4127 matches found
CVE-2023-51295
PHPJabbers Event Booking Calendar v4.0 is vulnerable to Multiple HTML Injection in the "name, pluginsmsapikey, pluginsmscountrycode, title, pluginsmsapikey, title" parameters...
Horner Automation Cscape 缓冲区错误漏洞
Horner Automation Cscape is a suite of programming software for industrial control system development from Horner Automation. A buffer error vulnerability exists in Horner Automation Cscape version 10.0 that originates from an out-of-bounds read and could allow an attacker to disclose information...
ApolloTheme AP Page Builder 路径遍历漏洞
ApolloTheme AP Page Builder is a plugin from ApolloTheme, Inc. A path traversal vulnerability exists in ApolloTheme AP Page Builder versions prior to 4.0.0, which stems from an unauthenticated remote user being able to modify the productitempath in the config JSON file, which could result in...
CVE-2024-11615
The Envolve Plugin plugin for WordPress is vulnerable to arbitrary file deletion in all versions up to, and including, 1.0 via the 'zetradeleteLanguageFile' and 'zetradeleteFontsFile' functions. This is due to the plugin not properly validating a file or its path prior to deleting it. This makes ...
CVE-2025-47626
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in apasionados Submission DOM tracking for Contact Form 7 allows Stored XSS. This issue affects Submission DOM tracking for Contact Form 7: from n/a through 2.0...
CVE-2025-46332 Information Disclosure via Flags override link
Flags SDK is an open-source feature flags toolkit for Next.js and SvelteKit. Impacted versions include flags from 3.2.0 and prior and @vercel/flags from 3.1.1 and prior as certain circumstances allows a bad actor with detailed knowledge of the vulnerability to list all flags returned by the flags...
CVE-2024-11142 CSRF in Gosoft Software's Proticaret E-Commerce
Cross-Site Request Forgery CSRF vulnerability in Gosoft Software Proticaret E-Commerce allows Cross Site Request Forgery. This issue affects Proticaret E-Commerce: before v6.0 NOTE: According to the vendor, fixing process is still ongoing for v4.05...
CVE-2024-11142 CSRF in Gosoft Software's Proticaret E-Commerce
Cross-Site Request Forgery CSRF vulnerability in Gosoft Software Proticaret E-Commerce allows Cross Site Request Forgery. This issue affects Proticaret E-Commerce: before v6.0 NOTE: According to the vendor, fixing process is still ongoing for v4.05...
CVE-2025-44193
SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangaymanagement/admin/?page=viewcomplaint...
CVE-2025-44193
SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangaymanagement/admin/?page=viewcomplaint...
CVE-2025-44192
SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangaymanagement/admin/?page=viewclearance...
CVE-2025-44194
SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangaymanagement/admin/?page=viewhousehold...
CVE-2025-44193
SourceCodester Simple Barangay Management System v1.0 has a SQL injection vulnerability in /barangaymanagement/admin/?page=viewcomplaint...
CVE-2025-44192
SourceCodester Simple Barangay Management System v1.0 contains a SQL injection vulnerability within the /barangay_management/admin/?page=view_clearance API endpoint. This flaw arises from improper handling of input, which can be exploited to inject malicious SQL code, potentially resulting in una...
PHPGurukul Online Nurse Hiring System 安全漏洞
PHPGurukul Online Nurse Hiring System is an online nurse hiring system from PHPGurukul, Inc. A security vulnerability exists in version 1.0 of the PHPGurukul Online Nurse Hiring System that stems from improper handling of the file /admin/edit-nurse.php, which could lead to a SQL injection attack...
UBUNTU-CVE-2025-4011
A vulnerability has been found in Redmine 6.0.0/6.0.1/6.0.2/6.0.3 and classified as problematic. This vulnerability affects unknown code of the component Custom Query Handler. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. Upgrading to...
Redmine 代码注入漏洞
Redmine is an open source set of open source Web-based project management and defect tracking tools from Redmine Open Source. The product provides features such as project management, issue tracking and role-based access control. A code injection vulnerability exists in Redmine versions 6.0.0,...
CVE-2025-46689
CVE-2025-46689 affects Ververica Platform 2.14.0 with a Reflected XSS vulnerability exposed via the URI path namespaces/default/formats . The issue involves user-controlled input in that path, allowing an attacker to trigger script execution in a victim’s browser when the vulnerable page is loade...