freepbx-endpoint-sqli-rce

CVE-2025-57819 — FreePBX 端点模块 SQL注入 → 远程代码执行 摘要 FreePBX 是 Asterisk PBX 的开源 Web 图形用户界面，广泛应用于企业电话环境。端点管理器 模块在 /admin/ajax.php 处暴露了一个 AJAX 处理程序，该程序接收一个 brand 参数，并在未经过滤的情况下直接将其插入 SQL 查询中。未经身份验证的远程攻击者可以注入任意 SQL，在 cronjobs 表中插入一行，并让 FreePBX 的 cron 守护进程将一个可执行的 PHP 网页木马写入 Web 根目录——从而在大约一分钟内实现未经身份验证的远程代码执...

FreePBX-CVE-2025-57819

FreePBX CVE-2025-57819 — SQLi non autenticato a Root RCE Gravità: Critico Tipo: SQL Injection non autenticata → Esecuzione remota di codice Software interessato: FreePBX modulo endpoint Testato su: FreePBX su CentOS 7, Apache 2.4, PHP 7.4, MariaDB 5.5 Panoramica Esiste una vulnerabilità di SQL...

CVE-2026-1469

Stored Cross-Site Scripting XSS in RLE NOVA's PlanManager. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by injecting malicious payload through the ‘comment’ and ‘brand’ parameters in ‘/index.php’. The payload is stored by the application and subsequentl...

CVE-2026-1469

Stored Cross-Site Scripting XSS in RLE NOVA's PlanManager. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by injecting malicious payload through the ‘comment’ and ‘brand’ parameters in ‘/index.php’. The payload is stored by the application and subsequentl...

CVE-2026-1469 Stored Cross-Site Scripting (XSS) in RLE NOVA's PlanManager

Stored Cross-Site Scripting XSS in RLE NOVA's PlanManager. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by injecting malicious payload through the ‘comment’ and ‘brand’ parameters in ‘/index.php’. The payload is stored by the application and subsequentl...

CVE-2026-1469

Stored Cross-Site Scripting XSS in RLE NOVA's PlanManager. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by injecting malicious payload through the ‘comment’ and ‘brand’ parameters in ‘/index.php’. The payload is stored by the application and subsequentl...

CVE-2026-1469 Stored Cross-Site Scripting (XSS) in RLE NOVA's PlanManager

Stored Cross-Site Scripting XSS in RLE NOVA's PlanManager. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by injecting malicious payload through the ‘comment’ and ‘brand’ parameters in ‘/index.php’. The payload is stored by the application and subsequentl...

EUVD-2026-4996

Stored Cross-Site Scripting XSS in RLE NOVA's PlanManager. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by injecting malicious payload through the ‘comment’ and ‘brand’ parameters in ‘/index.php’. The payload is stored by the application and subsequentl...

PT-2026-5261

Stored Cross-Site Scripting XSS in RLE NOVA's PlanManager. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by injecting malicious payload through the ‘comment’ and ‘brand’ parameters in ‘/index.php’. The payload is stored by the application and subsequentl...

SourceCodester Simple Inventory System SQL注入漏洞

SourceCodester Simple Inventory System is a SourceCodester open source simple inventory system. A SQL injection vulnerability exists in SourceCodester Simple Inventory System version 1.0, which stems from incorrect manipulation of the parameter editBrandName in the file /brand.php, which could le...

CVE-2018-17981

Lifesize Express ls ex24.7.10 2000 14 devices allow XSS via the interface/interface.php brand parameter...

SourceCodester Online Eyewear Shop 代码注入漏洞

SourceCodester Online Eyewear Shop is a SourceCodester open source online eyewear store website project developed using PHP and MySQL, which provides an online shopping and ordering platform for the eyewear business and its potential customers. A code injection vulnerability exists in...

SourceCodester Online Eyewear Shop 代码注入漏洞

SourceCodester Online Eyewear Shop is a SourceCodester open source online eyewear store website project developed using PHP and MySQL, which provides an online shopping and ordering platform for the eyewear business and its potential customers. A code injection vulnerability exists in...

PT-2024-16857 · Sourcecodester · Sourcecodester Online Eyewear Shop

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Eyewear Shop version 1.0 Description: A vulnerability has been found in the Inventory Page component, specifically in the file /oews/classes/Master.php?f=save product. The manipulation of the brand argument leads to...

SourceCodester Stock Management System SQL注入漏洞

Sourcecodester Stock Management System is an inventory management system. A SQL injection vulnerability exists in SourceCodester Stock Management System version 1.0, which stems from a SQL injection caused by the brandName parameter of the file createBrand.php...

CVE-2023-24234

A stored cross-site scripting XSS vulnerability in the component php-inventory-management-system/brand.php of Inventory Management System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Brand Name parameter...

CVE-2022-46126

Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/brands/managebrand.php?id=...

CVE-2022-36637

Garage Management System v1.0 was discovered to contain a persistent cross-site scripting XSS vulnerability via the brandname parameter at /brand.php...

CVE-2018-17981

Lifesize Express ls ex24.7.10 2000 14 devices allow XSS via the interface/interface.php brand parameter...

CVE-2018-17981

CVE-2018-17981 affects Lifesize Express devices running ls ex2_4.7.10 (2000 (14) devices). The vulnerability is a cross-site scripting (XSS) flaw exploitable via the interface/interface.php brand parameter, leading to potential script execution in a user’s browser. Root cause is an XSS in the bra...