CVE-2024-55059: Improper Neutralization of Input During Web Page Generation

A stored HTML Injection vulnerability was identified in PHPGurukul Online Birth Certificate System v1.0 in /user/certificate-form.php...

CVE-2024-55056: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability was identified in Phpgurukul Online Birth Certificate System 1.0 in /user/certificate-form.php via the full name field...

PT-2024-26257

Name of the Vulnerable Software and Affected Versions Campcodes Complete Web-Based School Management System version 1.0 Description A SQL injection issue allows an attacker to execute arbitrary SQL commands via the conversation id parameter in the "/view/emarks range grade update form.php" API...

PT-2024-35217

Name of the Vulnerable Software and Affected Versions Campcodes Complete Web-Based School Management System version 1.0 Description A critical issue was found in the system, affecting the file /view/timetable insert form.php. The manipulation of the grade argument leads to SQL injection. It is...

PT-2024-35227

Name of the Vulnerable Software and Affected Versions Campcodes Complete Web-Based School Management System version 1.0 Description A critical issue has been found in the system, affecting the file /view/timetable update form.php. The manipulation of the grade argument leads to SQL injection. The...

PT-2024-32222

Name of the Vulnerable Software and Affected Versions Campcodes Complete Web-Based School Management System version 1.0 Description A vulnerability has been found in the system, classified as problematic. It affects an unknown functionality of the file /view/exam timetable update form.php. The...

CVE-2024-0844

The Popup More Popups, Lightboxes, and more popup modules plugin for WordPress is vulnerable to Local File Inclusion in version 2.1.6 via the ycfChangeElementData function. This makes it possible for authenticated attackers, with administrator-level access and above, to include and execute...

PT-2024-15861 · WordPress · Popup More Popups

Name of the Vulnerable Software and Affected Versions: The Popup More Popups, Lightboxes, and more popup modules plugin for WordPress version 2.1.6 Description: The issue allows authenticated attackers with administrator-level access and above to include and execute arbitrary files ending with...

Cross-site Scripting (XSS)

baserproject/basercms is vulnerable to Cross-site Scripting XSS. The vulnerability in the favorite feature of form.php because it fails to properly escape malicious characters before rendering. This allows an attacker to inject and execute malicious JavaScript in the web browser when accessing th...

CVE-2023-0563: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic has been found in PHPGurukul Bank Locker Management System 1.0. This affects an unknown part of the file add-locker-form.php of the component Assign Locker. The manipulation of the argument ahname leads to cross site scripting. It is possible to initiate...

CVE-2009-10001: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic was found in jianlinwei cool-php-captcha up to 0.2. This vulnerability affects unknown code of the file example-form.php. The manipulation of the argument captcha with the input %3Cscript%3Ealert1%3C/script%3E leads to cross site scripting. The attack can...

PT-2022-22221

Name of the Vulnerable Software and Affected Versions itsourcecode Advanced School Management System version 1.0 Description The issue concerns SQL Injection via the grade parameter at the "/school/view/timetable insert form.php" API endpoint. This allows for potential unauthorized access to...

CVE-2021-42358

The Contact Form With Captcha WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation in the /cfwc-form.php file during contact form submission, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 1.6.2...

PT-2021-23589

Name of the Vulnerable Software and Affected Versions Contact Form With Captcha WordPress plugin versions up to, and including 1.6.2 Description The issue is related to Cross-Site Request Forgery due to missing nonce validation in the /cfwc-form.php file during contact form submission. This allow...

CVE-2021-42358: Cross-Site Request Forgery (CSRF)

The Contact Form With Captcha WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation in the /cfwc-form.php file during contact form submission, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 1.6.2...

CVE-2021-42363

The Preview E-Mails for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the searchorder parameter found in the /views/form.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.6.8...

CVE-2021-39353

The Easy Registration Forms WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the ajaxaddform function found in the /includes/class-form.php file which made it possible for attackers to inject arbitrary web scripts in versions up to, and including...

PT-2021-23595

Name of the Vulnerable Software and Affected Versions Preview E-Mails for WooCommerce WordPress plugin versions up to and including 1.6.8 Description The issue allows attackers to inject arbitrary web scripts via the search order parameter found in the /views/form.php file, enabling Reflected...

CVE-2021-42363: Improper Neutralization of Input During Web Page Generation

The Preview E-Mails for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the searchorder parameter found in the /views/form.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.6.8...

CVE-2021-39353: Cross-Site Request Forgery (CSRF)

The Easy Registration Forms WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the ajaxaddform function found in the /includes/class-form.php file which made it possible for attackers to inject arbitrary web scripts in versions up to, and including...