973 matches found
CVE-2025-10592
CVE-2025-10592 affects itsourcecode Online Public Access Catalog OPAC 1.0. the vulnerability resides in the mysearch.php POST Parameter Handler where manipulating search_field/search_text enables SQL injection. exploitation appears remote and publicly disclosed; multiple sources corroborate an SQ...
CVE-2025-10592 itsourcecode Online Public Access Catalog OPAC POST Parameter mysearch.php sql injection
A security vulnerability has been detected in itsourcecode Online Public Access Catalog OPAC 1.0. This impacts an unknown function of the file mysearch.php of the component POST Parameter Handler. Such manipulation of the argument searchfield/searchtext leads to sql injection. The attack may be...
CVE-2025-56697
A Stored Cross-Site Scripting XSS vulnerability was discovered in the /users/adminpanel/admin/home.php?page=feedbacks file of Kashipara Computer Base Test v1.0. Attackers can inject malicious scripts via the smyFeedbacks POST parameter in /users/home.php...
CVE-2025-40696
Stored Cross Site Scripting in Online Fire Reporting System v1.2 by PHPGurukul, that consists in a stored authenticated XSS due to the lack of propper validation of user inputs 'fullname', 'location' and 'message' parameters via POST at the endpoint '/ofrs/reporting.php'. This vulnerability could...
CVE-2025-51967
A Reflected Cross-site Scripting XSS vulnerability exists in the themeSet.php file of ProjectsAndPrograms School Management System 1.0. The application fails to sanitize user-supplied input in the theme POST parameter, allowing an attacker to inject and execute arbitrary JavaScript in a victim's...
CVE-2025-51967
Summary: CVE-2025-51967 describes a reflected XSS in ProjectsAndPrograms School Management System 1.0. The vulnerability exists in the themeSet.php script where user input supplied to the theme POST parameter is not properly sanitized, enabling an attacker to inject arbitrary JavaScript executed ...
CVE-2025-50989
OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint interfacesbridgeedit.php. The span POST parameter is concatenated into a system-level command without proper sanitization or escaping, allowing an administrator to inject arbitra...
CVE-2025-50989
OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint interfacesbridgeedit.php. The span POST parameter is concatenated into a system-level command without proper sanitization or escaping, allowing an administrator to inject arbitra...
CVE-2025-50860
SQL Injection in the listdomains function in Easy Hosting Control Panel EHCP 20.04.1.b allows authenticated attackers to access or manipulate database contents via the arananalan POST parameter...
CVE-2025-50860
SQL Injection in the listdomains function in Easy Hosting Control Panel EHCP 20.04.1.b allows authenticated attackers to access or manipulate database contents via the arananalan POST parameter...
CVE-2025-50860
SQL Injection in the listdomains function in Easy Hosting Control Panel EHCP 20.04.1.b allows authenticated attackers to access or manipulate database contents via the arananalan POST parameter...
📄 Easy Hosting Control Panel 20.04.1.b SQL Injection
Easy Hosting Control Panel version 20.04.1.b suffers from a remote SQL injection vulnerability in the listdomains function via the arananalan POST parameter. Title: Easy Hosting Control Panel EHCP 20.04.1.b - SQL Injection in the listdomains function via the arananalan POST parameter Description:...
PT-2025-33080 · Webid · Webid
Name of the Vulnerable Software and Affected Versions: WeBid version 1.0.2 Description: WeBid version 1.0.2 contains a remote code injection issue in the convert.php script. Unsanitized input from the to parameter in a POST request is directly written to the includes/currencies.php file. This...
Sourceforge WeBid 安全漏洞
Sourceforge WeBid is a Sourceforge open source web project for online auctions and selling products. A security vulnerability exists in Sourceforge WeBid version 1.0.2, which stems from a converter.php script that does not clean up the to parameter in a POST request, which could lead to remote co...
CVE-2012-10041
WAN Emulator v2.3 contains two unauthenticated command execution vulnerabilities. The result.php script calls shellexec with unsanitized input from the pc POST parameter, allowing remote attackers to execute arbitrary commands as the www-data user. The system also includes a SUID-root binary name...
CVE-2012-10041 WAN Emulator v2.3 Command Execution
WAN Emulator v2.3 contains two unauthenticated command execution vulnerabilities. The result.php script calls shellexec with unsanitized input from the pc POST parameter, allowing remote attackers to execute arbitrary commands as the www-data user. The system also includes a SUID-root binary name...
CVE-2012-10041
WAN Emulator v2.3 contains two unauthenticated command execution vulnerabilities. The result.php script passes unsanitized input from the pc POST parameter to shell_exec(), allowing remote command execution as the www-data user. Additionally, a SUID-root binary named dosu is vulnerable to command...
U.S. Dept Of Defense: Cross-Site Scripting via 'RAISED_FUNDS_DESC' parameter
A Cross-Site Scripting XSS vulnerability was discovered in the parameter 'RAISEDFUNDSDESC' through the POST method on the target website. Exploitation of this vulnerability could have led to consequences such as cookie theft and session hijacking. The vendor was notified, and appropriate...
CloudClassroom-PHP-Project 安全漏洞
CloudClassroom-PHP-Project is a cloud classroom website by the individual developer Vishal Mathur. A security vulnerability exists in CloudClassroom-PHP-Project version 1.0, which stems from insufficient cleanup of the Q4 POST parameter in the file takeassessment2.php, which could lead to SQL...