CVE-2025-7942 PHPGurukul Taxi Stand Management System admin-profile.php cross site scripting

A vulnerability has been found in PHPGurukul Taxi Stand Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/admin-profile.php. The manipulation of the argument adminname leads to cross site scripting. The attack can be...

PHPGurukul Taxi Stand Management System 代码注入漏洞

Taxi Stand Management System is a cab stand management system. The Taxi Stand Management System suffers from a cross-site scripting vulnerability that originates from the adminname parameter in the /admin/admin-profile.php file not effectively filtering user input. An attacker can exploit this...

GHSA-QC7J-JGF3-QMHG

creationtimestamp| type| source ---|---|--- 2025-07-12 14:35:57+00:00| seen| https://bsky.app/profile/nixpkgssecuritychanges.gerbet.me/post/3ltrlg5kfi22r...

CVE-2025-34086 Bolt CMS Authenticated Remote Code Execution via Profile Injection and File Rename

Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow an authenticated user to achieve remote code execution. A user with valid credentials can inject arbitrary PHP code into the displayname field of the user profile, which is rendered unsanitized in backend...

CVE-2024-49364

creationtimestamp| type| source ---|---|--- 2025-06-29 13:27:08+00:00| published-proof-of-concept| https://github.com/bitcoinjs/tiny-secp256k1/security/advisories/GHSA-7mc2-6phr-23xc 2025-07-01 06:49:46+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lsv4afurpu23...

CVE-2025-27828

creationtimestamp| type| source ---|---|--- 2025-06-24 14:46:31+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/19344 2025-06-24 16:45:35+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lsekbeanrx2m...

CVE-2025-6421

creationtimestamp| type| source ---|---|--- 2025-06-21 22:31:34+00:00| published-proof-of-concept| Telegram/PyJlSwi8jdNUrP0ZQH6ZpEvRZ26d84GFio1rTwIcDtG0Kjo 2025-06-21 22:42:57+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/19133 2025-06-22 02:10:48+00:00| seen|...

CVE-2025-48992

Group-Office is affected by a stored and blind XSS in the Name field of user profiles for versions prior to 6.8.123 and prior to 25.0.27. The vulnerability allows an attacker to set their name to a JavaScript payload, which executes when the compromised user adds that attacker to Synchronization ...

CVE-2025-5838

A vulnerability classified as critical was found in PHPGurukul Employee Record Management System 1.3. Affected by this vulnerability is an unknown functionality of the file /admin/adminprofile.php. The manipulation of the argument AdminName leads to sql injection. The attack can be launched...

CVE-2025-49446

creationtimestamp| type| source ---|---|--- 2025-06-06 14:48:43+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lqx3dtdxq42k...

PT-2025-24271 · Unknown · Bp Profile As Homepage

Name of the Vulnerable Software and Affected Versions: BP Profile as Homepage versions 1.1 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application,...

CVE-2025-5659

A vulnerability classified as critical was found in PHPGurukul Complaint Management System 2.0. Affected by this vulnerability is an unknown functionality of the file /user/profile.php. The manipulation of the argument pincode leads to sql injection. The attack can be launched remotely. The explo...

CVE-2023-33580

Phpgurukul Student Study Center Management System V1.0 is vulnerable to Cross Site Scripting XSS in the "Admin Name" field on Admin Profile page...

CVE-2022-40238

A Remote Code Injection vulnerability exists in CERT software prior to version 1.50.5. An authenticated attacker can inject arbitrary pickle object as part of a user's profile. This can lead to code execution on the server when the user's profile is accessed...

CVE-2022-32378

itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via /school/model/getteacherprofile.php?myindex=...

CVE-2022-39226

Discourse is an open source discussion platform. In versions prior to 2.8.9 on the stable branch and prior to 2.9.0.beta10 on the beta and tests-passed branches, a malicious actor can add large payloads of text into the Location and Website fields of a user profile, which causes issues for other...

CVE-2021-22231

A denial of service in user's profile page is found starting with GitLab CE/EE 8.0 that allows attacker to reject access to their profile page via using a specially crafted username...

CVE-2019-13252

ACDSee Free 1.1.21 has a User Mode Write AV starting at IDEACDStd!IEPSetColorProfile+0x00000000001172b0...

Vehicle Record Management System profile.php file cross-site scripting vulnerability

Vehicle Record Management System is a vehicle record management system. Vehicle Record Management System suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the name, email, and mobile parameters in...

PT-2025-21328 · Unknown · Phpgurukul Vehicle Parking Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Vehicle Parking Management System version 1.13 Description: A critical issue has been found in the PHPGurukul Vehicle Parking Management System, affecting an unknown functionality of the file /admin/admin-profile.php. The...