3289 matches found
CVE-2025-34178
In pfSense CE /suricata/suricataappparsers.php, the value of the policyname parameter is not sanitized of HTML-related strings/characters before being directly displayed. This can result in stored cross-site scripting. The attacker must be authenticated with at least "WebCfg - Services: suricata...
CVE-2025-10114
A vulnerability was found in PHPGurukul Small CRM 4.0. Affected by this issue is some unknown functionality of the file /profile.php. The manipulation of the argument Name results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used...
CVE-2025-10114 PHPGurukul Small CRM profile.php sql injection
A vulnerability was found in PHPGurukul Small CRM 4.0. Affected by this issue is some unknown functionality of the file /profile.php. The manipulation of the argument Name results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used...
SiempreCMS SQL注入漏洞
SiempreCMS is a content management system of SiempreCMS open source. SiempreCMS 1.3.6 and earlier versions have a SQL injection vulnerability that stems from incorrect manipulation of the parameter name/userName in the file usersearchajax.php resulting in SQL injection...
Netgate pfSense CE 安全漏洞
Netgate pfSense CE is a FreeBSD-based open source firewall and routing platform from Netgate, Inc. that supports enterprise-class network security and network management features. A security vulnerability exists in Netgate pfSense CE that stems from the policyname parameter not being cleaned of...
PHPGurukul Small CRM SQL注入漏洞
Small CRM is a customer relationship management system. Small CRM suffers from an SQL injection vulnerability that stems from the /profile.php file not having a secure filter for the Name parameter. No details of the vulnerability are available at this time...
rAthena SQL注入漏洞
rAthena is rAthena open source a cross-platform MMORPG server. An SQL injection vulnerability exists in versions prior to rAthena 0d89ae0, which stems from an SQL injection in the WorldName parameter...
CVE-2025-40641
CVE-2025-40641 corresponds to a stored Cross-Site Scripting (XSS) vulnerability in the Multi-Purpose Inventory Management System (Codester). The flaw arises from insufficient validation of user input in a POST request to /Controller_Products/update, specifically via the product_name parameter, en...
CVE-2025-40641 Stored Cross-Site Scripting (XSS) in the Multi-purpose Inventory Management System
Cross-site Scripting XSS vulnerability stored in Multi-Purpose Inventory Management System, consisting of a stored XSS due to lack of proper validation of user input by sending a POST request using the productname parameter in /ControllerProducts/update. This vulnerability could allow a remote us...
CVE-2025-10088 SourceCodester Time Tracker index.html cross site scripting
A vulnerability was detected in SourceCodester Time Tracker 1.0. The affected element is an unknown function of the file /index.html. Performing manipulation of the argument project-name results in cross site scripting. The attack may be initiated remotely. The exploit is now public and may be us...
CVE-2025-10088 SourceCodester Time Tracker index.html cross site scripting
A vulnerability was detected in SourceCodester Time Tracker 1.0. The affected element is an unknown function of the file /index.html. Performing manipulation of the argument project-name results in cross site scripting. The attack may be initiated remotely. The exploit is now public and may be us...
PT-2025-36457
Name of the Vulnerable Software and Affected Versions: Multi-Purpose Inventory Management System affected versions not specified Description: A stored Cross-Site Scripting XSS issue exists due to insufficient validation of user-supplied data. A remote user can exploit this by sending a POST reque...
PT-2025-36446
Name of the Vulnerable Software and Affected Versions: SourceCodester Time Tracker version 1.0 Description: A cross-site scripting XSS vulnerability exists due to manipulation of the project-name argument. The vulnerability affects an unknown function within the /index.html file. The exploit is...
CVE-2025-41044
A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataPagename' parameter in /apprain/page/manage-static-pages/create...
CVE-2025-57150
phpgurukul Complaint Management System in PHP 2.0 is vulnerable to Cross Site Scripting XSS in admin/subcategory.php via the categoryName parameter...
Complaint Management System in PHP subcategory.php file cross-site scripting vulnerability
Complaint Management System in PHP is a complaint management system. A cross-site scripting vulnerability exists in Complaint Management System in PHP, which stems from the lack of effective filtering and escaping of user-supplied data in the categoryName parameter of admin/subcategory.php, for...
CVE-2025-41038
A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataGroupname' parameter in /apprain/admin/managegroup/add/...
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection via the dataPagename parameter in the /apprain/page/manage-static-pages/create/ path. An attacker can retrieve, create, update, or delete database records by injecting crafted input. Remediation There is no fixed version f...
CVE-2025-41033
An SQL injection vulnerability has been found in appRain CMF 4.0.5. This vulnerability allows an attacker to retrieve, create, update, and delete the database, through the 'data%5BPage%5D%5Bname%5D' parameter in /apprain/page/manage-dynamic-pages/create...
CVE-2025-41038 Stored Cross-Site Scripting vulnerability in appRain CMF
A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataGroupname' parameter in /apprain/admin/managegroup/add/...