CVE-2025-3563: Improper Control of Generation of Code

A vulnerability was found in WuzhiCMS 4.1. It has been rated as critical. Affected by this issue is the function Set of the file /index.php?m=attachment&f=index&su=wuzhicms&v=set&submit=1 of the component Setting Handler. The manipulation of the argument Setting leads to code injection. The attac...

CVE-2025-3152

A vulnerability classified as problematic has been found in caipeichao ThinkOX 1.0. This affects an unknown part of the file /ThinkOX-master/index.php?s=/Weibo/Index/search.html of the component Search. The manipulation of the argument keywords leads to cross site scripting. It is possible to...

CVE-2025-29033: Improper Privilege Management

An issue in BambooHR Build v.25.0210.170831-83b08dd allows a remote attacker to escalate privileges via the /saml/index.php?r=" HTTP GET parameter...

PT-2025-37378

Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.30 Description Chamilo is a learning management system. A blind Server-Side Request Forgery SSRF condition exists due to insufficient validation of incoming requests used in the operating system command. Successf...

CVE-2025-29033

An issue in BambooHR Build v.25.0210.170831-83b08dd allows a remote attacker to escalate privileges via the /saml/index.php?r=" HTTP GET parameter...

CVE-2025-2979: Improper Neutralization of Input During Web Page Generation

A vulnerability classified as problematic has been found in WCMS 11. This affects an unknown part of the file /index.php?anonymous/setregister of the component Registration. The manipulation of the argument Username leads to cross site scripting. It is possible to initiate the attack remotely. Th...

PT-2025-13471

Name of the Vulnerable Software and Affected Versions Clinic Queuing System version 1.0 Description The issue is related to a Reflected Cross-Site Scripting XSS vulnerability. This could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the pa...

CVE-2025-2868: Improper Neutralization of Input During Web Page Generation

Reflected Cross-Site Scripting XSS vulnerability in version 1.0 of the Clinic Queuing System. This vulnerability could allow an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the page parameter in /index.php...

Vehicle Record Management System index.php File SQL Injection Vulnerability

Vehicle Record Management System is a vehicle record management system. Vehicle Record Management System suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the searchinputdata parameter of index.php. An attacker can exploit this...

PT-2025-12680

Name of the Vulnerable Software and Affected Versions JoomlaUX JUX Real Estate version 3.4.0 Description A vulnerability was found in JoomlaUX JUX Real Estate, affecting some unknown functionality of the file /extensions/realestate/index.php/agents/agent-register/addagent. The manipulation of the...

CVE-2025-2687: Unrestricted Upload of File with Dangerous Type

A vulnerability classified as critical has been found in PHPGurukul eLearning System 1.0. Affected is an unknown function of the file /user/index.php of the component Image Handler. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been...

PT-2025-12562

Name of the Vulnerable Software and Affected Versions PHPGurukul eLearning System version 1.0 Description A critical vulnerability has been found in the PHPGurukul eLearning System, affecting an unknown function of the file /user/index.php of the component Image Handler. This manipulation leads t...

CVE-2025-2661: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in Project Worlds Online Time Table Generator 1.0 and classified as critical. This issue affects some unknown processing of the file /staff/index.php. The manipulation of the argument e leads to sql injection. The attack may be initiated remotely. The exploit has been...

CVE-2025-2660: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in Project Worlds Online Time Table Generator 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/index.php. The manipulation of the argument e leads to sql injection. The attack can be initiated remotely. The exploit has been...

CVE-2025-29641: Improper Neutralization of Special Elements used in an SQL Command

Phpgurukul Vehicle Record Management System v1.0 is vulnerable to SQL Injection in /index.php via the 'searchinputdata' parameter...

PT-2025-12457

Name of the Vulnerable Software and Affected Versions MagnusBilling versions through 7.3.0 Description The issue is related to improper neutralization of input during web page generation in MagnusSolution MagnusBilling login logging, allowing unauthenticated users to store HTML content. This can...

PT-2025-12415

Name of the Vulnerable Software and Affected Versions ITIUM 6050 version 5.5.5.2-b3526 Description This issue allows an attacker to execute malicious Javascript code via GET and POST requests to the "/index.php" endpoint and inject code into the id session. Recommendations For ITIUM 6050 version...

PT-2025-12426

Name of the Vulnerable Software and Affected Versions Phpgurukul Vehicle Record Management System version 1.0 Description The issue concerns SQL Injection in the /index.php endpoint via the searchinputdata parameter. This allows for potential manipulation of database queries. Recommendations For...

CVE-2025-2597: Improper Neutralization of Input During Web Page Generation

Reflected Cross-Site Scripting XSS in ITIUM 6050 version 5.5.5.2-b3526 from Impact Technologies. This vulnerability could allow an attacker to execute malicious Javascript code via GET and POST requests to the ‘/index.php’ endpoint and injecting code into the ‘idsession...

PT-2025-11570

Name of the Vulnerable Software and Affected Versions PHPGurukul Company Visitor Management System version 2.0 Description A critical vulnerability was found in the PHPGurukul Company Visitor Management System, affecting an unknown functionality of the file /index.php of the component Sign In. Th...