CVE Watch18 jul 2026

CVE-2026-16156

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /forex

CVSS

3.5

Bajo

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 18 jul 2026 · Última mod.: 18 jul 2026 · CWE-79 · CWE-94

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /forexam.php. The manipulation of the argument day results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2025-32489.8 CRÍ

100.0%

KEV—80Langflow Missing Authentication Vulnerability5d CVE-2026-341978.8 ALT

99.9%

KEV—80Apache ActiveMQ Improper Input Validation Vulnerability5d CVE-2026-154107.2 ALT

71.1%

KEV—71SonicWall SMA1000 Appliances Code Injection Vulnerability3d CVE-2025-670389.8 CRÍ

55.3%

KEV—67Lantronix EDS5000 Code Injection Vulnerability13d CVE-2021-252996.1 MED

99.9%

——30Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). The vulnerability exists in the file /usr/local/nagiosxi/html/admin/sshterm.php due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal his/her session cookies or it can be chained with the previous bugs to get one-click remote command execution (RCE) on the Nagios XI server.11d CVE-2021-416539.8 CRÍ

99.5%

——30The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution via a crafted payload in an IP address input field.11d