PT-2025-25276 · Unknown · Kicode111 Like-Girl

Name of the Vulnerable Software and Affected Versions: kiCode111 like-girl version 5.2.0 Description: A critical issue has been found in the processing of the file /admin/ImgUpdaPost.php. The manipulation of the argument id, imgText, imgDatd, or imgUrl leads to SQL injection. The attack may be...

CVE-2025-5973

PHPGurukul Restaurant Table Booking System 1.0 contains a cross-site scripting (XSS) flaw in the /admin/add-table.php file. The vulnerability arises from manipulation of the tableno parameter in an unknown functionality, enabling remote attacker input that can execute scripts in a user’s browser ...

CVE-2025-5886 Emlog article.php cross site scripting

A vulnerability was found in Emlog up to 2.5.7 and classified as problematic. This issue affects some unknown processing of the file /admin/article.php. The manipulation of the argument activepost leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed ...

CVE-2025-5881

CVE-2025-5881 affects code-projects Chat System (versions up to 1.0). Multiple connected sources describe a vulnerability in /user/confirm_password.php where manipulating the parameter cid allows an SQL injection. Exploitation can be remote and the vulnerability has been disclosed publicly. Evide...

CVE-2025-5706

A vulnerability was found in PHPGurukul Human Metapneumovirus Testing Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /new-user-testing.php. The manipulation of the argument state leads to sql injection. The attack ca...

CVE-2025-5617

A vulnerability classified as critical has been found in PHPGurukul Online Fire Reporting System 1.2. This affects an unknown part of the file /admin/manage-teams.php. The manipulation of the argument teamid leads to sql injection. It is possible to initiate the attack remotely. The exploit has...

CVE-2025-5758 SourceCodester Open Source Clinic Management System doctor.php sql injection

A vulnerability classified as critical has been found in SourceCodester Open Source Clinic Management System 1.0. This affects an unknown part of the file /doctor.php. The manipulation of the argument doctorname leads to sql injection. It is possible to initiate the attack remotely. The exploit h...

PT-2025-24060 · Undefined · Undefined

CVSS: 4.3 Impact Loss of Availability Loss of Confidentiality Loss of Integrity Description A remote authenticated attacker can exploit a vulnerability in Synology DiskStation Manager and Synology Router Manager in order to manipulate files. Affected Versions Synology - Synology Router Manager -...

CVE-2025-5651

CVE-2025-5651 affects code-projects Traffic Offense Reporting System 1.0. The vulnerability is caused by cross-site scripting in saveuser.php due to improper handling of input parameters (user_id/username/email/name/position), enabling injection of arbitrary scripts. Reports across multiple sourc...

CVE-2025-5610

CodeAstro Real Estate Management System 1.0 contains a SQL injection vulnerability in the /submitpropertydelete.php file, caused by unsafely manipulating the ID parameter. The issue is exploitable remotely, with exploitation details disclosed publicly. Multiple sources corroborate the existence a...

CVE-2025-44115

A vulnerability has been found in Cotonti Siena v0.9.25. Affected by this vulnerability is the file /admin.php?m=config=edit=core=title. The manipulation of the value of title leads to cross-site scripting...

PT-2025-23735 · Unknown · Phpgurukul Rail Pass Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Rail Pass Management System version 1.0 Description: A critical issue has been found in the PHPGurukul Rail Pass Management System, affecting some unknown functionality of the file /admin/pass-bwdates-reports-details.php. The...

CVE-2025-5513 quequnlong shiyi-blog add cross site scripting

A vulnerability has been found in quequnlong shiyi-blog up to 1.2.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /dev-api/api/comment/add. The manipulation of the argument content leads to cross site scripting. The attack can be launched...

BIT-DRUPAL-2024-11942 Drupal core - Moderately critical - Improper error handling - SA-CORE-2024-002

A vulnerability in Drupal Core allows File Manipulation.This issue affects Drupal Core: from 10.0.0 before 10.2.10...

CVE-2025-5498 slackero phpwcms Custom Source Tab cnt21.readform.inc.php is_file deserialization

A vulnerability was found in slackero phpwcms up to 1.9.45/1.10.8. It has been rated as critical. This issue affects the function filegetcontents/isfile of the file include/inclib/content/cnt21.readform.inc.php of the component Custom Source Tab. The manipulation of the argument cpagecustom leads...

PT-2025-23613

Name of the Vulnerable Software and Affected Versions slackero phpwcms versions 1.9.45 and earlier, slackero phpwcms versions 1.10.8 and earlier Description A critical issue affects the function file get contents/is file of the file include/inc lib/content/cnt21.readform.inc.php in the Custom...

Avast Business Antivirus for Linux do_update_vps() Spoofing

The vulnerability of the doupdatevps function in the Avast Business Antivirus for Linux antivirus tool is related to the use of files and directories accessible from external sources. Exploiting this vulnerability could allow attackers to carry out spoofing attacks by manipulating update files...

CVE-2025-1750

An SQL injection vulnerability exists in the delete function of DuckDBVectorStore in run-llama/llamaindex version v0.12.19. This vulnerability allows an attacker to manipulate the refdocid parameter, enabling them to read and write arbitrary files on the server, potentially leading to remote code...

CVE-2025-1750

CVE-2025-1750 affects run-llama/llama_index v0.12.19, via an SQL injection in the DuckDBVectorStore.delete path that lets an attacker manipulate ref_doc_id to read/write arbitrary server files and potentially achieve remote code execution (RCE). Public analyses corroborate the risk and point to t...

CVE-2025-1750 SQL Injection in run-llama/llama_index

An SQL injection vulnerability exists in the delete function of DuckDBVectorStore in run-llama/llamaindex version v0.12.19. This vulnerability allows an attacker to manipulate the refdocid parameter, enabling them to read and write arbitrary files on the server, potentially leading to remote code...