CVE-2025-10620 itsourcecode Online Clinic Management System editp2.php sql injection

A flaw has been found in itsourcecode Online Clinic Management System 1.0. This vulnerability affects unknown code of the file /editp2.php. Executing manipulation of the argument id/firstname/lastname/type/age/address can lead to sql injection. The attack can be executed remotely. The exploit has...

CVE-2025-39786

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ad7173: fix channels index for syscalibmode Fix the index used to look up the channel when accessing the syscalibmode attribute. The address field is a 0-based index same as scanindex that it used to access the channel ...

CVE-2025-58746

The Volkov Labs Business Links panel for Grafana provides an interface to navigate using external links, internal dashboards, time pickers, and dropdown menus. Prior to version 2.4.0, a malicious actor with Editor privileges can escalate their privileges to Administrator and perform arbitrary...

CVE-2025-44961

In RUCKUS SmartZone SZ before 6.1.2p3 Refresh Build, OS command injection can occur via an IP address field provided by an authenticated user...

CVE-2025-44961

In RUCKUS SmartZone SZ before 6.1.2p3 Refresh Build, OS command injection can occur via an IP address field provided by an authenticated user...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure in the process that applies field masking rules to fields of types ip, geopoint, geoshape, xypoint, and xyshape. An attacker can access sensitive information by issuing search queries that reconstruct the original...

CodeAstro Simple Hospital Management System 安全漏洞

CodeAstro Simple Hospital Management System is a simple hospital management system from CodeAstro. A security vulnerability exists in CodeAstro Simple Hospital Management System version 1.0, which originates from a cross-site scripting attack due to an incorrect manipulation of the parameters Fir...

CVE-2021-23253

Opera Mini for Android below 53.1 displays URL left-aligned in the address field. This allows a malicious attacker to craft a URL with a long domain name, e.g. www.safe.opera.com.attacker.com. With the URL being left-aligned, the user will only see the front part e.g. www.safe.opera.com… The exac...

CVE-2021-34223

Cross-site scripting in urlfilter.htm in TOTOLINK A3002R version V1.1.1-B20200824 Important Update, new UI allows attackers to execute arbitrary JavaScript by modifying the "URL Address" field...

CVE-2021-31329

Cross Site Scripting XSS in Remote Clinic v2.0 via the "Chat" and "Personal Address" field on staff/register.php...

CVE-2020-28124

Cross Site Scripting XSS in LavaLite 5.8.0 via the Address field...

CVE-2012-3558

Opera before 11.65 does not ensure that the address field corresponds to the displayed web page during unusually timed changes to this field, which makes it easier for user-assisted remote attackers to conduct spoofing attacks via vectors involving navigation, reloads, and redirects...

CVE-2019-15238

The cforms2 plugin before 15.0.2 for WordPress has CSRF related to the IP address field...

CVE-2019-10107

CMS Made Simple 2.2.10 has XSS via the myaccount.php "Email Address" field, which is reachable via the "My Preferences - My Account" section...

CVE-2012-6471

Opera before 12.12 allows remote attackers to spoof the address field via a high rate of HTTP requests...

Exploit for CVE-2025-29276

CVE-2025-29276 Proof of Concept PoC: In the Diagnostics tab,...

PT-2025-14567 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS versions 9 and earlier than 9.4.0RC2 Concrete CMS versions earlier than 8.5.20 Description: The issue concerns Concrete CMS's Address attribute, where addresses are not properly sanitized in the output when a country is not...

CVE-2025-29719

SourceCodester rems Employee Management System 1.0 is vulnerable to Cross Site Scripting XSS in addemployee.php via the First Name and Address text fields...

go-git: argument injection via the URL field

An argument injection vulnerability was found in go-git. This flaw allows an attacker to set arbitrary values to git-upload-pack flags, leading to command or code execution, exposure of sensitive data, or other unintended behavior. This is only possible in configurations where the file transport...

BIT-DJANGO-2024-56374

An issue was discovered in Django 5.1 before 5.1.5, 5.0 before 5.0.11, and 4.2 before 4.2.18. Lack of upper-bound limit enforcement in strings passed when performing IPv6 validation could lead to a potential denial-of-service attack. The undocumented and private functions cleanipv6address and...