CVE-2026-0700
published 2026-01-08CVE-2026-0700: A vulnerability was determined in code-projects Intern Membership Management System 1.0. Affected is an unknown function of the file…
PriorityP350critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.44%
37.3th percentile
A vulnerability was determined in code-projects Intern Membership Management System 1.0. Affected is an unknown function of the file /intern/admin/check_admin.php. Executing a manipulation of the argument Username can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| carmelo | intern_membership_management_system | — | — |
| code-projects | intern_membership_management_system | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.05.5MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-322m-p87g-xcpj: A vulnerability was determined in code-projects Intern Membership Management System 1
ghsa_unreviewed·2026-01-08
CVE-2026-0700 [MEDIUM] CWE-74 GHSA-322m-p87g-xcpj: A vulnerability was determined in code-projects Intern Membership Management System 1
A vulnerability was determined in code-projects Intern Membership Management System 1.0. Affected is an unknown function of the file /intern/admin/check_admin.php. Executing a manipulation of the argument Username can lead to sql injection. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized.
Red Hat
nano: nano: Local attacker can inject malicious .desktop launcher due to insecure directory permissions
vendor_redhat·2026-04-13·CVSS 2.5
CVE-2026-6842 [LOW] CWE-732 nano: nano: Local attacker can inject malicious .desktop launcher due to insecure directory permissions
nano: nano: Local attacker can inject malicious .desktop launcher due to insecure directory permissions
A flaw was found in nano. In environments with permissive umask settings, a local attacker can exploit incorrect directory permissions (0777 instead of 0700) for the `~/.local` directory. This allows the attacker to inject a malicious `.desktop` launcher, which could lead to unintended actions or information disclosure if the launcher is subsequently processed.
Statement: This is a Low impact flaw where nano creates the `~/.local` directory with insecure permissions (0777) in permissive umask environments. A local attacker can exploit this to inject a malicious `.desktop` launcher. This issue affects Red Hat Enterprise Linux 8 and 9.
Mitigation: Ensure that the system's umask is confi
Red Hat
libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow
vendor_redhat·2025-08-12·CVSS 7.8
CVE-2026-18917 [HIGH] CWE-190 libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow
libvirt: Integer overflow in NodeGetFreePages RPC handler leading to heap buffer overflow
A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.
Mitigation: Restrict access to the libvirt read-only Unix socket to limit which local users can reach the vulnerable RPC handler. In /etc/libvirt/libvirtd.conf, set unix_sock_ro_perms to "0770" (or "0700") and configure unix_sock_group to a group containing only t
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-95511 cups-filters: cups-filters: lpadmin can escalate to root via privileged serial backend (cups2root) [fedora-all]
bugzilla·2026-09-22
CVE-2026-95511 [HIGH] CVE-2026-95511 cups-filters: cups-filters: lpadmin can escalate to root via privileged serial backend (cups2root) [fedora-all]
CVE-2026-95511 cups-filters: cups-filters: lpadmin can escalate to root via privileged serial backend (cups2root) [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
A local privilege escalation exists in the CUPS printing stack used on Red Hat products. The cupsd scheduler decides that a backend runs as root based only on file permission bits (mode 0744 or 0700). Device URI validation in scheduler/ipp.c applies FileDevice path restrictions only to file: URIs. For other schemes, cupsd only checks that the backend binary exists and is executable. It does not validate the path component of the URI.
The seri
Bugzilla
CVE-2026-95511 cups: cups-filters: cups-filters: lpadmin can escalate to root via privileged serial backend (cups2root)
bugzilla·2026-09-22
CVE-2026-95511 [HIGH] CVE-2026-95511 cups: cups-filters: cups-filters: lpadmin can escalate to root via privileged serial backend (cups2root)
CVE-2026-95511 cups: cups-filters: cups-filters: lpadmin can escalate to root via privileged serial backend (cups2root)
A local privilege escalation exists in the CUPS printing stack used on Red Hat products. The cupsd scheduler decides that a backend runs as root based only on file permission bits (mode 0744 or 0700). Device URI validation in scheduler/ipp.c applies FileDevice path restrictions only to file: URIs. For other schemes, cupsd only checks that the backend binary exists and is executable. It does not validate the path component of the URI.
The serial backend, historically part of Apple CUPS, is not present in OpenPrinting CUPS HEAD (v2.5b1, commit 7cf4b97). Red Hat and Fedora ship it from the cups-filters package as /usr/lib/cups/backend/serial (or /usr/libexec/cups/backend/s
Bugzilla
CVE-2026-6842 nano: nano: Local attacker can inject malicious .desktop launcher due to insecure directory permissions
bugzilla·2026-04-21·CVSS 2.5
CVE-2026-6842 [LOW] CVE-2026-6842 nano: nano: Local attacker can inject malicious .desktop launcher due to insecure directory permissions
CVE-2026-6842 nano: nano: Local attacker can inject malicious .desktop launcher due to insecure directory permissions
nano creates ~/.local with mode 0777 instead of 0700. In permissive-umask environments (containers, CI), local attacker can race to inject malicious .desktop launcher. The subsequent mkdir for ~/.local/share correctly uses 0700.
Affected: src/history.c lines 229-234. BZ#2455314.
Reported by Michał Majchrowicz and Marcin Wyczechowski, AFINE Team.
2026-01-08
Published