CVE-2025-55420: Improper Neutralization of Input During Web Page Generation

A Reflected Cross Site Scripting XSS vulnerability was found in /index.php in FoxCMS v1.2.6. When a crafted script is sent via a GET request, it is reflected unsanitized into the HTML response. This permits execution of arbitrary JavaScript code when a logged-in user submits the malicious input...

CVE-2025-9147: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in jasonclark getsemantic up to 040c96eb8cf9947488bd01b8de99b607b0519f7d. The impacted element is an unknown function of the file /index.php. The manipulation of the argument view leads to cross site scripting. Remote exploitation of the attack is possible. The...

CVE-2025-52335

EyouCMS 1.7.3 is vulnerale to Cross Site Scripting XSS in index.php, which can be exploited to obtain sensitive information...

CVE-2025-52335

EyouCMS version 1.7.3 is susceptible to a Cross-Site Scripting (XSS) vulnerability in the index.php file. This flaw stems from the improper neutralization of input , which can be exploited by attackers to obtain sensitive information . At this time, there is no information available regarding a n...

PT-2025-33145 · Unknown · Lepszy Bip

Name of the Vulnerable Software and Affected Versions: Lepszy BIP affected versions not specified Description: Lepszy BIP is susceptible to a Reflected Cross-Site Scripting XSS issue. Insufficient input validation within the index.php form allows for the execution of arbitrary JavaScript code in ...

CVE-2025-52335: Improper Neutralization of Input During Web Page Generation

EyouCMS 1.7.3 is vulnerale to Cross Site Scripting XSS in index.php, which can be exploited to obtain sensitive information...

CVE-2025-8976: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in givanz Vvveb up to 1.0.5. This vulnerability affects unknown code of the file /vadmin123/index.php?module=content/post&type=post of the component Endpoint. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been...

CVE-2025-7761: Improper Neutralization of Input During Web Page Generation

Lepszy BIP is vulnerable to Reflected Cross-Site Scripting XSS. Improper input validation in index.php form in one of the parameters allows arbitrary JavaScript to be executed on victim's browser when specially crafted URL is opened. The vendor was contacted early about this disclosure but did no...

CVE-2025-8950: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in Campcodes Online Recruitment Management System 1.0. This issue affects some unknown processing of the file /Recruitment/index.php?page=viewvacancy. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has...

PT-2025-33078 · S40 Cms · S40 Cms

Name of the Vulnerable Software and Affected Versions: S40 CMS version 0.4.2 Description: S40 CMS version 0.4.2 contains a path traversal vulnerability in its index.php page handler. The p parameter is not properly sanitized, allowing attackers to traverse the file system and access arbitrary fil...

CVE-2011-10009: Improper Limitation of a Pathname to a Restricted Directory

S40 CMS v0.4.2 contains a path traversal vulnerability in its index.php page handler. The p parameter is not properly sanitized, allowing attackers to traverse the file system and access arbitrary files outside the web root. This can be exploited remotely without authentication by appending...

CVE-2025-8772: Server-Side Request Forgery (SSRF)

A vulnerability, which was classified as problematic, has been found in Vinades NukeViet up to 4.5.06. This issue affects some unknown processing of the file /admin/index.php?language=en&nv=upload of the component Module Handler. The manipulation leads to server-side request forgery. The attack m...

CVE-2023-41524

Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the username parameter at index.php...

PT-2025-32292 · Unknown · Attendance Management System

Name of the Vulnerable Software and Affected Versions: Student Attendance Management System version 1 Description: The Student Attendance Management System is susceptible to a SQL injection issue through the username parameter located at the /index.php API endpoint. Recommendations: As a temporar...

CVE-2023-41524: Improper Neutralization of Special Elements used in an SQL Command

Student Attendance Management System v1 was discovered to contain a SQL injection vulnerability via the username parameter at index.php...

CVE-2025-50707

An issue in thinkphp3 v.3.2.5 allows a remote attacker to execute arbitrary code via the index.php component...

CVE-2025-50707: Improper Control of Generation of Code

An issue in thinkphp3 v.3.2.5 allows a remote attacker to execute arbitrary code via the index.php component...

ThinkPHP 安全漏洞

ThinkPHP is a PHP-based, open source, lightweight web application development framework from China's Top Thinking Information Technology ThinkPHP. A security vulnerability exists in ThinkPHP version v.3.2.5, which originates from the index.php component that allows execution of arbitrary code...

CVE-2025-50707

An issue in thinkphp3 v.3.2.5 allows a remote attacker to execute arbitrary code via the index.php component. This vulnerability can be triggered through crafted template inclusion and requires no authentication. Practical consequences include full system compromise. To mitigate this risk, it is ...

CVE-2025-8521

A vulnerability, which was classified as problematic, has been found in givanz Vvveb up to 1.0.5. This issue affects some unknown processing of the file /vadmin123/index.php?module=settings/post-types of the component Add Type Handler. The manipulation leads to cross site scripting. The attack ma...