CVE-2026-78143

HighCVSS 7.3/10Last modified Oct 12, 2026

Description

A vulnerability was determined in code-projects Barangay Resident Profiling Management System 1.0. Affected is an unknown function of the file residents.php of the component Resident Search Functionality. This manipulation of the argument Search causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-74CWE-89

Affected software

No affected versions have been published.

Timeline

Published
Aug 23, 2026
Last modified
Oct 12, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-781446.3A vulnerability was identified in code-projects Barangay Resident Profiling Management System 1.0. Affected by this vulnerability is an unknCVE-2026-781454.3A vulnerability has been found in CTFd up to 3.8.4. The affected element is the function _is_safe_url of the file CTFd/utils/validators/__inCVE-2026-781466.5The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request bCVE-2026-781477.3A vulnerability was found in ggml-org llama.cpp bec4772f6. The impacted element is the function deserialize_tensor of the file ggml/src/ggmlCVE-2026-781485.3A vulnerability was determined in ggml-org llama.cpp bec4772f6. This affects the function rpc_server::graph_compute of the file ggml/src/ggmCVE-2026-781495.3The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its storeCVE-2026-78158.8SQL injection vulnerability in pgAdmin 4 Maintenance Tool. Four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_indeCVE-2026-781502.7The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing usCVE-2026-781515.3The FormLayer WordPress plugin before 1.0.9 does not perform any authorization check before returning a form's full stored configuration in CVE-2026-781525.3The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outpCVE-2026-781535.3The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its conteCVE-2026-781559.9privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privileges