CVE-2024-11267

CVE-2024-11267 concerns the JSP Store Locator WordPress plugin (versions up to 1.0) where an input parameter is not sanitized/escaped before being used in a SQL statement, enabling a user with Contributor privileges to perform SQL injection. The vulnerability is documented across multiple sources...

WordPress plugin Payment Gateway for Telcell 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

WordPress plugin Twitter Bootstrap Collapse aka Accordian Shortcode 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress plugin Twitter Bootstrap Collapse ak...

Jenkins plugin Cadence vManager 安全漏洞

Jenkins and Jenkins plugin are both Jenkins open source products.Jenkins is an application software. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins plugin is an application software plugin. A security...

CVE-2025-47815

libpspp-core.a in GNU PSPP through 2.0.1 allows attackers to cause a heap-based buffer overflow in inflateread called indirectly from zipmemberreadall in zip-reader.c...

VulnCheck KEV: CVE-2024-11238

A vulnerability, which was classified as critical, was found in Landray EKP up to 16.0. This affects the function delPreviewFile of the file /sys/ui/sysuicomponent/sysUiComponent.do?method=delPreviewFile. The manipulation of the argument directoryPath leads to path traversal. It is possible...

CVE-2023-51295

PHPJabbers Event Booking Calendar v4.0 is vulnerable to Multiple HTML Injection in the "name, pluginsmsapikey, pluginsmscountrycode, title, pluginsmsapikey, title" parameters...

ApolloTheme AP Page Builder 路径遍历漏洞

ApolloTheme AP Page Builder is a plugin from ApolloTheme, Inc. A path traversal vulnerability exists in ApolloTheme AP Page Builder versions prior to 4.0.0, which stems from an unauthenticated remote user being able to modify the productitempath in the config JSON file, which could result in...

Horner Automation Cscape 缓冲区错误漏洞

Horner Automation Cscape is a suite of programming software for industrial control system development from Horner Automation. A buffer error vulnerability exists in Horner Automation Cscape version 10.0 that originates from an out-of-bounds read and could allow an attacker to disclose information...

CVE-2024-11615

The Envolve Plugin plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.0 via the 'zetradeleteLanguageFile' and 'zetradeleteFontsFile' functions. This is due to the plugin not properly validating a file or its path prior to deleting it. This makes ...

CVE-2025-47626

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in apasionados Submission DOM tracking for Contact Form 7 allows Stored XSS. This issue affects Submission DOM tracking for Contact Form 7: from n/a through 2.0...

CVE-2025-46332 Information Disclosure via Flags override link

Flags SDK is an open-source feature flags toolkit for Next.js and SvelteKit. Impacted versions include flags from 3.2.0 and prior and @vercel/flags from 3.1.1 and prior as certain circumstances allows a bad actor with detailed knowledge of the vulnerability to list all flags returned by the flags...

CVE-2024-11142 CSRF in Gosoft Software's Proticaret E-Commerce

Cross-Site Request Forgery CSRF vulnerability in Gosoft Software Proticaret E-Commerce allows Cross Site Request Forgery. This issue affects Proticaret E-Commerce: before v6.0 NOTE: According to the vendor, fixing process is still ongoing for v4.05...

CVE-2024-11142 CSRF in Gosoft Software's Proticaret E-Commerce

Cross-Site Request Forgery CSRF vulnerability in Gosoft Software Proticaret E-Commerce allows Cross Site Request Forgery. This issue affects Proticaret E-Commerce: before v6.0 NOTE: According to the vendor, fixing process is still ongoing for v4.05...

CVE-2025-44193

SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangaymanagement/admin/?page=viewcomplaint...

CVE-2025-44193

SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangaymanagement/admin/?page=viewcomplaint...

CVE-2025-44194

SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangaymanagement/admin/?page=viewhousehold...

CVE-2025-44193

SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangaymanagement/admin/?page=viewcomplaint...

CVE-2025-44192

SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangaymanagement/admin/?page=viewclearance...

CVE-2025-44192

CVE-2025-44192 affects SourceCodester Simple Barangay Management System v1.0. The SQL injection vulnerability exists in the /barangay_management/admin/?page=view_clearance endpoint due to improper input handling, enabling attacker-controlled SQL execution. CVSSv3.1 metrics in the initial record i...