CVE-2025-12857 code-projects Responsive Hotel Site roombook.php sql injection

A security vulnerability has been detected in code-projects Responsive Hotel Site 1.0. The affected element is an unknown function of the file /admin/roombook.php. Such manipulation of the argument rid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed...

CVE-2025-63551

A Server-Side Request Forgery SSRF vulnerability, achievable through an XML External Entity XXE injection, exists in MetInfo Content Management System CMS thru 8.1. This flaw stems from a defect in the XML parsing logic, which allows an attacker to construct a malicious XML entity that forces the...

CVE-2025-63551

A Server-Side Request Forgery SSRF vulnerability, achievable through an XML External Entity XXE injection, exists in MetInfo Content Management System CMS thru 8.1. This flaw stems from a defect in the XML parsing logic, which allows an attacker to construct a malicious XML entity that forces the...

Keycloak Admin Path Traversal Vulnerability (CVE-2025-10939)

The version of Keycloak installed on the remote host is affected by a path traversal vulnerability. A flaw was found in Keycloak where the /admin path can be accessed using relative/non-normalized paths e.g., /realms/../admin/, bypassing proxy restrictions recommended in the Keycloak guides. This...

Duplicate Advisory: Keycloak allows access to admin path through flaw

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-j4vq-q93m-4683. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the...

GHSA-C6CM-5GC7-C3F4 Duplicate Advisory: Keycloak allows access to admin path through flaw

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-j4vq-q93m-4683. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the...

CVE-2025-10939

A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occurs at least via ha-proxy, as it can be tricked to using relative/non-normalized paths to access the /admin application path relative to...

Uncontrolled Search Path Element

Overview Affected versions of this package are vulnerable to Uncontrolled Search Path Element via the /admin application path relative to /realms when accessed through a proxy that does not properly restrict or normalize URLs. An attacker can gain unauthorized access to sensitive administrative...

CVE-2025-10939 Org.keycloak/keycloak-quarkus-server: unable to restrict access to the admin console

A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occurs at least via ha-proxy, as it can be tricked to using relative/non-normalized paths to access the /admin application path relative to...

CVE-2025-10939

A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occurs at least via ha-proxy, as it can be tricked to using relative/non-normalized paths to access the /admin application path relative to...

CVE-2025-12338 Campcodes Retro Basketball Shoes Online Store admin_product.ph sql injection

A weakness has been identified in Campcodes Retro Basketball Shoes Online Store 1.0. This vulnerability affects unknown code of the file /admin/adminproduct.ph. Executing a manipulation of the argument pid can lead to sql injection. The attack may be launched remotely. The exploit has been made...

PT-2025-44084

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in Keycloak where the /admin path can be accessed via a proxy, such as ha-proxy, by using relative or non-normalized paths. Keycloak documentation advises against exposing the...

Red Hat build of Keycloak 代码问题漏洞

Red Hat build of Keycloak is a web application for single sign-on from Red Hat USA. A code issue vulnerability exists in the Red Hat build of Keycloak, which stems from a proxy misconfiguration that could result in accessing the /admin path via a non-normalized path...

Willow CMS 代码注入漏洞

Willow CMS is a content management system by mndeaves individual developers. A code injection vulnerability exists in Willow CMS 1.4.0 and earlier versions, which stems from an incorrect manipulation of the parameters title/body in the file /admin/articles/add, which could lead to a cross-site...

Emoncms 安全漏洞

Emoncms is an open source web application from Emoncms Open Source. The program is primarily used to process, record and display energy, temperature and other environmental data. A security vulnerability exists in Emoncms version 11.7.3, which stems from insufficient input validation of the...

Automated Voting System update_user.php File SQL Injection Vulnerability

Automated Voting System is an automated voting system. Automated Voting System suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the parameter Password in the file /admin/updateuser.php. An attacker can exploit this...

CVE-2025-41020

Insecure direct object reference IDOR vulnerability in Sergestec's Exito v8.0. This vulnerability allows an attacker to access data belonging to other customers through the 'id' parameter in '/admin/ticketa4.php'...

EUVD-2025-34733

Insecure direct object reference IDOR vulnerability in Sergestec's Exito v8.0. This vulnerability allows an attacker to access data belonging to other customers through the 'id' parameter in '/admin/ticketa4.php'...

CVE-2025-11352

The CVE-2025-11352 entry concerns code-projects Online Hotel Reservation System 1.0. The vulnerability resides in the /admin/addexec.php script, where manipulation of the image parameter enables unrestricted file uploads. This flaw is described as remotely exploitable and is noted as publicly dis...

EUVD-2010-2142

Malware in sbrugna...