CVE-2026-78142

MediumCVSS 6.3/10Last modified Oct 12, 2026

Description

A vulnerability was found in code-projects Barangay Resident Profiling Management System 1.0. This impacts an unknown function of the file /archived_records.php of the component Restore/Delete. The manipulation of the argument resident_id results in authorization bypass. The attack may be launched remotely. The exploit has been made public and could be used.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-285CWE-639

Affected software

VendorProductVersions
code-projectsBarangay Resident Profiling Management System1.0

References

Timeline

Published
Aug 23, 2026
Last modified
Oct 12, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-781437.3A vulnerability was determined in code-projects Barangay Resident Profiling Management System 1.0. Affected is an unknown function of the fiCVE-2026-781446.3A vulnerability was identified in code-projects Barangay Resident Profiling Management System 1.0. Affected by this vulnerability is an unknCVE-2026-781454.3A vulnerability has been found in CTFd up to 3.8.4. The affected element is the function _is_safe_url of the file CTFd/utils/validators/__inCVE-2026-781466.5The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request bCVE-2026-781477.3A vulnerability was found in ggml-org llama.cpp bec4772f6. The impacted element is the function deserialize_tensor of the file ggml/src/ggmlCVE-2026-781485.3A vulnerability was determined in ggml-org llama.cpp bec4772f6. This affects the function rpc_server::graph_compute of the file ggml/src/ggmCVE-2026-781495.3The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its storeCVE-2026-78158.8SQL injection vulnerability in pgAdmin 4 Maintenance Tool. Four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_indeCVE-2026-781502.7The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing usCVE-2026-781515.3The FormLayer WordPress plugin before 1.0.9 does not perform any authorization check before returning a form's full stored configuration in CVE-2026-781525.3The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outpCVE-2026-781535.3The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its conte