CVE-2026-4969

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

A vulnerability was identified in code-projects Social Networking Site 1.0. The impacted element is an unknown function of the file /home.php of the component Alert Handler. The manipulation of the argument content leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-79CWE-94

Affected software

No affected versions have been published.

Timeline

Published
Mar 27, 2026
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-49706.3A security flaw has been discovered in code-projects Social Networking Site 1.0. This affects an unknown function of the file delete_photos.CVE-2026-49714.3A weakness has been identified in SourceCodester Note Taking App up to 1.0. This impacts an unknown function. This manipulation causes crossCVE-2026-49722.4A security vulnerability has been detected in code-projects Online Reviewer System up to 1.0. Affected is an unknown function of the file /sCVE-2026-49733.5A vulnerability was detected in SourceCodester Online Quiz System up to 1.0. Affected by this vulnerability is an unknown functionality of tCVE-2026-497382.1The path allowance check in GeneralUtility::isAllowedAbsPath() performed a plain string prefix comparison without requiring a directory sepaCVE-2026-49748.8A flaw has been found in Tenda AC7 15.03.06.44. Affected by this issue is the function fromSetSysTime of the file /goform/SetSysTimeCfg of tCVE-2026-497406.3TYPO3's cache frontend (VariableFrontend) and persistent key-value store (Registry) deserialized PHP payloads without integrity validation oCVE-2026-497418.7Backend users with write access to the form_definition database table were able to directly create, update, or delete form definition recordCVE-2026-497427.1Backend users with file download permissions were able to download files from the fallback storage of the file abstraction layer (FAL) via tCVE-2026-497437.8Software installed and run as a non-privileged user may conduct improper GPU system calls to manipulate the lifetimes of synchronisation objCVE-2026-497447.8Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside thCVE-2026-497457.8Kernel software installed and running inside a Guest VM may post improper commands to the GPU Firmware to trigger a write of data outside th