CVE Vulnerability Catalog

A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects the function mysqli_query of the file admin/delete1.php of the component Unauthenticated Action Script. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

Joomla Extension - OrdaSoft Joomla CCK before 8.3.16 has unauthenticated remote code execution. The file site/uploader.php is reached through normal frontend routing (task=getContent), with no authentication or ACL check. The handler validates the uploaded file's content with a real magic-byte MIME check, but the extension allow-list is commented out. The saved file's extension is taken directly from the attacker-supplied filename with no validation, and the file is written to a path under the Joomla web root executed by PHP. An image/PHP polyglot passed the content check with a .php extension.

In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible.

In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials. A user able to edit the integration could gain access to the authentication data.

In JetBrains YouTrack before 2026.2.19197 users with restricted permission could edit and hide other users' comments. This violates data integrity and access control.

In JetBrains YouTrack before 2026.2.19197 account takeover was possible by replaying a notification signature.

In JetBrains YouTrack before 2026.2.19197 guest users could remove a workflow action's visibility restriction and run the action. This allows bypassing access control mechanisms.

In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible. Malicious code could be stored and executed in the victim's browser.

In JetBrains YouTrack before 2026.2.19197 project Admin could trigger DoS via a notification template. This may lead to service unavailability.

In JetBrains YouTrack before version 2026.2.19197, an authorization bypass in the scripts debugger allows arbitrary code execution.

In JetBrains YouTrack before 2026.2.19197 missing authorisation in the notification template preview allowed Project Administrators to read restricted issues. This violates data confidentiality.

In JetBrains YouTrack before version 2026.2.19197, missing authorization on several endpoints allowed authenticated users to access information from other projects.

In JetBrains YouTrack before version 2026.2.19197, users with low-level Admin Read permission could disclose integration credentials via import configurations.

In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed. This allows unauthorized issue submission.

In JetBrains YouTrack before version 2026.2.19197, project administrators could read comments from other projects via notification templates.

In JetBrains YouTrack before 2026.2.19197 reDoS attack was possible via mailbox regex mail-rule filters. This may lead to excessive resource consumption.

In JetBrains Hub before version 2026.2.52366, missing authorization allowed authenticated users to send arbitrary emails from the server's trusted address.

In JetBrains Rider before 2026.2.1 AI Assistant could auto-update third-party skills without user confirmation. This may lead to unauthorized changes in the environment.

In JetBrains YouTrack before version 2026.2.18991, stored SMTP server credentials could be disclosed by changing the server host.

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible. Malicious content could be stored and displayed to other users.