3286 matches found
CVE-2025-40638 Reflected Cross-Site Scripting (XSS) in Eventobot
A reflected Cross-Site Scripting XSS vulnerability has been found in Eventobot. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending him/her a malicious URL using the 'name' parameter in '/search-results'. This vulnerability can be exploited to steal...
EUVD-2026-10280
A flaw has been found in SourceCodester Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file checksupplierdetails.php of the component POST Parameter Handler. Executing a manipulation of the argument stockname1 can lead to sql injection. The attac...
CVE-2026-3790
A flaw has been found in SourceCodester Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file checksupplierdetails.php of the component POST Parameter Handler. Executing a manipulation of the argument stockname1 can lead to sql injection. The attac...
CVE-2026-3790
A flaw has been found in SourceCodester Sales and Inventory System 1.0. Affected by this vulnerability is an unknown functionality of the file checksupplierdetails.php of the component POST Parameter Handler. Executing a manipulation of the argument stockname1 can lead to sql injection. The attac...
PT-2026-24050
A reflected Cross-Site Scripting XSS vulnerability has been found in Eventobot. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending him/her a malicious URL using the 'name' parameter in '/search-results'. This vulnerability can be exploited to steal...
Eventobot 跨站脚本漏洞
Eventobot is a ticketing management system developed by Eventobot Inc. Eventobot has a cross-site scripting vulnerability, which stems from insufficient cleaning and escaping of the name parameter. This vulnerability may lead to reflective cross-site scripting attacks...
CVE-2026-3756
A vulnerability was identified in SourceCodester Sales and Inventory System up to 1.0. Affected is an unknown function of the file /checkitemdetails.php. The manipulation of the argument stockname1 leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and...
CVE-2026-3755 SourceCodester Sales and Inventory System POST check_customer_details.php sql injection
A vulnerability was determined in SourceCodester Sales and Inventory System 1.0. This impacts an unknown function of the file /checkcustomerdetails.php of the component POST Handler. Executing a manipulation of the argument stockname1 can lead to sql injection. The attack can be launched remotely...
Tenda F453 安全漏洞
The Tenda F453 is a wireless router produced by the Chinese company Tenda. There is a security vulnerability in the Tenda F453 1.0.0.3/1.If version. This vulnerability stems from incorrect operations with parameters funcname/funcpara1 in the file/goform/setcfm, which may lead to a stack buffer...
Yifang CMS 代码注入漏洞
Yifang CMS is a PHP enterprise website development and management system provided by Yifang Corporation. Version 2.0.5 of Yifang CMS has a code injection vulnerability. This vulnerability stems from the handling of the parameter “Name” in the file “singlePageGroup.php”, which may lead to cross-si...
Warranty Tracking System SQL注入漏洞
The Warranty Tracking System is a warranty record management system developed by Warranty Tracking Company. Version 11.06.3 of the Warranty Tracking System contains an SQL injection vulnerability. This vulnerability stems from the txtCustomerCode, txtCustomerName, and txtPhone parameters, which m...
PT-2026-23649
Name of the Vulnerable Software and Affected Versions Talishar versions prior to commit 6be3871 Description A Path Traversal issue exists in Talishar, a fan-made Flesh and Blood project. The gameName parameter is susceptible to directory traversal sequences e.g., ../ due to a lack of internal...
CVE-2026-28457 OpenClaw < 2026.2.14 - Path Traversal in Sandbox Skill Mirroring via Name Parameter
OpenClaw versions prior to 2026.2.14 contain a path traversal vulnerability in sandbox skill mirroring must be enabled that uses the skill frontmatter name parameter unsanitized when copying skills into the sandbox workspace. Attackers who provide a crafted skill package with traversal sequences...
CVE-2026-28457
OpenClaw is affected by a path traversal vulnerability in sandbox skill mirroring that uses the frontmatter name when copying skills into the sandbox workspace. Affected versions: OpenClaw before 2026.2.14. Attackers can craft a skill package with traversal sequences (e.g., ../ or absolute paths)...
CVE-2026-1945
The WPBookit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpbusername' and 'wpbuseremail' parameters in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
CVE-2024-55022
Weintek cMT-3072XH2 easyweb v2.1.53, OS v20231011 was discovered to contain an authenticated command injection vulnerability via the HMI Name parameter...
CVE-2026-1945 WPBookit <= 1.0.8 - Unauthenticated Stored Cross-Site Scripting via 'wpb_user_name' and 'wpb_user_email' Parameters
The WPBookit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpbusername' and 'wpbuseremail' parameters in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
CVE-2026-1945
The CVE-2026-1945 entry concerns the WPBookit WordPress plugin. A Stored Cross-Site Scripting (XSS) vulnerability affects the plugin via the wpb_user_name and wpb_user_email parameters in all versions up to and including 1.0.8, caused by insufficient input sanitization and output escaping. Exploi...
PT-2026-22858
The WPBookit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpb user name' and 'wpb user email' parameters in all versions up to, and including, 1.0.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...