557 matches found
CVE-2026-6003: Improper Neutralization of Input During Web Page Generation
A security vulnerability has been detected in code-projects Simple IT Discussion Forum 1.0. This issue affects some unknown processing of the file /admin/user.php. Such manipulation of the argument fname leads to cross site scripting. The attack may be performed from remote. The exploit has been...
CVE-2026-5010: Improper Neutralization of Input During Web Page Generation
A reflected Cross-Site Scripting XSS vulnerability has been discovered in Clickedu. This vulnerability allows an attacker to execute JavaScript code in the victim’s browser by sending them a malicious URL using the endpoint “/user.php/”. This vulnerability can be exploited to steal sensitive user...
PT-2026-27035
Name of the Vulnerable Software and Affected Versions MacCMS versions prior to 2025.1000.4052 Description A weakness exists in MacCMS that allows authorization bypass. This issue affects the order info function within the application/index/controller/User.php file, specifically within the Member...
CVE-2026-31859: Improper Neutralization of Input During Web Page Generation
Craft is a content management system CMS. The fix for CVE-2025-35939 in craftcms/cms introduced a striptags call in src/web/User.php to sanitize return URLs before they are stored in the session. However, striptags only removes HTML tags angle brackets -- it does not inspect or filter URL schemes...
CVE-2025-6593: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/user/User.Php. This issue affects MediaWiki: from 1.27.0 before 1.39.13, 1.42.7 1.43.2, 1.44.0...
CVE-2026-1702: Improper Authorization
A vulnerability was detected in SourceCodester Pet Grooming Management Software 1.0. Impacted is an unknown function of the file /admin/operation/user.php of the component User Management. Performing a manipulation of the argument groupid results in improper authorization. The attack can be...
CVE-2025-15390 PHPGurukul Small CRM edit-user.php authorization
A security flaw has been discovered in PHPGurukul Small CRM 4.0. This impacts an unknown function of the file /admin/edit-user.php. The manipulation results in missing authorization. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for...
CVE-2025-15390: Missing Authorization
A security flaw has been discovered in PHPGurukul Small CRM 4.0. This impacts an unknown function of the file /admin/edit-user.php. The manipulation results in missing authorization. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for...
PT-2025-50960
Name of the Vulnerable Software and Affected Versions haxxorsid Stock-Management-System versions prior to fbbbf213e9c93b87183a3891f77e3cc7095f22b0 Description A security issue exists in haxxorsid Stock-Management-System. The manipulation of the employee id, id, or admin argument can lead to SQL...
CVE-2025-14568: Improper Neutralization of Special Elements used in an SQL Command
A security vulnerability has been detected in haxxorsid Stock-Management-System up to fbbbf213e9c93b87183a3891f77e3cc7095f22b0. This impacts an unknown function of the file model/User.php. The manipulation of the argument employeeid/id/admin leads to sql injection. The attack can be initiated...
CVE-2025-63712: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF in SourceCodester Product Expiry Management System. The User Management module delete-user.php allows remote attackers to delete arbitrary user accounts via forged cross-origin GET requests because the endpoint relies solely on session cookies and lacks CSRF...
CVE-2025-12238: Improper Neutralization of Special Elements used in an SQL Command
A security flaw has been discovered in code-projects Automated Voting System 1.0. The affected element is an unknown function of the file /admin/user.php. Performing manipulation of the argument Username results in sql injection. The attack is possible to be carried out remotely. The exploit has...
CVE-2025-12201: Unrestricted Upload of File with Dangerous Type
A vulnerability was identified in ajayrandhawa User-Management-PHP-MYSQL up to fedcf58797bf2791591606f7b61fdad99ad8bff1. This affects an unknown part of the file /admin/edit-user.php of the component User Management Interface. Such manipulation of the argument image leads to unrestricted upload. ...
CVE-2025-11611: Improper Neutralization of Special Elements used in an SQL Command
A weakness has been identified in SourceCodester Simple Inventory System 1.0. Impacted is an unknown function of the file /user.php. This manipulation of the argument uemail causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public...
PT-2025-41697
Name of the Vulnerable Software and Affected Versions SourceCodester Simple Inventory System version 1.0 Description A flaw exists in SourceCodester Simple Inventory System 1.0. The issue involves the manipulation of the uemail argument within an unknown function of the /user.php file, leading to...
CVE-2025-11556: Improper Neutralization of Special Elements used in an SQL Command
A flaw has been found in code-projects Simple Leave Manager 1.0. This vulnerability affects unknown code of the file /user.php. This manipulation of the argument table causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be used...
EUVD-2008-6925
Malware in sbrugna...
EUVD-2001-1501
Malware in sbrugna...