CVE-2026-110625

ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/flaggeditem.php via the unencoded type GET parameter. Attackers can send crafted flaggeditem.php?type= links to logged-in administrators or moderators to execute injected script in the admin panel...

CVE-2026-110625

Versions v5 through 5.5.3-#206 of ClipBucket are vulnerable to a reflected cross-site scripting (XSS) vulnerability. The flaw exists in the admin_area/flagged_item.php file due to the lack of encoding on the type GET parameter. An attacker can distribute crafted links to logged-in administrators ...

EUVD-2026-101253

ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/flaggeditem.php via the unencoded type GET parameter. Attackers can send crafted flaggeditem.php?type= links to logged-in administrators or moderators to execute injected script in the admin panel...

ffuf

ffuf - Fuzz Faster U Fool A fast web fuzzer written in Go. Installation Example usage Content discovery Vhost discovery Parameter fuzzing POST data fuzzing Using external mutator Configuration files Help Interactive mode Installation Download a prebuilt binary from releases page, unpack and run! ...

CVE-2024-29895-CactiRCE-PoC

Cacti RCE - CVE-2024-29895 Usage: python3 cve-2024-29895.py -u https://target.com/ -c id Affecting Cacti versions 1.3.X on DEV builds where cmdrealtime.php is present and POLLERID is enabled. Command Injection is possible via this endpoint, by requesting via GET with payload as HTML Query...

CVE-2026-58457

CVE-2026-58457 - Unauthenticated OS Command Injection in Shenzhen Aitemi M300 Wi-Fi Repeater !WARNING This code is provided AS IS for educational and research purposes only. Do not use this PoC on production systems, shared environments, or any unauthorized targets. Running or hosting this code m...

CVE-2026-74251

Unauthenticated SQL Injection via Attribute Filter in Phoca Cart Phoca Cart ≤ 6.1.6 — Unauthenticated Attacker Extracts Full Database via Time-Based Blind Injection SUMMARY The a attribute and s specification GET array parameters on Phoca Cart's public shop items page are concatenated raw into SQ...

CVE-2026-109327

The Admidio application (versions 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 ) is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw in the system/redirect.php component. The root cause is an incomplete fix for CVE-2021-43810, allowing unauthenticated attackers to inject JavaScript via ...

CVE-2026-109327 Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php

Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/redirect.php that allows unauthenticated attackers to inject JavaScript via the url GET parameter, due to an incomplete fix for CVE-2021-43810. Attackers can craft a javascript:...

CVE-2024-52301-Research

CVE-2024-52301-Research A bit of research around CVE-2024-52301. I've seen the vuln and wanted to find out how Laravel is vulnerable. For this, I just diffed the 6.20.44 and 6.20.45 versions, and traced how GET parameters could end up changing the application configuration. I've written about thi...

CVE-2024-9796

CVE-2024-9796 POC SQLi - CVE-2024-9796 Functional PoC for vulnerability CVE-2024-9796, which affects the WP Advanced Search autocompletion plugin in WordPress, allowing SQL injection through unsanitized GET parameters. 📌 Description This vulnerability allows an attacker to inject arbitrary SQL...

CVE-2025-55885

CVE-2025-55885 Description SQL Injection vulnerability in Alpes Recherche et Developpement ARD GEC en Ligne before v.2025-04-23 allows a remote attacker to escalate privileges via the GET parameters in index.php Attack Vectors SQL injection via unsanitized GET parameter ocid on...

semcms

Introduction to Semcms SEMCMS is a foreign trade website content management system CMS that supports multiple languages. v4.8 Download Link: http://www.sem-cms.com/TradeCmsdown/php/semcmsphp4.8.zip Causes of vulnerabilities: /xcR45qAdmin/SEMCMSMenu.php Line 66 Vulnerability code: query"SELECT FRO...

Wordpress-ebook-CVE-2016-10924

Wordpress eBook Download 1.1 plugin has a file disclosure vulnerability by abusing it's get parameter in the filedownload.php file. This script brute forces different processes on the server using this vulnerability. USAGE: python pidbrute.py...

CVE-2025-7606

CVE-2025-7606 code-projects AVL Rooms Project V1.0/city.php SQL injection NAME OF AFFECTED PRODUCTS AVL Rooms Vendor Homepage https://code-projects.org/avl-rooms-in-php-css-javascript-and-mysql-free-download/ submitter dazhi Vulnerable File /city.php VERSIONS V1.0 Software Link...

CVE-2020-27368

CVE-2020-27368 TOTOLINK-A702R-V1.0.0-B20161227.1023 Directory Indexing Vulnerability Description Directory Indexing in Login Portal of Login Portal of TOTOLINK-A702R-V1.0.0-B20161227.1023 allows attacker to access /icons/ directories via GET Parameter. Additional Information Remediation disabling...

HotelDruid-CVE-2021-42948

CVE-2021-42948 HotelDruid Hotel Management Software v3.0.3 and below was discovered to have exposed session tokens in multiple links via GET parameters, allowing attackers to access user session id's. The session token used to access authenticated pages of the application is passed using GET...

CVE-2025-66947

CVE-2025-66947 Inyección SQL ciega basada en tiempo en krishanmuraiji SMS v1.0 ⏱️ Comparación visual: respuesta normal vs respuesta retardada 6s 🔍 Resumen TL;DR: Un parámetro GET en un módulo administrativo permite inyección SQL basada en tiempo mediante retardos en la respuesta. Existe una...

CVE-2025-47423

CVE-2025-47423 – Local File Inclusion in Personal Weather Station Dashboard 12lts Discovered by: Matthew Eagle Status: Public Disclosure Date Reported: 2025-05-05 CVE ID: CVE-2025-47423 🧩 Summary A Local File Inclusion LFI vulnerability in the Personal Weather Station Dashboard version 12lts allo...

CVE-2021-3030

The Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting (XSS) due to improper validation of the Theme GET parameter within the /CuteSoft_Client/CuteEditor/Dialogs/colorpicker_more.aspx component. A remote, unauthenticated attacker can craft a malicious URL that, when opene...