CVE-2018-25191 Facturation System 1.0 SQL Injection via editar_producto.php

Facturation System 1.0 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'modid' parameter. Attackers can send POST requests to the editarproducto.php endpoint with crafted SQL payloads in the modid...

CVE-2018-25189

Data Center Audit 2.6.2 contains an SQL injection vulnerability in the username parameter of dca_login.php that allows unauthenticated attackers to submit crafted SQL payloads via POST to extract sensitive DB information (usernames, database names, version details). CVSS vectors: CVSS3.1 (AV:N/AC...

CVE-2018-25190

Easyndexer 1.0 is affected by a CSRF in createuser.php that enables unauthenticated attackers to create administrative accounts by submitting forged POSTs with username, password, name, surname, and privileges=1. CVSS v3.1: 5.3 (NETWORK, LOW CA/PR, NONE UI) with I/L; CVSS v4.0: 6.9 (NETWORK, LOW ...

CVE-2018-25180

Maitra 1.7.2 contains an sql injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the mailid parameter in outmail and inmail modules. Attackers can also download the SQLite database file directly from the application...

CVE-2018-25178 Easyndexer 1.0 Arbitrary File Download via showtif.php

Easyndexer 1.0 contains an arbitrary file download vulnerability that allows unauthenticated attackers to download sensitive files by manipulating the file parameter. Attackers can send POST requests to showtif.php with arbitrary file paths in the file parameter to retrieve system files like...

CVE-2018-25176

CVE-2018-25176 affects Alive Parish 2.0.4. The advisory documents an unauthenticated SQL injection via the key parameter in the search endpoint and an arbitrary file upload through the person photo upload feature that can lead to remote code execution, with CVSS scores indicating HIGH severity (C...

CVE-2018-25176 Alive Parish 2.0.4 SQL Injection and Arbitrary File Upload

Alive Parish 2.0.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the key parameter in the search endpoint. Attackers can also upload arbitrary files via the person photo upload functionality to th...

CVE-2018-25175

CVE-2018-25175 affects Alienor Web Libre 2.0. It is an SQL injection in index.php where the identifiant parameter can be injected via crafted POST requests, allowing unauthenticated attackers to extract sensitive database information (usernames, databases, version details). Root cause: unsanitize...

CVE-2018-25173 Rmedia SMS 1.0 SQL Injection via editgrp.php

Rmedia SMS 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to extract database information by injecting SQL code through the gid parameter. Attackers can send GET requests to editgrp.php with malicious gid values using EXTRACTVALUE and CONCAT functions to retriev...

CVE-2018-25168

Precurio Intranet Portal 2.0 contains a Cross-Site Request Forgery vulnerability that allows unauthenticated attackers to create administrative user accounts by submitting crafted POST requests to the /public/admin/user/submitnew endpoint without CSRF tokens. The issue stems from missing CSRF pro...

CVE-2018-25164

EverSync 0.5 contains an arbitrary file download vulnerability that allows unauthenticated attackers to access sensitive files by requesting them directly from the files directory. Attackers can send GET requests to the files directory to download database files like db.sq3 containing application...

NewStart CGSL MAIN 6.06 (SP) : gettext Vulnerability (NS-SA-2026-0015)

The remote NewStart CGSL host, running version MAIN 6.06 SP, has gettext packages installed that are affected by a vulnerability: - An issue was discovered in GNU gettext 0.19.8. There is a double free in defaultaddmessage in read- catalog.c, related to an invalid free in pogramparse in...

CVE-2018-12116

creationtimestamp| type| source ---|---|--- 2026-03-05 09:58:04+00:00| published-proof-of-concept| https://t.me/poxek/5968...

CVE-2018-4013

creationtimestamp| type| source ---|---|--- 2026-03-04 21:17:54+00:00| seen| https://gist.github.com/OxBat/68c6985e8109c209a2842933de844b8b...

CVE-2018-25160

creationtimestamp| type| source ---|---|--- 2026-02-27 23:35:46+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mfuut5hylf2w 2026-02-27 23:40:06+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfuv2vq2yv2u...

CVE-2018-25160

HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend. For example, if an application uses memcached for session storage, then it may be possible for a remote attacker to inject...

CVE-2018-25160

HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend. For example, if an application uses memcached for session storage, then it may be possible for a remote attacker to inject...

CVE-2018-25160 HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend

HTTP::Session2 versions through 1.09 for Perl does not validate the format of user provided session ids, enabling code injection or other impact depending on session backend. For example, if an application uses memcached for session storage, then it may be possible for a remote attacker to inject...

CVE-2018-25160

Summary (CVE-2018-25160) : The Perl package HTTP::Session2 (versions through 1.09) does not validate the format of user-provided session IDs, enabling potential code injection or other impact depending on the session backend. Red Hat and EU/ENISA entries corroborate that insecure session-id handl...

Instagram flagged explicit messages to minors in 2018. Image-blurring arrived six years later

Meta took six years to blur explicit images on Instagram, even though internal emails show executives were aware in 2018 that minors were receiving them, according to newly unsealed court documents. In a deposition given last year, Adam Mosseri now the head of Instagram discusses an email thread...