high · CVSS v3 6.5 · CVSS v4 7.1

CVE-2026-125385

INDOTALENT WHMS before 10.20261109 contains a path traversal vulnerability that allows authenticated users to read arbit…

Description

INDOTALENT WHMS before 10.20261109 contains a path traversal vulnerability that allows authenticated users to read arbitrary files via the documentName and imageName parameters. Attackers can self-register and supply traversal sequences to GetDocument or GetImage, which use Path.Combine without containment checks, to read files like appsettings.json.

Scores

Severity
high
CVSS v2
6.8
CVSS v3
6.5
CVSS v4
7.1
EPSS
—

← All CVEs

Related CVEs

high

CVE-2026-125074

A flaw has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown function of the file reset_password.php of the component Password Reset. This manipulation of the argument username/password causes weak password recovery. The attack is possible to be carried out remotely. The exploit has been published and may be used.

View analysis

high

CVE-2026-125076

A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.0. Affected is an unknown function of the file api/attendance_handler.php of the component JSON Endpoint. Performing a manipulation of the argument student_code results in missing authentication. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

View analysis

high

CVE-2026-125078

A security flaw has been discovered in SourceCodester Smart Attendance System with QR Code Scanner 1.0. This affects an unknown part of the file login.php. The manipulation results in session fixiation. The attack can be launched remotely. The exploit has been released to the public and may be used for attacks.

View analysis

high

CVE-2026-125360

Storyden through 1.26.16 contains a privilege escalation vulnerability that allows users holding MANAGE_ROLES to grant the ADMINISTRATOR permission without being administrators. Attackers can call AccountAddRole on another controlled account or use RoleCreate and RoleUpdate to create administrator roles, taking full control of the instance.

View analysis