GetSimple CMS 3.3.13 - Open Redirect

GetSimple CMS 3.3.13 contains an open redirect vulnerability via the admin/index.php redirect parameter. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2019-9915 info: name: GetSimple CMS...

Mitel ShoreTel 19.46.1802.0 Devices - Cross-Site Scripting

Mitel ShoreTel 19.46.1802.0 devices and their conference component are vulnerable to an unauthenticated attacker conducting reflected cross-site scripting attacks via the PATHINFO variable to index.php due to insufficient validation for the timezone object in the HOMEMEETING& page. id:...

CVE-2022-27414

CVE-2022-27414 - SQL-Injection College Website CMS v1.0 - CVE-2022-27414 - SQL Injection CVE url https://vulners.com/cve/CVE-2022-27414 PoC below Vulnerable Code starts from line 9 in "cwms\departments\index.php" query"SELECT FROM departmentlist where deleteflag = 0 and status = 1 order by name...

CVE-2018-1263-Demo

Exploit Demo This guide will help you to install vulnerable component and perform the attack related to phpMyAdmin bug mentioned in CVE-2018-1263. Description of CVE Why does the vulnerability exist How does the attack work How to install vulnerable component How to perform the attack Description...

CVE-2021-42663

CVE-2021-42663 CVE-2021-42662 - HTML Injection vulnerability in the Online event booking and reservation system version 2.3.0. Technical description: A HTML injection vulnerability exists in the Online Event Booking and Reservation System version 2.3.0. An attacker can leverage this vulnerability...

CVE-2026-6183-SQLI

SQL Injection via id Parameter in index.php - Simple Content Management System in PHP Description A SQL Injection vulnerability exists in Simple Content Management System PHP. The id parameter in index.php is not sanitized before being passed to the SQL query, allowing an unauthenticated attacker...

CVE-2025-55885

CVE-2025-55885 Description SQL Injection vulnerability in Alpes Recherche et Developpement ARD GEC en Ligne before v.2025-04-23 allows a remote attacker to escalate privileges via the GET parameters in index.php Attack Vectors SQL injection via unsanitized GET parameter ocid on...

phpmyadmin-config-set-2fa

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · phpmyadmin-config-set-2fa phpmyadmin-config-set-2fa Class: Privilege leftover / missing step-up Reach: Remote phpMyAdmin 5.2.3 RELEASE523 / 962857e - phpMyAdmin POST index.php?route=/config/set writes any allowlisted...

CVE-2021-39408

CVE-2021-39408 A reflected Cross Site Scripting XSS vulnerability exists in multiple version 1.0 of the Online Student Rate System application that allows for arbitrary execution of JavaScript commands. Vulnerable Page On index.php, the page parameter is vulnerable, allowing an attacker to includ...

joomla-levels-api

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · joomla-levels-api joomla-levels-api Class: Privilege leftover Reach: Remote Joomla CMS 6.1.3 0f2d4de - Open Source Matters Administrator Users - Viewing Access Levels requires core.admin on comusers...

CVE-2024-35468

CVE-2024-35468 Submitter: Kha Do Human Resource Management System 1.0 Vulnerability SQL injection Description SQL injection vulnerability in /hrm/index.php in SourceCodester Human Resource Management System 1.0 allow attackers to execute arbitrary SQL commands via the password parameters. Affecte...

CVE-2023-46015-Code-Projects-Blood-Bank-1.0-Reflected-Cross-Site-Scripting-Vulnerability

CVE-2023-46015-Code-Projects-Blood-Bank-1.0-Reflected-Cross-Site-Scripting-Vulnerability Exploit Author: ersinerenler Vendor Homepage https://code-projects.org/blood-bank-in-php-with-source-code Software Link https://download-media.code-projects.org/2020/11/BloodBankInPHPWithSourcecode.zip Overvi...

CVE-2021-40353

CVE-2021-40353 CVE-2021-40353 openSIS 8.0 SQL Injection Vulnerability https://vulners.com/cve/CVE-2021-40353 A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the USERNAME...

CVE-2021-39433

CVE-2021-39433 A local file inclusion LFI vulnerability exists in version BIQS IT Biqs-drive v1.83 and below when sending a specific payload as the file parameter to download/index.php. This allows the attacker to read arbitrary files from the server with the permissions of the configured web-use...

CVE-2023-34632

CVE-2023-34632 Reflected XSS in 1000projects Book Management System 1.0 CVE-2023-34632 Reflected Cross-Site Scripting XSS in 1000projects Book Management System 1.0 Description A Reflected Cross-Site Scripting XSS vulnerability was discovered in 1000projects Book Management System version 1.0. Th...

CVE-2026-115981

The phpIPAM software (up to version 1.8.3 ) is vulnerable to a cross-site scripting (XSS) flaw in the upgrade/index.php file. The root cause is the improper handling of the REQUEST_URI argument, which allows for remote manipulation. This vulnerability has a LOW base severity (CVSS 3.1 score of 2....

CVE-2025-34030-PoC

CVE-2025-34030 - sar2html 'plot' parameter RCE CVSS: 10.0 Critical Vulnerability: OS Command Injection Programming Language: PHP Exploit Code: Python References: https://nvd.nist.gov/vuln/detail/CVE-2025-34030 https://www.vulncheck.com/advisories/sar2html-command-injection Description sar2html...

CVE-2025-63589

CVE-2025-63589 Reflected XSS in CMSimpleXH index.php path handling Discovered: October 6, 2025 Products: CMSimpleXH open-source flat-file CMS Affected versions: 1.8 CVEs: CVE-2025-63589 Authentication required: None unauthenticated Attack type: Reflected Cross-Site Scripting XSS Estimated CVSS...

CVE-2025-61456

🛡️ CVE Disclosure: CVE-2025-61456 — Reflected XSS in E-commerce Project Disclosure Date: 14 October 2025 CVE ID: CVE-2025-61456 Severity: MEDIUM CVSS 6.1 🧩 Summary A reflected Cross-Site Scripting XSS vulnerability exists in the E-commerce Project v1.0, specifically within the index.php endpoint...

CVE-2021-39377

OPENSIS 8.0 SQL INJECTION VULNERABILITY CVE-2021-39377 A SQL Injection vulnerability exists in version 8.0 of openSIS when MySQL MariaDB is being used as the application database. A malicious attacker can issue SQL commands to the Mysql MariaDB database through the vulnerable username= parameter...