CVE-2023-49548

CVE-2023-49548 Customer Support System 1.0 - SQL Injection Vulnerability in the "lastname" Parameter During "saveuser" Operation Description : A SQL Injection vulnerability exists in version 1 of the Customer Support System. A malicious attacker can issue SQL commands to the MySQL database when...

Projectworlds Advanced Library Management System input validation error vulnerability

Version 1.0 of the Projectworlds Advanced Library Management System contains a security vulnerability. This vulnerability stems from improper handling of the firstname/middlename/lastname/address/branch/type parameters in the file editmember.php, potentially leading to SQL injection...

CVE-2026-55872

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who...

CVE-2026-55872 GYM One admin user list is vulnerable to stored cross-site scripting

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who...

CVE-2026-55872

The open-source gym management software GYM One is vulnerable to stored cross-site scripting (XSS) in versions prior to 1.4.1 . The root cause is the lack of HTML output encoding when the admin/users/index.php page renders the firstname , lastname , and email profile fields into the administrator...

CVE-2026-55872 GYM One admin user list is vulnerable to stored cross-site scripting

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who...

CVE-2026-55872

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who...

CVE-2026-55872 GYM One admin user list is vulnerable to stored cross-site scripting

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who...

CVE-2026-55872: Improper Neutralization of Input During Web Page Generation

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who...

Mayer Balint GYM One Cross-site Scripting Vulnerability

Mayer Balint GYM versions prior to 1.4.1 have a cross-site scripting vulnerability. This vulnerability arises from the fact that the admin/users/index.php file does not encode the stored firstname, lastname, and email fields using HTML. This may lead to a stored-cross-site scripting attack...

Advanced-Library-Management-System-Project-in-PHP-with-Barcode-edit_member.php

Advanced-Library-Management-System-Project-in-PHP-with-Barcode...

CVE-2026-105809

A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the file /register.php of the component Profile Field Handler. The manipulation of the argument firstname/lastname leads to cross site scripting. The attack may be...

CVE-2026-105809 SourceCodester Simple Student Information System Profile Field register.php cross site scripting

A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the file /register.php of the component Profile Field Handler. The manipulation of the argument firstname/lastname leads to cross site scripting. The attack may be...

EUVD-2026-93226

A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the file /register.php of the component Profile Field Handler. The manipulation of the argument firstname/lastname leads to cross site scripting. The attack may be...

CVE-2026-105809 SourceCodester Simple Student Information System Profile Field register.php cross site scripting

A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the file /register.php of the component Profile Field Handler. The manipulation of the argument firstname/lastname leads to cross site scripting. The attack may be...

CVE-2026-105809

A cross-site scripting (XSS) vulnerability exists in SourceCodester Simple Student Information System 1.0 . The flaw is located in the Profile Field Handler component, specifically within the register.php file. Attackers can initiate a remote attack by manipulating the firstname or lastname argum...

CVE-2026-105809: Improper Neutralization of Input During Web Page Generation

A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the file /register.php of the component Profile Field Handler. The manipulation of the argument firstname/lastname leads to cross site scripting. The attack may be...

Spotweb <= 1.5.1 - Cross Site Scripting Detection

Cross-site scripting XSS vulnerability in templates/installer/step-004.inc.php in spotweb 1.5.1 and below allow remote attackers to inject arbitrary web script or HTML via the lastname parameter. !/usr/bin/env python3 -- coding: utf-8 -- """Cross-site scripting XSS vulnerability in...

CVE-2025-69241

Raytha CMS is vulnerable to Stored XSS via FirstName and LastName parameters in profile editing functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. This issue was fixed in version 1.4.6...

EUVD-2025-208709

Raytha CMS is vulnerable to Stored XSS via FirstName and LastName parameters in profile editing functionality. Authenticated attacker can inject arbitrary HTML and JS into website, which will be rendered/executed when visiting edited page. This issue was fixed in version 1.4.6...