CVE-2026-1118

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

A vulnerability was detected in itsourcecode Society Management System 1.0. Impacted is an unknown function of the file /admin/add_activity.php. Performing a manipulation of the argument Title results in sql injection. It is possible to initiate the attack remotely. The exploit is now public and may be used.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74 CWE-89

Affected software

Vendor	Product	Versions
itsourcecode	Society Management System	1.0

References

https://github.com/AriazzzZ/CVE/issues/2Exploit, Issue Tracking, Mitigation, Third Party Advisory
https://itsourcecode.com/Product
https://vuldb.com/?ctiid.341710Permissions Required, VDB Entry
https://vuldb.com/?id.341710Third Party Advisory, VDB Entry
https://vuldb.com/?submit.734289Third Party Advisory, VDB Entry

Timeline

Published: Jan 18, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-111806.5Inappropriate implementation in SVG in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafte CVE-2026-1118026.6A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash wit CVE-2026-1118048.2Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-suppli CVE-2026-1118058.6Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. This issue aff CVE-2026-1118088.6Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affect CVE-2026-1118099.3Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apach CVE-2026-111816.3Inappropriate implementation in Media Session in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy CVE-2026-1118107.5Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a reque CVE-2026-1118119.0Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. CVE-2026-11181210.0Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own c CVE-2026-11181310.0Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsi CVE-2026-11181410.0Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for