management (EUVD-2026-103328)

Sun, 18 Oct 2026 05:02:05 +0200

A vulnerability was found in thorsten phpMyFAQ up to 4.2.0-alpha.2. It has been rated as problematic. Affected by this issue is the function updatePermissions of the component Group Permission API. The manipulation leads to improper privilege management. This vulnerability is documented as CVE-2026-111891. The attack can be initiated remotely.... Weiterlesen

CVE-2026-111890 | Thorsten phpMyFAQ up to 4.2.0-alpha.2 UserController updateUserRights privileges management (EUVD-2026-103329)

Sun, 18 Oct 2026 05:02:05 +0200

A vulnerability, which was classified as problematic, has been found in Thorsten phpMyFAQ. Affected by this vulnerability is the function UserController::updateUserRights of the component UserController. This manipulation causes improper privilege management. This vulnerability is tracked as CVE-2026-111890. The attack is possible to be carried... Weiterlesen

CVE-2026-111907 | thorsten phpMyFAQ up to 4.1.8 update-database cross-site request forgery (EUVD-2026-103313)

Sun, 18 Oct 2026 03:11:31 +0200

A vulnerability, which was classified as problematic, has been found in thorsten phpMyFAQ up to 4.1.8. The affected element is an unknown function of the file /admin/api/update-database. The manipulation leads to cross-site request forgery. This vulnerability is referenced as CVE-2026-111907. Remote exploitation of the attack is possible. No... Weiterlesen

CVE-2026-111909 | thorsten phpMyFAQ up to 4.1.8 /admin/api/user/delete deleteUser userId improper authorization (EUVD-2026-103311)

Sun, 18 Oct 2026 03:11:30 +0200

A vulnerability labeled as problematic has been found in thorsten phpMyFAQ up to 4.1.8. Affected by this issue is the function deleteUser of the file /admin/api/user/delete. The manipulation of the argument userId results in improper authorization. This vulnerability is known as CVE-2026-111909. It is possible to launch the attack remotely. No... Weiterlesen

CVE-2026-111908 | thorsten phpMyFAQ up to 4.1.8/4.2.0-alpha improper authorization (EUVD-2026-103312)

Sun, 18 Oct 2026 03:11:30 +0200

A vulnerability identified as critical has been detected in thorsten phpMyFAQ up to 4.1.8/4.2.0-alpha. Affected by this vulnerability is an unknown functionality. The manipulation leads to improper authorization. This vulnerability is traded as CVE-2026-111908. It is possible to initiate the attack remotely. There is no exploit available. You... Weiterlesen

CVE-2026-111896 | thorsten phpMyFAQ 4.2.0-alpha SVG file SvgSanitizer cross site scripting (EUVD-2026-103323)

Sun, 18 Oct 2026 03:11:30 +0200

A vulnerability identified as problematic has been detected in thorsten phpMyFAQ 4.2.0-alpha. This affects the function SvgSanitizer of the component SVG file Handler. Performing a manipulation results in cross site scripting. This vulnerability is known as CVE-2026-111896. Remote exploitation of the attack is possible. No exploit is available.... Weiterlesen

CVE-2026-111895 | thorsten phpMyFAQ Microsoft Entra ID login flow AuthEntraId::create preferred_username improper authentication (EUVD-2026-103324)

Sun, 18 Oct 2026 03:11:29 +0200

A vulnerability marked as critical has been reported in thorsten phpMyFAQ. The impacted element is the function AuthEntraId::create of the component Microsoft Entra ID login flow. Performing a manipulation of the argument preferred_username results in improper authentication. This vulnerability was named CVE-2026-111895. The attack may be... Weiterlesen

CVE-2026-111900 | thorsten phpMyFAQ up to 4.1.8/4.1.x Attachment attachment.php id improper authorization (EUVD-2026-103320)

Sun, 18 Oct 2026 03:11:29 +0200

A vulnerability was found in thorsten phpMyFAQ up to 4.1.8/4.1.x. It has been declared as problematic. This affects an unknown function of the file attachment.php of the component Attachment. Such manipulation of the argument ID leads to improper authorization. This vulnerability is documented as CVE-2026-111900. The attack can be executed... Weiterlesen

CVE-2026-111898 | thorsten phpMyFAQ up to 4.2.0-alpha /auth/keycloak/authorize improper authorization (EUVD-2026-103321)

Sun, 18 Oct 2026 03:11:29 +0200

A vulnerability labeled as critical has been found in thorsten phpMyFAQ up to 4.2.0-alpha. This impacts an unknown function of the file /auth/keycloak/authorize. Executing a manipulation can lead to improper authorization. This vulnerability is handled as CVE-2026-111898. The attack can be executed remotely. There is not any exploit available. The... Weiterlesen

CVE-2026-111897 | thorsten phpMyFAQ 4.2.0-alpha Attachment Management record_id/attachment_id authorization (EUVD-2026-103322)

Sun, 18 Oct 2026 03:11:29 +0200

A vulnerability was found in thorsten phpMyFAQ 4.2.0-alpha. It has been classified as critical. This issue affects some unknown processing of the component Attachment Management. The manipulation of the argument record_id/attachment_id leads to authorization bypass. This vulnerability is documented as CVE-2026-111897. The attack can be initiated... Weiterlesen

CVE-2026-111902 | thorsten phpMyFAQ 4.2.0-alpha FAQ Translation Check isFaqAccessibleForUser Accept-Language authorization (EUVD-2026-103318)

Sun, 18 Oct 2026 03:11:29 +0200

A vulnerability was found in thorsten phpMyFAQ 4.2.0-alpha. It has been rated as problematic. This impacts the function isFaqAccessibleForUser of the component FAQ Translation Check. Performing a manipulation of the argument Accept-Language results in authorization bypass. This vulnerability is reported as CVE-2026-111902. The attack is possible... Weiterlesen

CVE-2026-111901 | Thorsten phpMyFAQ 4.2.0-alpha Faqs And Search Api resource consumption (EUVD-2026-103319)

Sun, 18 Oct 2026 03:11:28 +0200

A vulnerability, which was classified as problematic, was found in Thorsten phpMyFAQ 4.2.0-alpha. This issue affects some unknown processing of the component Faqs And Search Api. Executing a manipulation can lead to resource consumption. This vulnerability is tracked as CVE-2026-111901. The attack can be launched remotely. No exploit exists. You... Weiterlesen

CVE-2026-111872 | itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449 database.php getreport id/user/topic sql injection

Sun, 18 Oct 2026 01:02:28 +0200

A vulnerability, which was classified as critical, has been found in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::valid/MySQLDB::getresults/MySQLDB::noresults/MySQLDB::getExams/MySQLDB::latestExamID/MySQLDB::getreport of the file results.php/include/database.php. The... Weiterlesen

CVE-2026-111873 | itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449 AJAX Endpoint exammanger.php MySQLDB::topicslist subject sql injection

Sun, 18 Oct 2026 01:02:28 +0200

A vulnerability, which was classified as critical, was found in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This impacts the function MySQLDB::topicslist of the file exammanger.php of the component AJAX Endpoint. The manipulation of the argument subject results in sql injection. This vulnerability is... Weiterlesen

CVE-2026-111870 | itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449 admin/admin.php isAdmin missing authentication

Sun, 18 Oct 2026 01:02:28 +0200

A vulnerability classified as problematic has been found in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The affected element is the function isAdmin of the file admin/admin.php. Performing a manipulation results in missing authentication. This vulnerability is identified as CVE-2026-111870. The attack... Weiterlesen

CVE-2026-111871 | itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449 subjectsdb.php query/qtype/sortname/sortorder sql injection

Sun, 18 Oct 2026 01:02:28 +0200

A vulnerability classified as critical was found in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. The impacted element is an unknown function of the file qsdb/usersdb/brandb/topicsdb/subjectsdb.php. Executing a manipulation of the argument query/qtype/sortname/sortorder can lead to sql injection. This... Weiterlesen

CVE-2026-111914 | Admidio up to 5.0.15 Inventory inventory_data.php access control (EUVD-2026-103306)

Sat, 17 Oct 2026 23:06:40 +0200

A vulnerability described as problematic has been identified in Admidio up to 5.0.15. This vulnerability affects unknown code of the file modules/inventory/inventory_data.php of the component Inventory. Such manipulation leads to improper access controls. This vulnerability is uniquely identified as CVE-2026-111914. The attack can be launched... Weiterlesen

CVE-2026-111913 | Admidio up to 5.0.15 Pdf Export lists_show.php mode authorization (EUVD-2026-103307)

Sat, 17 Oct 2026 23:06:38 +0200

A vulnerability was found in Admidio up to 5.0.15. It has been classified as problematic. The impacted element is an unknown function of the file modules/groups-roles/lists_show.php of the component Pdf Export. This manipulation of the argument mode causes authorization bypass. This vulnerability is registered as CVE-2026-111913. Remote... Weiterlesen

CVE-2026-111916 | Admidio up to 5.0.15 RSS Feed rss/links.php information disclosure (EUVD-2026-103305)

Sat, 17 Oct 2026 23:06:38 +0200

A vulnerability, which was classified as problematic, has been found in Admidio up to 5.0.15. This vulnerability affects unknown code of the file rss/links.php of the component RSS Feed. Performing a manipulation results in information disclosure. This vulnerability is identified as CVE-2026-111916. The attack can be initiated remotely. There is... Weiterlesen

CVE-2026-111910 | thorsten phpMyFAQ up to 4.1.8/4.2.0-alpha Attachment attachment.php improper authorization (EUVD-2026-103310)

Sat, 17 Oct 2026 23:06:38 +0200

A vulnerability marked as problematic has been reported in thorsten phpMyFAQ up to 4.1.8/4.2.0-alpha. This affects an unknown part of the file attachment.php of the component Attachment. This manipulation causes improper authorization. This vulnerability is handled as CVE-2026-111910. The attack can be initiated remotely. There is not any exploit... Weiterlesen

CVE-2026-111911 | thorsten phpMyFAQ up to 4.1.8 WebAuthn Registration improper authentication (EUVD-2026-103309)

Sat, 17 Oct 2026 23:06:38 +0200

A vulnerability was found in thorsten phpMyFAQ up to 4.1.8 and classified as critical. The affected element is an unknown function of the component WebAuthn Registration. The manipulation results in improper authentication. This vulnerability is cataloged as CVE-2026-111911. The attack may be launched remotely. There is no exploit available. It is... Weiterlesen

How I Reverse-Engineered ZKTeco’s Binary Protocol in Pure PHP 8 to Build a Direct Hardware Attendance Writer

Sat, 17 Oct 2026 20:41:45 +0200

If you’ve ever had to integrate ZKTeco biometric time-and-attendance clocks (fingerprint scanners, facial recognition terminals, RFID readers) into a modern web stack, you already know the grim reality of the ecosystem: Most existing Packagist packages are 6 to 10 years old abandonware. They throw fatal deprecation notices on PHP 8.1, 8.2, 8.3,... Weiterlesen

CVE-2026-108123 | murgroland Booking System Plugin up to 2.1.0.3 on WordPress profile.php admin_init authorization (EUVD-2026-103228)

Sat, 17 Oct 2026 18:53:36 +0200

A vulnerability was found in murgroland Booking System Plugin up to 2.1.0.3 on WordPress. It has been rated as problematic. Impacted is the function admin_init of the file profile.php. The manipulation leads to authorization bypass. This vulnerability is uniquely identified as CVE-2026-108123. The attack is possible to be carried out remotely. No... Weiterlesen

[APPSEC-1337] Magento 2 - Arbitrary PHP code execution using language packs

Fri, 16 Oct 2026 20:56:31 +0200

If an attacker could trick a user into installing a malicious language package or had access to an installed language package, he/she could remotely deploy an attack when the language-package code was executed. Part of patch MAGENTO 2.0.4 SECURITY UPDATE This vulnerability affects the following application versions: Magento 2.0.0 Magento 2.0.0-rc... Weiterlesen

[6342] Rescricted to upload PHP script at AdminImport

Fri, 16 Oct 2026 20:56:23 +0200

Official description: #6342: Prevented upload of PHP script This vulnerability affects the following application versions: PrestaShop 1.6.0.1 PrestaShop 1.6.0.1 alpha 1 PrestaShop 1.6.0.2 PrestaShop 1.6.0.2 alpha 2 PrestaShop 1.6.0.3 PrestaShop 1.6.0.3 beta 1 PrestaShop 1.6.0.4 PrestaShop 1.6.0.4 RC1 PrestaShop 1.6.0.5 PrestaShop 1.6.0.6... Weiterlesen

Potential XSS within price.php fixed with escape on get_price()

Fri, 16 Oct 2026 19:49:16 +0200

When submitting a product information update request, vulnerable versions of WooCommerce didn't sanitize the value of product sale price on the server side so that the injected code was also included in the product web page. It could be exploited to attack innocent users visiting the tampered product web page. Any user with edit or higher... Weiterlesen

Escaping attributes in cart.php in order to prevent XSS

Fri, 16 Oct 2026 19:48:50 +0200

Official WooCommerce descripion: Fix - Escaped attribute translations in the `cart.php` template and bumped the template version to match. This vulnerability affects the following application versions: WooCommerce 2.5.0 WooCommerce 2.5.0-RC1 WooCommerce 2.5.0-RC2 WooCommerce 2.5.0-RC3 WooCommerce 2.5.1 WooCommerce 2.5.2 WooCommerce 2.5.3... Weiterlesen

Unauthenticated PHP Object Injection in Forminator Forms Entry Form UID

Fri, 16 Oct 2026 19:45:23 +0200

Forminator stored the visitor-supplied form_uid value of abandoned (save-and-continue) submissions unserialized in the entry meta table and later passed it to maybe_unserialize() when loading the entry. An unauthenticated attacker can submit a crafted serialized PHP object as form_uid, leading to PHP Object Injection and, if a suitable POP chain... Weiterlesen

PHP Code Injection in Duplicator Installer wp-config.php

Fri, 16 Oct 2026 19:45:18 +0200

The Duplicator installer writes the database name, user, password, host and port, and the new site URL and paths submitted during the database/update steps into wp-config.php without escaping. An unauthenticated attacker who can reach a leftover installer.php or installer-backup.php can inject PHP code into wp-config.php and achieve remote code... Weiterlesen

CVE-2026-100106 | damian-gora FiboSearch Plugin up to 1.34.2 on WordPress /wp-admin/profile.php purchased_plan cross site scripting (EUVD-2026-102816)

Fri, 16 Oct 2026 14:31:28 +0200

A vulnerability, which was classified as problematic, has been found in damian-gora FiboSearch Plugin up to 1.34.2 on WordPress. This issue affects some unknown processing of the file /wp-admin/profile.php. The manipulation of the argument purchased_plan leads to cross site scripting. This vulnerability is referenced as CVE-2026-100106. Remote... Weiterlesen

CVE-2026-111472 | TSG Profleet /cgi-bin/index.php Identificación sql injection (EUVD-2026-102826)

Fri, 16 Oct 2026 12:30:58 +0200

A vulnerability, which was classified as critical, has been found in TSG Profleet. This affects an unknown part of the file /cgi-bin/index.php. The manipulation of the argument Identificación leads to sql injection. This vulnerability is uniquely identified as CVE-2026-111472. The attack is possible to be carried out remotely. No exploit exists. Weiterlesen

CVE-2026-93681 | meum Tutor LMS Plugin up to 4.1.0 on WordPress Consent Logs wp-admin/users.php display_name cross site scripting (EUVD-2026-102821)

Fri, 16 Oct 2026 12:30:58 +0200

A vulnerability was found in meum Tutor LMS Plugin up to 4.1.0 on WordPress and classified as problematic. Affected is an unknown function of the file wp-admin/users.php of the component Consent Logs. Executing a manipulation of the argument display_name can lead to cross site scripting. This vulnerability is tracked as CVE-2026-93681. The attack... Weiterlesen

CVE-2022-46639 | Correos Prestashop 1.7.x descarga_etiqueta.php path traversal (EUVD-2022-49443)

Thu, 15 Oct 2026 21:14:24 +0200

A vulnerability labeled as critical has been found in Correos Prestashop 1.7.x. This affects an unknown function of the file descarga_etiqueta.php. Such manipulation leads to path traversal. This vulnerability is traded as CVE-2022-46639. Access to the local network is required for this attack to succeed. There is no exploit available. Weiterlesen

CVE-2026-78851 | Grav up to 2.0.6 GravExtension.php mediaDirFunc path traversal (EUVD-2026-102184)

Thu, 15 Oct 2026 19:43:24 +0200

A vulnerability was found in Grav up to 2.0.6 and classified as problematic. Affected by this issue is the function mediaDirFunc of the file GravExtension.php. Executing a manipulation can lead to path traversal. This vulnerability appears as CVE-2026-78851. The attack may be performed from remote. There is no available exploit. Weiterlesen

CVE-2026-63314 | Slican IPx prior 6.62.0100 WebCTI service /webcti/admin_json.php sql injection (EUVD-2026-101951)

Thu, 15 Oct 2026 13:58:35 +0200

A vulnerability classified as critical has been found in Slican IPx. The impacted element is an unknown function of the file /webcti/admin_json.php of the component WebCTI service. This manipulation causes sql injection. The identification of this vulnerability is CVE-2026-63314. It is possible to initiate the attack remotely. There is no exploit... Weiterlesen

[0day-rubbish] Maian Pal 2.1 product image upload with no extension allow-list to PHP webshell and www-data uid 33 code execution (7.2, PR:H)

Thu, 15 Oct 2026 10:28:47 +0200

Posted by disclosure via Fulldisclosure on Oct 150day Rubbish Research Team is publicly disclosing a vulnerability in Maian Pal 2.1, the self-hosted PHP shopping-cart script from Maian Media (United Kingdom), oriented at PayPal checkout and distributed as a commercial closed-source archive, verified end to end against a real installation of that... Weiterlesen

DSA-6539-1 php-mongodb - security update

Mon, 12 Oct 2026 22:22:36 +0200

Multiple security vulnerabilities have been discovered in the MongoDB driver for PHP, which could result in information disclosure, PHP objection injection or denial of service. https://security-tracker.debian.org/tracker/DSA-6539-1 Weiterlesen

CVE-2025-59588 | PenciDesign Soledad Plugin up to 8.6.8 on WordPress php file inclusion