EUVD-2026-68276

A flaw has been found in SourceCodester Queue Management System 1.0. This affects an unknown part of the file /api/addcustomer.php. This manipulation of the argument Name causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used...

CVE-2026-82553

This vulnerability affects sambitraj Student Management System (up to commit 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5). The Student Dashboard component, specifically the mysqli_query function in student_dashboard.php, is vulnerable to improper authorization through manipulation of the roll_no arg...

EUVD-2026-68279

A vulnerability was detected in sambitraj Student Management System up to 56ba287f2e9031523ccb4244cb6e3fe530e4e5d5. Affected by this issue is the function mysqliquery of the file studentdashboard.php of the component Student Dashboard. The manipulation of the argument rollno results in improper...

CVE-2023-23752

CVE-2023-23752 Joomla 무단 액세스 취약점 CVE-2023-23752 취약점 설명 Joomla는 PHP로 작성된 오픈 소스 콘텐츠 관리 시스템CMS으로, MySQL, MSSQL, PostgreSQL 등 여러 데이터베이스 시스템을 지원합니다. 부적절한 액세스 제한으로 인해 서버 REST API 엔드포인트에 대한 무단 액세스가 발생합니다. 영향받는 버전: Joomla 4.0.0 - 4.2.7 사용 도움말 root@kitploit: optional arguments: -h, --help show this help...

CVE-2024-51430

CVE-2024-51430 Tipo de Vulnerabilidad Cross-Site Scripting XSS Descripción Existe una vulnerabilidad de Cross Site Scripting en el sistema de gestión de laboratorios de diagnóstico en línea que utiliza PHP v.1.0, la cual permite a un atacante remoto ejecutar código arbitrario a través del parámet...

CVE-2023-43838

CVE-2023-43838 Personal Management System v1.4.64의 임의 파일 업로드 취약점으로 인해 공격자가 조작된 SVG 파일을 사용자 프로필의 아바타에 업로드하여 임의 코드를 실행할 수 있습니다. 추가 정보 1. 다음 내용으로 alert.svg를 생성합니다: root@kitploit: alert"huntr.dev"; 2. .SVG 파일을 웹 서버에 호스팅합니다. 3. .SVG 파일을 아바타 이미지로 업로드합니다. 4. 사용자가 아바타를 별도의 탭에서 열면 .SVG 파일에 저장된 JavaScript가...

CVE-2020-25270

CVE-2020-25270 PHPGurukul hostel-management-system 2.1 は、Guardian Name、Guardian Relation、Guardian Contact no、Address、City において XSS を許容します。 ベンダー - PHPGurukul 製品 - https://phpgurukul.com/hostel-management-system V2.1 脆弱性タイプ - クロスサイトスクリプティング XSS 追加情報 - XSS は両側でトリガーされます。ユーザーは管理者の Cookie...

Zoo Management System 1.0 - SQL Injection

Zoo Management System 1.0 contains a SQL injection vulnerability via the username parameter on the login page. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id:...

Hospital Management System 4.0 - SQL Injection

Hospital Management System 4.0 contains multiple SQL injection vulnerabilities because multiple pages and parameters do not validate user input. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of...

Alumni Management System 1.0 - SQL Injection

SourceCodester Alumni Management System 1.0 contains a sqlinjection caused by unsanitized input in admin/login.php, letting attackers bypass authentication, exploit requires injection of malicious SQL payload. id: CVE-2020-29214 info: name: Alumni Management System 1.0 - SQL Injection author:...

Masteriyo LMS <= 1.7.3 - Insecure Direct Object Reference

Authentication Bypass Using an Alternate Path or Channel vulnerability in Masteriyo Masteriyo - LMS. Unauth access to course progress.This issue affects Masteriyo - LMS: from n/a through 1.7.3. id: CVE-2024-33939 info: name: Masteriyo LMS = 1.7.3 - Insecure Direct Object Reference author:...

School Dormitory Management System 1.0 - Authenticated Cross-Site Scripting

School Dormitory Management System 1.0 contains an authenticated cross-site scripting vulnerability via admin/inc/navigation.php:125. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-bas...

Masa CMS - Authentication Bypass

Masa CMS 7.2, 7.3, and 7.4-beta are susceptible to authentication bypass in the Remember Me function. An attacker can bypass authentication via a crafted web request and thereby obtain sensitive information, modify data, and/or execute unauthorized administrative operations in the context of the...

School Dormitory Management System 1.0 - Authenticated Cross-Site Scripting

School Dormitory Management System 1.0 contains an authenticated cross-site scripting vulnerability in admin/inc/navigation.php:126. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-base...

Academy Learning Management System <5.9.1 - Cross-Site Scripting

Academy Learning Management System before 5.9.1 contains a cross-site scripting vulnerability via the Search parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based...

Vehicle Service Management System - Stored Cross-Site Scripting

A Stored Cross Site Scripting XSS vulnerability exists in Vehicle Service Management System 1.0 via the My Account Section in login panel. id: CVE-2021-46068 info: name: Vehicle Service Management System - Stored Cross-Site Scripting author: TenBird severity: medium description: | A Stored Cross...

H3C ER8300G2-X - Password Disclosure

H3C ER8300G2-X is vulnerable to Incorrect Access Control. The password for the router's management system can be accessed via the management system page login interface. id: CVE-2024-32238 info: name: H3C ER8300G2-X - Password Disclosure author: s4e-io,adeljck severity: critical description: | H3...

Sourcecodester Car Rental Management System 1.0 - Stored Cross-Site Scripting

Sourcecodester Car Rental Management System 1.0 is vulnerable to cross-site scripting via the vehicalorcview parameter. id: CVE-2021-46005 info: name: Sourcecodester Car Rental Management System 1.0 - Stored Cross-Site Scripting author: cckuailong severity: medium description: Sourcecodester Car...

Vehicle Service Management System 1.0 - Stored Cross Site Scripting

Vehicle Service Management System 1.0 contains a stored cross-site scripting vulnerability via the Mechanic List section in login panel. id: CVE-2021-46069 info: name: Vehicle Service Management System 1.0 - Stored Cross Site Scripting author: TenBird severity: medium description: | Vehicle Servi...

ehicle Service Management System 1.0 - Cross-Site Scripting

Vehicle Service Management System 1.0 contains a stored cross-site scripting vulnerability via the Category List section in login panel. id: CVE-2021-46071 info: name: ehicle Service Management System 1.0 - Cross-Site Scripting author: TenBird severity: medium description: | Vehicle Service...