CVE-2022-38813

CVE-2022-38813 Escalada de privilegios vertical a través del parámetro user en Blood Donor Management System Using Codeigniter v 1.0 Descripción técnica: Blood Donor Management System 1.0 no restringe adecuadamente el acceso a admin/dashboard.php, lo que permite a los atacantes acceder a todos lo...

CVE-2022-40470

CVE-2022-40470 Cross Site Scripting en el Sistema de Gestión de Donantes de Sangre usando CodeIgniter - 1.0 Descripción sugerida Phpgurukul Sistema de Gestión de Donantes de Sangre 1.0 permite Cross Site Scripting a través de la función Agregar Nombre de Grupo Sanguíneo. Información Adicional PoC...

CVE-2026-85113

The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...

EUVD-2026-83868

The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...

CVE-2026-85113

GiveWP WordPress plugin versions before 4.16.9 fail to remove shortcode delimiters from donor-supplied values (such as donor names) before rendering them on public pages. The shortcode-stripping logic the plugin applies can be defeated by nesting , allowing unauthenticated users to execute arbitr...

CVE-2026-85113 GiveWP < 4.16.9 - Unauthenticated Arbitrary Shortcode Execution via Donor Name

The GiveWP WordPress plugin before 4.16.9 does not remove shortcode delimiters from donor-supplied values before rendering them on public pages, and the shortcode stripping it applies can be defeated by nesting, allowing unauthenticated users to execute arbitrary shortcodes registered on the site...

EUVD-2026-80196

The GiveWP WordPress plugin before 4.16.8.1 does not consistently normalise a donor's e-mail address between the value it stores and the value it later uses to look that donor up, allowing unauthenticated users to be resolved as an arbitrary donor and to set the WordPress password of any user...

EUVD-2026-78224

A weakness has been identified in PHPGurukul Blood Donor Management System 1.0. Affected by this issue is some unknown functionality of the file application/models/admin/LoginModel.php. This manipulation of the argument password/email/currentpassword/dbcurrentpwd/newpassword causes cleartext...

EUVD-2026-78223

A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /application/controllers/admin/Report.php of the component Report Endpoint. The manipulation of the argument fromdate/todate results in sql...

EUVD-2026-78222

A vulnerability was identified in PHPGurukul Blood Donor Management System 1.0. Affected is the function construct of the file /application/controllers/admin/Dashboard.php of the component Admin Controllers. The manipulation leads to improper authentication. The attack can be initiated remotely...

CVE-2026-90842

A weakness has been identified in PHPGurukul Blood Donor Management System 1.0. Affected by this issue is some unknown functionality of the file application/models/admin/LoginModel.php. This manipulation of the argument password/email/currentpassword/dbcurrentpwd/newpassword causes cleartext...

CVE-2026-90841

A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /application/controllers/admin/Report.php of the component Report Endpoint. The manipulation of the argument fromdate/todate results in sql...

CVE-2026-90841: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /application/controllers/admin/Report.php of the component Report Endpoint. The manipulation of the argument fromdate/todate results in sql...

CVE-2026-90842: Cleartext Storage in a File or on Disk

A weakness has been identified in PHPGurukul Blood Donor Management System 1.0. Affected by this issue is some unknown functionality of the file application/models/admin/LoginModel.php. This manipulation of the argument password/email/currentpassword/dbcurrentpwd/newpassword causes cleartext...

CVE-2026-90840: Improper Authentication

A vulnerability was identified in PHPGurukul Blood Donor Management System 1.0. Affected is the function construct of the file /application/controllers/admin/Dashboard.php of the component Admin Controllers. The manipulation leads to improper authentication. The attack can be initiated remotely...

CVE-2026-90842

PHPGurukul Blood Donor Management System 1.0 is affected by a cleartext storage vulnerability in application/models/admin/Login_Model.php . Manipulating the arguments password , email , currentpassword , dbcurrentpwd , or newpassword allows sensitive data to be stored in plaintext on disk. The at...

CVE-2026-90842 PHPGurukul Blood Donor Management System Login_Model.php cleartext storage in file

A weakness has been identified in PHPGurukul Blood Donor Management System 1.0. Affected by this issue is some unknown functionality of the file application/models/admin/LoginModel.php. This manipulation of the argument password/email/currentpassword/dbcurrentpwd/newpassword causes cleartext...

CVE-2026-90842 PHPGurukul Blood Donor Management System Login_Model.php cleartext storage in file

A weakness has been identified in PHPGurukul Blood Donor Management System 1.0. Affected by this issue is some unknown functionality of the file application/models/admin/LoginModel.php. This manipulation of the argument password/email/currentpassword/dbcurrentpwd/newpassword causes cleartext...

CVE-2026-90841 PHPGurukul Blood Donor Management System Report Endpoint Report.php sql injection

A security flaw has been discovered in PHPGurukul Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /application/controllers/admin/Report.php of the component Report Endpoint. The manipulation of the argument fromdate/todate results in sql...

CVE-2026-90841

A SQL injection vulnerability in PHPGurukul Blood Donor Management System 1.0 affects the Report Endpoint (file /application/controllers/admin/Report.php). Manipulating the fromdate/todate arguments allows a remote, unauthenticated attacker to inject SQL, potentially compromising confidentiality,...