CVE-2025-65647

Insecure Direct Object Reference IDOR in the Track order function in PHPGURUKUL Online Shopping Portal 2.1 allows information disclosure via the oid parameter...

CVE-2025-13579

CVE-2025-13579 affects code-projects Library System 1.0, specifically the file /return.php. Multiple connected records confirm a SQL Injection vulnerability originating from the ID parameter, enabling remote exploitation. The vulnerability is widely documented across CVE feeds (NVD/NVD mirror, RH...

Code-Projects Library System SQL注入漏洞

Library System is a library system. The Library System suffers from a SQL injection vulnerability that originates from a lack of validation of externally entered SQL statements in the parameter ID of the file /return.php. An attacker can exploit this vulnerability to execute illegal SQL commands ...

CVE-2025-13568

A flaw has been found in itsourcecode COVID Tracking System 1.0. This impacts an unknown function of the file /admin/?page=people. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used...

School Fees Payment Management System /manage_course.php File SQL Injection Vulnerability

School Fees Payment Management System is a tuition payment management system. The School Fees Payment Management System suffers from a SQL injection vulnerability that originates from a lack of validation of externally entered SQL statements in the parameter ID of the file /managecourse.php. An...

Nero Social Networking Site friendsphoto.php File SQL Injection Vulnerability

Nero Social Networking Site is a social networking site. Nero Social Networking Site suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the parameter ID of the file /friendsphoto.php. An attacker can exploit this vulnerability t...

CVE-2025-13286

A security flaw has been discovered in itsourcecode Online Voting System 1.0. The impacted element is an unknown function of the file /ajax.php?action=saveuser. Performing manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been...

D-Link DIR-816L Buffer Overflow Vulnerability

The DIR-816L is a wireless router device from D-Link. A stack-based buffer overflow vulnerability exists in the D-Link DIR-816L version 206b09beta, which stems from the genacgimain function in the gena.cgi file improperly handling the SERVERID/HTTPSID parameter. An attacker could use this...

CVE-2025-13277 code-projects Nero Social Networking Site friendsphoto.php sql injection

A flaw has been found in code-projects Nero Social Networking Site 1.0. This issue affects some unknown processing of the file /friendsphoto.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used...

EUVD-2025-197752

A flaw has been found in Campcodes Supplier Management System 1.0. This affects an unknown function of the file /manufacturer/editunit.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been published and may be used...

PT-2025-47067

Name of the Vulnerable Software and Affected Versions itsourcecode Inventory Management System version 1.0 Description A SQL injection issue exists in itsourcecode Inventory Management System 1.0. Manipulation of the ID argument in the /index.php?q=single-item endpoint can lead to SQL injection...

SourceCodester Patients Waiting Area Queue Management System SQL注入漏洞

SourceCodester Patients Waiting Area Queue Management System is a SourceCodester open source patient waiting area queue management system. A SQL injection vulnerability exists in SourceCodester Patients Waiting Area Queue Management System version 1.0, which stems from incorrect manipulation of t...

SourceCodester Alumni Management System SQL注入漏洞

SourceCodester Alumni Management System is SourceCodester open source a Php, Mysql-based alumni management system. A SQL injection vulnerability exists in SourceCodester Alumni Management System version 1.0, which stems from incorrect manipulation of the parameter ID in the file /managecareer.php...

The vulnerability of the export function of the SuiteCRM system’s client relationship management module allows a hacker to execute arbitrary code.

The vulnerability of the export function of the SuiteCRM system’s client relationship management module is related to the lack of measures taken to protect the SQL query structure when processing the uid parameter. Exploiting this vulnerability allows an attacker operating remotely to execute...

EUVD-2025-50812

TorrentPier is Vulnerable to Authenticated SQL Injection through Moderator Control Panel's topicid parameter...

CVE-2025-63147

Tenda AX3 V16.03.12.10CN was discovered to contain a stack overflow in the deviceId parameter of the saveParentControlInfo function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...

EUVD-2025-41748

A vulnerability has been found in SourceCodester Food Ordering System 1.0. Affected is an unknown function of the file /view-ticket.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may...

CVE-2025-63147

CVE-2025-63147 affects Tenda AX3 (V16.03.12.10_CN). Connected sources describe a stack overflow in the deviceId parameter of the saveParentControlInfo function, exploitable to cause Denial of Service via a crafted request. The vulnerability is confirmed across CNVD, Red Hat CVE, CIRCL, EUVD, NVD,...

EverShop 安全漏洞

EverShop is a NodeJS e-commerce platform open-sourced by EverShop. A security vulnerability exists in EverShop 2.0.1 and earlier versions, which stems from improper control of the resource identifier of the parameter uuid in the file /src/modules/oms/graphql/types/Order/Order.resolvers.js, which...

CVE-2025-63718

A SQL injection vulnerability exists in the SourceCodester PQMS Patient Queue Management System 1.0 in the apipatientschedule.php endpoint. The appointmentID parameter is not properly sanitized, allowing attackers to execute arbitrary SQL commands...