CVE-2025-51967

A Reflected Cross-site Scripting (XSS) vulnerability exists in the ProjectsAndPrograms School Management System 1.0 . The flaw is located in the themeSet.php file, where the application fails to sanitize user-supplied input within the theme POST parameter. This allows an attacker to inject and ex...

CVE-2025-51967: Improper Neutralization of Input During Web Page Generation

A Reflected Cross-site Scripting XSS vulnerability exists in the themeSet.php file of ProjectsAndPrograms School Management System 1.0. The application fails to sanitize user-supplied input in the theme POST parameter, allowing an attacker to inject and execute arbitrary JavaScript in a victim's...

CVE-2025-50989

OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint interfacesbridgeedit.php. The span POST parameter is concatenated into a system-level command without proper sanitization or escaping, allowing an administrator to inject arbitra...

CVE-2025-50989

OPNsense before 25.1.8 contains an authenticated command injection vulnerability in its Bridge Interface Edit endpoint interfacesbridgeedit.php. The span POST parameter is concatenated into a system-level command without proper sanitization or escaping, allowing an administrator to inject arbitra...

CVE-2025-50860

SQL Injection in the listdomains function in Easy Hosting Control Panel EHCP 20.04.1.b allows authenticated attackers to access or manipulate database contents via the arananalan POST parameter...

CVE-2025-50860

SQL Injection in the listdomains function in Easy Hosting Control Panel EHCP 20.04.1.b allows authenticated attackers to access or manipulate database contents via the arananalan POST parameter...

CVE-2025-50860

SQL Injection in the listdomains function in Easy Hosting Control Panel EHCP 20.04.1.b allows authenticated attackers to access or manipulate database contents via the arananalan POST parameter...

📄 Easy Hosting Control Panel 20.04.1.b SQL Injection

Easy Hosting Control Panel version 20.04.1.b suffers from a remote SQL injection vulnerability in the listdomains function via the arananalan POST parameter. Title: Easy Hosting Control Panel EHCP 20.04.1.b - SQL Injection in the listdomains function via the arananalan POST parameter Description:...

Sourceforge WeBid 安全漏洞

Sourceforge WeBid is a Sourceforge open source web project for online auctions and selling products. A security vulnerability exists in Sourceforge WeBid version 1.0.2, which stems from a converter.php script that does not clean up the to parameter in a POST request, which could lead to remote co...

PT-2025-33080 · Webid · Webid

Name of the Vulnerable Software and Affected Versions: WeBid version 1.0.2 Description: WeBid version 1.0.2 contains a remote code injection issue in the convert.php script. Unsanitized input from the to parameter in a POST request is directly written to the includes/currencies.php file. This...

CVE-2012-10041

WAN Emulator v2.3 contains two unauthenticated command execution vulnerabilities. The result.php script calls shellexec with unsanitized input from the pc POST parameter, allowing remote attackers to execute arbitrary commands as the www-data user. The system also includes a SUID-root binary name...

CVE-2012-10041 WAN Emulator v2.3 Command Execution

WAN Emulator v2.3 contains two unauthenticated command execution vulnerabilities. The result.php script calls shellexec with unsanitized input from the pc POST parameter, allowing remote attackers to execute arbitrary commands as the www-data user. The system also includes a SUID-root binary name...

CVE-2012-10041

WAN Emulator v2.3 contains two unauthenticated command execution vulnerabilities. The result.php script passes unsanitized input from the pc POST parameter to shell_exec(), allowing remote command execution as the www-data user. Additionally, a SUID-root binary named dosu is vulnerable to command...

U.S. Dept Of Defense: Cross-Site Scripting via 'RAISED_FUNDS_DESC' parameter

A Cross-Site Scripting XSS vulnerability was discovered in the parameter 'RAISEDFUNDSDESC' through the POST method on the target website. Exploitation of this vulnerability could have led to consequences such as cookie theft and session hijacking. The vendor was notified, and appropriate...

CVE-2025-50868

A SQL Injection vulnerability exists in the takeassessment2.php file of CloudClassroom-PHP-Project 1.0. The Q4 POST parameter is not properly sanitized before being used in SQL queries...

CloudClassroom-PHP-Project 安全漏洞

CloudClassroom-PHP-Project is a cloud classroom website by the individual developer Vishal Mathur. A security vulnerability exists in CloudClassroom-PHP-Project version 1.0, which stems from insufficient cleanup of the Q4 POST parameter in the file takeassessment2.php, which could lead to SQL...

CVE-2025-50868

A SQL Injection vulnerability exists in CloudClassroom-PHP-Project version 1.0 . The issue is located in the takeassessment2.php file, where the Q4 POST parameter is not properly sanitized before being used in SQL queries. This flaw could allow an attacker to execute unauthorized database command...

CVE-2025-50868

A SQL Injection vulnerability exists in the takeassessment2.php file of CloudClassroom-PHP-Project 1.0. The Q4 POST parameter is not properly sanitized before being used in SQL queries...

CVE-2025-50867

A SQL Injection vulnerability exists in the takeassessment2.php endpoint of the CloudClassroom-PHP-Project 1.0, where the Q5 POST parameter is directly embedded in SQL statements without sanitization...

PT-2025-31559 · Unknown · Cloudclassroom-Php Project

Name of the Vulnerable Software and Affected Versions: CloudClassroom-PHP-Project version 1.0 Description: A SQL Injection vulnerability exists in the takeassessment2.php endpoint of CloudClassroom-PHP-Project version 1.0, where the Q5 POST parameter is directly embedded in SQL statements without...