2947 matches found
CVE-2025-60500: Unrestricted Upload of File with Dangerous Type
QDocs Smart School Management System 7.1 allows authenticated users with roles such as "accountant" or "admin" to bypass file type restrictions in the media upload feature by abusing the alternate YouTube URL option. This logic flaw permits uploading of arbitrary PHP files, which are stored in a...
CVE-2025-11746 XStore | Multipurpose WooCommerce Theme <= 9.5.4 - Authenticated (Subscriber+) Local File Inclusion
The XStore theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 9.5.4 via theetajaxrequiredpluginspopup function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on t...
CVE-2011-10033 WordPress Plugin is-human <= v1.4.2 Eval Injection RCE
The WordPress plugin is-human = v1.4.2 contains an eval injection vulnerability in /is-human/engine.php that can be triggered via the 'type' parameter when the 'action' parameter is set to 'log-reset'. The root cause is unsafe use of eval on user-controlled input, which can lead to execution of...
PT-2025-41462
Name of the Vulnerable Software and Affected Versions Simple Leave Manager version 1.0 Description A SQL injection issue exists in the Simple Leave Manager 1.0 application. The flaw is located in the /user.php file and stems from improper handling of user-supplied input within the argument table,...
CVE-2025-11477 SourceCodester Wedding Reservation Management System global.php sql injection
A security flaw has been discovered in SourceCodester Wedding Reservation Management System 1.0. This vulnerability affects unknown code of the file /global.php. The manipulation of the argument User results in sql injection. The attack may be launched remotely. The exploit has been released to t...
EUVD-2025-33160
A security flaw has been discovered in SourceCodester Wedding Reservation Management System 1.0. This vulnerability affects unknown code of the file /global.php. The manipulation of the argument User results in sql injection. The attack may be launched remotely. The exploit has been released to t...
CVE-2025-11431
A vulnerability was determined in code-projects Web-Based Inventory and POS System 1.0. The impacted element is an unknown function of the file /transaction.php. This manipulation of the argument shopid causes sql injection. The attack is possible to be carried out remotely. The exploit has been...
EUVD-2006-2697
Malware in sbrugna...
EUVD-2006-7014
Malware in sbrugna...
EUVD-2019-6691
Malware in sbrugna...
EUVD-2011-3660
Malware in sbrugna...
EUVD-2019-6777
Malware in sbrugna...
EUVD-2017-5635
Malware in sbrugna...
EUVD-2005-3557
Malware in sbrugna...
EUVD-2005-3334
Malware in sbrugna...
EUVD-2005-3365
Malware in sbrugna...
EUVD-2015-9178
Malware in sbrugna...
EUVD-2021-2107
Malware in sbrugna...