CVE-2023-31705

CVE-2023-31705 描述 Sourcecodester 任务提醒系统 1.0 中存在一个反射型跨站脚本（XSS）漏洞， 允许已认证用户向 page 参数注入恶意 JavaScript。 漏洞类型 跨站脚本攻击（XSS） 产品供应商 Sourcecodster 受影响产品代码库 Task Reminder System - 1.0 受影响组件 http://localhost/php-trs/admin/ page 参数 攻击类型 远程 攻击向量 要利用此漏洞，攻击者必须先通过应用程序的身份验证。之后可在浏览器中输入以下 URL...

CVE-2024-46878-TikiCMS-XSS

CVE-2024-46878 - Tiki CMS の反射型クロスサイトスクリプティング XSS の脆弱性 Tiki CMS - 'page' パラメータの反射型クロスサイトスクリプティング XSS の脆弱性 免責事項 教育、研究、および防御目的 のみに使用を意図しています。許可なくシステムに対して不正に使用することは違法です。 概要 Tiki バージョン 26.3 以前の tiki-editpage.php の page パラメータには、反射型クロスサイトスクリプティング XSS の脆弱性が存在します。この脆弱性により、攻撃者は巧妙に細工したペイロードを介して任意の JavaScrip...

CVE-2024-39210

CVE ID CVE-2024-39210 製品 Best house rental management system バージョン =1.0 問題種別 不適切なアクセス制御 説明 Best House Rental Management System v1.0 には、index.php の Page パラメータを介した任意のファイル読み取りの脆弱性が存在することが判明しました。この脆弱性により、攻撃者は任意の PHP ファイルを読み取り、アプリケーション内のその他の機密情報にアクセスできる可能性があります。...

CVE-2021-39408

CVE-2021-39408 Online Student Rate System 애플리케이션의 여러 버전 1.0에서 반사형 XSSCross Site Scripting 취약점이 존재하며, 이로 인해 임의의 JavaScript 명령이 실행될 수 있습니다. 취약한 페이지 index.php에서 page 매개변수가 취약하여, 공격자가 스크립트 태그 내에 임의의 자바스크립트를 포함할 수 있습니다: http://localhost/index.php?page=alert'test'; 발견자: Stefan Dorresteijn, 2021년 8월...

CVE-2023-49544

CVE-2023-49544 Customer Support System 1.0 - ローカルファイルインクルージョン 説明 : Customer Support System 1.0 はローカルファイルインクルージョンに対して脆弱です。認証されたユーザーは、ラッパーフィルタを利用したローカルファイルインクルージョン LFI 脆弱性を悪用することで、オペレーティングシステム上の PHP ファイルにアクセスし読み取ることが可能です。 脆弱な製品バージョン : Customer Support System 1.0 CVE 作者 : Geraldo Alcântara 日付.:...

CVE-2023-46974

CVE-2023-46974 POC 설명 Cross Site Scripting 취약점이 Best Courier Management System v.1.000에 존재하여, 원격 공격자가 조작된 페이로드를 URL의 page 매개변수에 전달함으로써 임의의 코드를 실행할 수 있습니다. 취약점 유형 Cross Site Scripting XSS 제품 공급업체 https://www.sourcecodester.com/php/16848/best-courier-management-system-project-php.html 영향받는 제품 코드 베이...

CVE-2026-13456

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes it possible for authenticated attackers, with...

CVE-2026-13456 WP Maps <= 4.9.8 - Authenticated (Subscriber+) Local File Inclusion via 'page' Parameter

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes it possible for authenticated attackers, with...

EUVD-2026-86595

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes it possible for authenticated attackers, with...

CVE-2026-13456

The WP Maps WordPress plugin (versions up to and including 4.9.8 ) is vulnerable to Local File Inclusion (LFI) via the 'page' parameter . Authenticated attackers with subscriber-level access or higher can include and execute arbitrary .php files on the server. This flaw may lead to bypassing acce...

CVE-2026-13456 WP Maps <= 4.9.8 - Authenticated (Subscriber+) Local File Inclusion via 'page' Parameter

The WP Maps – Google Maps,OpenStreetMap,Mapbox,Store Locator,Listing,Directory & Filters plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.8 via the 'page' parameter parameter. This makes it possible for authenticated attackers, with...

CVE-2026-90795

A vulnerability was determined in itsourcecode Loan Management System 1.0. The impacted element is an unknown function of the file navbar.php. Executing a manipulation of the argument page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicl...

EUVD-2026-77582

A vulnerability was determined in itsourcecode Loan Management System 1.0. The impacted element is an unknown function of the file navbar.php. Executing a manipulation of the argument page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicl...

WordPress ProSolution WP Client plugin < 2.0.11 - Reflected XSS via 'page' Parameter vulnerability

Reflected XSS via 'page' Parameter vulnerability discovered by Erwan LR WPScan in WordPress Plugin ProSolution WP Client versions 2.0.11...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: struts (UTSA-2026-031330)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-031330 advisory. The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page...

CVE-2026-19056

The ProSolution WP Client WordPress plugin (versions before 2.0.11 ) is vulnerable to reflected Cross-Site Scripting (XSS) . The flaw exists because the plugin fails to properly sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages. An atta...

CVE-2026-19056 ProSolution WP Client < 2.0.11 - Reflected XSS via 'page' Parameter

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted...

CVE-2026-19056 ProSolution WP Client < 2.0.11 - Reflected XSS via 'page' Parameter

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted...

PT-2026-73044

Name of the Vulnerable Software and Affected Versions SourceCodester Online Book Store System version 1.0 Description Cross site scripting occurs in the System Settings Module within the file '/admin/index.php?page=site settings'. This issue allows a remote attacker to execute malicious scripts...

EUVD-2026-54509

A flaw has been found in SourceCodester Photo Share Website 1.0. The affected element is an unknown function of the file /social/index.php?page=home. This manipulation of the argument Comment causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may...