FreePBX Servers Targeted by Zero-Day Flaw, Emergency Patch Now Available

The Sangoma FreePBX Security Team has issued an advisory warning about an actively exploited FreePBX zero-day vulnerability that impacts systems with an administrator control panel ACP exposed to the public internet. FreePBX is an open-source private branch exchange PBX platform widely used by...

FreePBX Servers Targeted by Zero-Day Flaw, Emergency Patch Now Available

The Sangoma FreePBX Security Team has issued an advisory warning about an actively exploited FreePBX zero-day vulnerability that impacts systems with an administrator control panel ACP exposed to the public internet. FreePBX is an open-source private branch exchange PBX platform widely used by...

CVE-2025-9666: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in code-projects Simple Grading System 1.0. Affected by this issue is some unknown functionality of the file /deletestudent.php of the component Admin Panel. Such manipulation of the argument ID leads to sql injection. The attack can be launched remotely...

PT-2025-35252

Name of the Vulnerable Software and Affected Versions: Simple Grading System version 1.0 Description: A SQL injection issue exists in the Admin Panel component of the software, specifically within the /login.php file and an unknown function. This allows for remote execution of malicious code. The...

PT-2025-35296

Name of the Vulnerable Software and Affected Versions: code-projects Simple Grading System version 1.0 Description: A security flaw exists in code-projects Simple Grading System 1.0. The issue is a SQL injection affecting an unknown function within the /add student grade.php file of the Admin Pan...

CVE-2025-9665: Improper Neutralization of Special Elements used in an SQL Command

A weakness has been identified in code-projects Simple Grading System 1.0. Affected by this vulnerability is an unknown functionality of the file /editstudent.php of the component Admin Panel. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The...

PT-2025-35299

Name of the Vulnerable Software and Affected Versions code-projects Simple Grading System version 1.0 Description A weakness exists in the Admin Panel component of code-projects Simple Grading System. The manipulation of the ID argument in the /edit student.php file causes SQL injection. This iss...

CVE-2025-9663: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in code-projects Simple Grading System 1.0. This impacts an unknown function of the file /editaccount.php of the component Admin Panel. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicl...

PT-2025-35295

Name of the Vulnerable Software and Affected Versions: Simple Grading System version 1.0 Description: A SQL injection issue exists in the Admin Panel component of the software. The vulnerability is located in the /edit account.php file and affects an unknown function. Manipulation of the ID...

PT-2025-35302

Name of the Vulnerable Software and Affected Versions: Simple Grading System version 1.0 Description: A SQL injection issue exists in the Admin Panel component of the software, specifically within the /delete account.php file. Manipulation of the ID argument can trigger the issue, allowing for...

CVE-2025-9667: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was detected in code-projects Simple Grading System 1.0. This affects an unknown part of the file /deleteaccount.php of the component Admin Panel. Performing manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit is now public a...

CVE-2025-9662: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in code-projects Simple Grading System 1.0. This affects an unknown function of the file /login.php of the component Admin Panel. Executing manipulation can lead to sql injection. The attack may be performed from a remote location. The exploit has been publicly...

CVE-2025-9664: Improper Neutralization of Special Elements used in an SQL Command

A security flaw has been discovered in code-projects Simple Grading System 1.0. Affected is an unknown function of the file /addstudentgrade.php of the component Admin Panel. The manipulation of the argument Add results in sql injection. It is possible to launch the attack remotely. The exploit h...

CVE-2025-55175

QuickCMS is vulnerable to Reflected XSS via sLangEdit parameter in admin's panel functionality. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. The vendor was notified early about this vulnerability, but...

CVE-2025-54540

QuickCMS is vulnerable to Reflected XSS via sSort parameter in admin's panel functionality. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. The vendor was notified early about this vulnerability, but didn...

CVE-2025-54540

QuickCMS is vulnerable to Reflected XSS via sSort parameter in admin's panel functionality. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. The vendor was notified early about this vulnerability, but didn...

CVE-2025-55175

CVE-2025-55175 : QuickCMS is vulnerable to a Reflected XSS via the sLangEdit parameter in the admin panel. A malicious URL can trigger arbitrary JavaScript execution in the victim’s browser. Only version 6.8 was tested and confirmed vulnerable; other versions were not tested and might also be vul...

CVE-2025-55175 Reflected XSS in QuickCMS

QuickCMS is vulnerable to Reflected XSS via sLangEdit parameter in admin's panel functionality. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. The vendor was notified early about this vulnerability, but...

CVE-2025-55175 Reflected XSS in QuickCMS

QuickCMS is vulnerable to Reflected XSS via sLangEdit parameter in admin's panel functionality. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. The vendor was notified early about this vulnerability, but...

CVE-2025-54540 Reflected XSS in QuickCMS

QuickCMS is vulnerable to Reflected XSS via sSort parameter in admin's panel functionality. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. The vendor was notified early about this vulnerability, but didn...