CVE-2026-78144

MediumCVSS 6.3/10Last modified Oct 12, 2026

Description

A vulnerability was identified in code-projects Barangay Resident Profiling Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /boarders.php of the component Boarder Management Module. Such manipulation of the argument ID leads to authorization bypass. The attack can be executed remotely. The exploit is publicly available and might be used.

Metrics

CVSS 3.1 6.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-285CWE-639

Affected software

No affected versions have been published.

Timeline

Published
Aug 23, 2026
Last modified
Oct 12, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-781454.3A vulnerability has been found in CTFd up to 3.8.4. The affected element is the function _is_safe_url of the file CTFd/utils/validators/__inCVE-2026-781466.5The Simple Newsletter Plugin WordPress plugin before 4.3.3 does not verify that the requester is the subscriber named in a public request bCVE-2026-781477.3A vulnerability was found in ggml-org llama.cpp bec4772f6. The impacted element is the function deserialize_tensor of the file ggml/src/ggmlCVE-2026-781485.3A vulnerability was determined in ggml-org llama.cpp bec4772f6. This affects the function rpc_server::graph_compute of the file ggml/src/ggmCVE-2026-781495.3The Smart Post WordPress plugin before 4.0.8 does not check whether a post is password protected before returning its content and its storeCVE-2026-78158.8SQL injection vulnerability in pgAdmin 4 Maintenance Tool. Four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_indeCVE-2026-781502.7The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing usCVE-2026-781515.3The FormLayer WordPress plugin before 1.0.9 does not perform any authorization check before returning a form's full stored configuration in CVE-2026-781525.3The SureRank SEO WordPress plugin before 1.10.1 does not exclude users' registered account email addresses from the structured data it outpCVE-2026-781535.3The Restrict User Access WordPress plugin before 2.8.1 does not normalise the REST API route before checking it against the routes its conteCVE-2026-781559.9privilege escalation in StackGres operator allows a low-privilege tenant who owns a database to gain administrator privilegesCVE-2026-781567.4A security vulnerability has been detected in Open5GS 2.8.0. Affected by this issue is the function hss_ogs_diam_s6a_air_cb of the file src/