Veille CVE

Vendredi 14 août 2026

14 CVE

Critique 3 Élevée 6 Moyenne 5 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « php » ✕
  1. CVE-2026-19825 7.3 Élevée

    SourceCodester Simple Client Management System

    A security vulnerability has been detected in SourceCodester Simple Client Management System 1.0. The impacted element is an unknown function of the file /classes/Master.php?f=save_service. The manipulation of the argument ID leads to sql injection. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used.

  2. CVE-2026-19786 4.3 Moyenne

    francoisjacquet RosarioSIS

    A vulnerability was found in francoisjacquet RosarioSIS up to 12.8. This issue affects some unknown processing of the file Modules.php. Performing a manipulation results in cross-site request forgery. Remote exploitation of the attack is possible. Upgrading to version 12.9 is capable of addressing this issue. The patch is named 801a71272c82cf4bf695fdc5ed42a9b7511d124d. It is recommended to upgrade the affected component.

  3. CVE-2026-19784 4.3 Moyenne

    francoisjacquet RosarioSIS

    A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 12.9 is able to mitigate this issue. Patch name: 04dd1a368ddf80ad7082baefa3c656e4e1825c76. It is suggested to upgrade the affected component.

  4. CVE-2026-19767 6.3 Moyenne

    itsourcecode Hospital Management System

    A weakness has been identified in itsourcecode Hospital Management System 1.0. This issue affects some unknown processing of the file viewdoctortimings.php. Executing a manipulation of the argument delid can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks.

  5. CVE-2026-19764 7.3 Élevée

    Raisecom Communication Command and Dispatch Management Platform

    A vulnerability was identified in Raisecom Communication Command and Dispatch Management Platform up to 7.6.5. This affects an unknown part of the file /app/users/getpwd.php. Such manipulation of the argument sip leads to sql injection. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

  6. CVE-2026-19787 4.7 Moyenne

    SourceCodester Air Cargo Management System

    A vulnerability was determined in SourceCodester Air Cargo Management System 1.0. Impacted is an unknown function of the file /classes/Master.php?f=save_cargo_type. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.

  7. CVE-2026-19710 7.3 Élevée

    SourceCodester Simple Student Information System

    A vulnerability was found in SourceCodester Simple Student Information System. Affected by this vulnerability is an unknown functionality of the file app/admin/departments/view_department.php. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used.

  8. CVE-2026-28176 8.8 Élevée

    Booking Activities Team Booking Activities

    Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions.

  9. CVE-2026-28149 9.8 Critique

    miniOrange Headless Single Sign On

    Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions.

  10. CVE-2026-27380 7.2 Élevée

    magepeopleteam Car Rental Manager

    Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions.

  11. CVE-2026-19345 6.5 Moyenne

    code-projects Task Management System

    A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown part of the file /user/UpdateTaskStatus.php. The manipulation of the argument task_id/val results in missing authorization. It is possible to launch the attack remotely. The exploit has been made public and could be used.

  12. CVE-2026-60121 9.8 Critique

    VITEC Flamingo

    Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/ping.php endpoint that allows remote attackers to execute arbitrary commands by exploiting a double-evaluation flaw in shell argument handling. The endpoint applies escapeshellarg() to the user-supplied host POST parameter before passing it to a system wrapper, but the wrapper retrieves the decoded value from argv and incorporates it into a second shell_exec() call without escaping, allowing injected commands to execute with root privileges via passwordless sudo.

  13. CVE-2026-61498 9.8 Critique

    VITEC Flamingo

    Vitec Flamingo 4.12.2 contains an unauthenticated OS command injection vulnerability in the admin/ajax/gen_graphs.php endpoint that allows remote unauthenticated attackers to execute arbitrary commands by supplying shell metacharacters in the start, end, key, or format HTTP GET parameters. Attackers can exploit the lack of input sanitization in the graph generation script, which passes user-supplied values directly to shell commands via passthru(), to execute arbitrary OS commands with root privileges due to the web server context having passwordless sudo access.

  14. CVE-2026-57804 7.5 Élevée

    CodexThemes TheGem Theme Elements (for Elementor)

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in CodexThemes TheGem Theme Elements (for Elementor) allows PHP Local File Inclusion. This issue affects TheGem Theme Elements (for Elementor): from n/a before 5.12.1.1.