CVE-2025-10114 PHPGurukul Small CRM profile.php sql injection

A vulnerability was found in PHPGurukul Small CRM 4.0. Affected by this issue is some unknown functionality of the file /profile.php. The manipulation of the argument Name results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used...

Netgate pfSense CE 安全漏洞

Netgate pfSense CE is a FreeBSD-based open source firewall and routing platform from Netgate, Inc. that supports enterprise-class network security and network management features. A security vulnerability exists in Netgate pfSense CE that stems from the policyname parameter not being cleaned of...

SiempreCMS SQL注入漏洞

SiempreCMS is a content management system of SiempreCMS open source. SiempreCMS 1.3.6 and earlier versions have a SQL injection vulnerability that stems from incorrect manipulation of the parameter name/userName in the file usersearchajax.php resulting in SQL injection...

rAthena SQL注入漏洞

rAthena is rAthena open source a cross-platform MMORPG server. An SQL injection vulnerability exists in versions prior to rAthena 0d89ae0, which stems from an SQL injection in the WorldName parameter...

The vulnerability of the multi-platform web solution for creating Scada systems, Scada-LTS, is related to the lack of protective measures for the web page structure. This allows attackers to perform cross-site scripting attacks.

The vulnerability of the multi-platform web solution for creating Scada systems is related to the lack of protection for the structure of the web page when processing the parameter “name” of the final point “publisheredit.shtm”. Exploiting this vulnerability allows a remote attacker to perform...

The vulnerability of the formSetSambaConf() function (/goform/SetSambaConf) in the Tenda CH22 router microprogramming software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the formSetSambaConf function /goform/SetSambaConf of the Tenda CH22 router microprogramming system is related to the copying of buffers without checking the size of the input data when processing the sambauserNameSda parameter. Exploiting this vulnerability can allow an...

PHPGurukul Small CRM SQL注入漏洞

Small CRM is a customer relationship management system. Small CRM suffers from an SQL injection vulnerability that stems from the /profile.php file not having a secure filter for the Name parameter. No details of the vulnerability are available at this time...

CVE-2025-40641 Stored Cross-Site Scripting (XSS) in the Multi-purpose Inventory Management System

Cross-site Scripting XSS vulnerability stored in Multi-Purpose Inventory Management System, consisting of a stored XSS due to lack of proper validation of user input by sending a POST request using the productname parameter in /ControllerProducts/update. This vulnerability could allow a remote us...

CVE-2025-40641

CVE-2025-40641 corresponds to a stored Cross-Site Scripting (XSS) vulnerability in the Multi-Purpose Inventory Management System (Codester). The flaw arises from insufficient validation of user input in a POST request to /Controller_Products/update, specifically via the product_name parameter, en...

CVE-2025-10088 SourceCodester Time Tracker index.html cross site scripting

A vulnerability was detected in SourceCodester Time Tracker 1.0. The affected element is an unknown function of the file /index.html. Performing manipulation of the argument project-name results in cross site scripting. The attack may be initiated remotely. The exploit is now public and may be us...

CVE-2025-10088 SourceCodester Time Tracker index.html cross site scripting

A vulnerability was detected in SourceCodester Time Tracker 1.0. The affected element is an unknown function of the file /index.html. Performing manipulation of the argument project-name results in cross site scripting. The attack may be initiated remotely. The exploit is now public and may be us...

PT-2025-36457

Name of the Vulnerable Software and Affected Versions: Multi-Purpose Inventory Management System affected versions not specified Description: A stored Cross-Site Scripting XSS issue exists due to insufficient validation of user-supplied data. A remote user can exploit this by sending a POST reque...

PT-2025-36446

Name of the Vulnerable Software and Affected Versions: SourceCodester Time Tracker version 1.0 Description: A cross-site scripting XSS vulnerability exists due to manipulation of the project-name argument. The vulnerability affects an unknown function within the /index.html file. The exploit is...

CVE-2025-41044

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataPagename' parameter in /apprain/page/manage-static-pages/create...

CVE-2025-57150

phpgurukul Complaint Management System in PHP 2.0 is vulnerable to Cross Site Scripting XSS in admin/subcategory.php via the categoryName parameter...

Complaint Management System in PHP subcategory.php file cross-site scripting vulnerability

Complaint Management System in PHP is a complaint management system. A cross-site scripting vulnerability exists in Complaint Management System in PHP, which stems from the lack of effective filtering and escaping of user-supplied data in the categoryName parameter of admin/subcategory.php, for...

CVE-2025-41038

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataGroupname' parameter in /apprain/admin/managegroup/add/...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the dataPagename parameter in the /apprain/page/manage-static-pages/create/ path. An attacker can retrieve, create, update, or delete database records by injecting crafted input. Remediation There is no fixed version f...

CVE-2025-41033

An SQL injection vulnerability has been found in appRain CMF 4.0.5. This vulnerability allows an attacker to retrieve, create, update, and delete the database, through the 'data%5BPage%5D%5Bname%5D' parameter in /apprain/page/manage-dynamic-pages/create...

CVE-2025-41038 Stored Cross-Site Scripting vulnerability in appRain CMF

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataGroupname' parameter in /apprain/admin/managegroup/add/...