Online Shopping Portal product-details.php file SQL Injection Vulnerability

Online Shopping Portal is an online store system. Online Shopping Portal suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements for the name, summary, review, quality, price, and value parameters in product-details.php. An attacker c...

PT-2025-47553

A vulnerability was determined in SourceCodester Online Shop Project 1.0. Impacted is an unknown function of the file /shop/register.php. This manipulation of the argument f name causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed a...

SourceCodester Online Shop Project 安全漏洞

SourceCodester Online Shop Project is a SourceCodester open source online store project. A security vulnerability exists in SourceCodester Online Shop Project version 1.0, which stems from an incorrect manipulation of the parameter fname in the file /shop/register.php, and could lead to a...

PT-2025-47640

Name of the Vulnerable Software and Affected Versions Campcodes Complete Online Beauty Parlor Management System version 1.0 Description A cross site scripting issue exists in Campcodes Complete Online Beauty Parlor Management System 1.0. The issue is located in the file /admin/customer-list.php...

CVE-2025-65013

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a reflected cross-site scripting XSS vulnerability was identified in the LibreNMS application at the /maps/nodeimage endpoint. The Image Name parameter is reflected in the HTTP response without...

CVE-2025-13412 Campcodes Retro Basketball Shoes Online Store admin_running.php cross site scripting

A vulnerability was determined in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this issue is some unknown functionality of the file /admin/adminrunning.php. Executing a manipulation of the argument productname can lead to cross site scripting. The attack may be performed from...

CVE-2025-13412

CVE-2025-13412 affects Campcodes Retro Basketball Shoes Online Store 1.0. The vulnerability resides in /admin/admin_running.php where manipulating the product_name parameter can trigger cross-site scripting. The issue is exploitable remotely, and public disclosures exist. Public sources consisten...

CVE-2025-13412 Campcodes Retro Basketball Shoes Online Store admin_running.php cross site scripting

A vulnerability was determined in Campcodes Retro Basketball Shoes Online Store 1.0. Affected by this issue is some unknown functionality of the file /admin/adminrunning.php. Executing a manipulation of the argument productname can lead to cross site scripting. The attack may be performed from...

CVE-2025-13396

The CVE-2025-13396 entry concerns Code-Projects Courier Management System 1.0. A vulnerability exists in the /add-office.php code, where manipulating the OfficeName parameter enables SQL injection. The attack can be initiated remotely, and the exploit has been publicly released. Documents consist...

CVE-2025-13396 code-projects Courier Management System add-office.php sql injection

A weakness has been identified in code-projects Courier Management System 1.0. This affects an unknown function of the file /add-office.php. This manipulation of the argument OfficeName causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public a...

EUVD-2025-198142

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2025-13206

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2025-13206

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2025-13206 GiveWP - Donation Plugin and Fundraising Platform <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via 'name'

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘name’ parameter in all versions up to, and including, 4.13.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2025-13206

CVE-2025-13206 affects the WordPress GiveWP – Donation Plugin and Fundraising Platform. The vulnerability is a stored cross-site scripting flaw in the name parameter present in all versions up to and including 4.13.0, caused by insufficient input sanitization and output escaping. It allows unauth...

CampCodes Retro Basketball Shoes Online Store 跨站脚本漏洞

CampCodes Retro Basketball Shoes Online Store is an online store for retro basketball shoes from CampCodes, Inc. A code injection vulnerability exists in CampCodes Retro Basketball Shoes Online Store version 1.0, which stems from an incorrect manipulation of the parameter productname in the file...

Cross-site Scripting (XSS)

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Image Name parameter in the /maps/nodeimage endpoint. An attacker can execute...

CVE-2025-65013

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a reflected cross-site scripting XSS vulnerability was identified in the LibreNMS application at the /maps/nodeimage endpoint. The Image Name parameter is reflected in the HTTP response without...

CVE-2025-65013

LibreNMS (PHP/MySQL/SNMP-based network monitoring) contains a reflected XSS flaw in GET /maps/nodeimage via the Image Name parameter. The vulnerability allows arbitrary JavaScript execution in a victim’s browser when a crafted URL is visited. Details from multiple sources (including NVD/Red Hat/C...

CVE-2025-65013 LibreNMS vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint `/maps/nodeimage` parameter `Image Name`

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.11.0, a reflected cross-site scripting XSS vulnerability was identified in the LibreNMS application at the /maps/nodeimage endpoint. The Image Name parameter is reflected in the HTTP response without...