CVE-2025-41695 Reflected XSS vulnerability in dyn_conn.php

An XSS vulnerability in dynconn.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management WBM. The vulnerability does not provide access to system-level...

CVE-2025-41745 Reflected XSS vulnerability in pxc_portCntr2.php

An XSS vulnerability in pxcportCntr2.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management WBM. The vulnerability does not provide access to system-leve...

CVE-2025-41745

CVE-2025-41745 describes an XSS in pxc_portCntr2.php that allows an unauthenticated attacker to trick an authenticated user into sending a manipulated POST to modify web-based management parameters. The vulnerability affects devices exposing the pxc_portCntr2.php page within their web management ...

CVE-2025-41748

Summary (CVE-2025-41748): A reflected XSS vulnerability in the web application module pxc_Dot1xCfg.php allows an unauthenticated attacker to trick an authenticated user into clicking a malicious link that changes device configuration parameters via the web-based management interface (WBM). The im...

CVE-2025-41749 Reflected XSS vulnerability in port_util.php

An XSS vulnerability in portutil.php can be used by an unauthenticated remote attacker to trick an authenticated user to click on the link provided by the attacker in order to change parameters available via web based management WBM. The vulnerability does not provide access to system-level...

CVE-2025-41749

CVE-2025-41749 describes a reflected XSS in port_util.php. Multiple sources (NVD, Red Hat, EUVD, CVE List, VulnEnrichment, CIRCL) reiterate: an unauthenticated remote attacker can lure an authenticated user to click a crafted link to modify device configuration parameters via the web-based manage...

EUVD-2025-201842

A vulnerability was found in code-projects Employee Profile Management System 1.0. Affected is an unknown function of the file editpersonnel.php. The manipulation of the argument perid results in sql injection. The attack can be launched remotely. The exploit has been made public and could be use...

PT-2025-50154

Name of the Vulnerable Software and Affected Versions phpIPAM version 1.7.3 Description A cross-site scripting XSS issue exists in the Request IP form within phpIPAM. This allows attackers to inject arbitrary web scripts or HTML code through the instructions parameter of the...

PT-2025-49901

Name of the Vulnerable Software and Affected Versions Opal WP ekommart versions prior to 4.3.1 Description A flaw exists in Opal WP ekommart that allows for PHP Local File Inclusion due to improper control of filename for include/require statements. This issue impacts the software’s handling of...

📄 Pluck 4.7.7-dev2 Remote Code Execution

Pluck version 4.7.7-dev2 suffers from a remote code execution vulnerability. Exploit Title: Pluck 4.7.7-dev2 - PHP Code Execution Date: 2024-10-26 Exploit Author: CodeSecLab Vendor Homepage: https://github.com/pluck-cms/pluck Software Link: https://github.com/pluck-cms/pluck Version: 4.74-dev5...

PT-2025-49814

An XSS vulnerability in dyn conn.php can be used by an unauthenticated remote attacker to trick an authenticated user to send a manipulated POST request to the device in order to change parameters available via web based management WBM. The vulnerability does not provide access to system-level...

WordPress plugin Ronneby Theme Core 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blogging websites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

PT-2025-50209

Name of the Vulnerable Software and Affected Versions itsourcecode Student Management System version 1.0 Description A flaw exists in itsourcecode Student Management System 1.0, specifically within the file /new adviser.php. Manipulation of the Name argument in an unknown function can lead to SQL...

WordPress plugin Besa 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

PT-2025-50248

Name of the Vulnerable Software and Affected Versions Selea Targa IP OCR-ANPR Camera affected versions not specified Description The Selea Targa IP OCR-ANPR Camera contains a stored cross-site scripting issue in the files list parameter. This allows attackers to inject malicious HTML and script...

CVE-2025-63740

CVE-2025-63740 : SQL injection in Xinhu Rainrock RockOA 2.7.0, via function getselectdataAjax in inputAction.php (parameter: actstr). Impact includes administrator accounts, password hashes, and database structure. Root cause: improper handling of the actstr parameter leading to data disclosure. ...

WordPress plugin Exhibz 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

WordPress plugin ekommart 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to set up personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security...

WordPress plugin Sailing 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

PT-2025-50242

Name of the Vulnerable Software and Affected Versions OpenBMCS version 2.4 Description An information disclosure issue exists in OpenBMCS version 2.4 that allows unauthenticated attackers to access sensitive files. This is possible through exploitation of directory listing functionality. Attacker...