CVE-2025-9155

A vulnerability has been found in itsourcecode Online Tour and Travel Management System 1.0. Impacted is an unknown function of the file /user/forgetpassword.php. Such manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to...

PT-2025-33865 · Unknown · Solidinvoice

Name of the Vulnerable Software and Affected Versions: SolidInvoice versions prior to 2.4.1 Description: A vulnerability exists in SolidInvoice that allows for cross site scripting. The issue affects unknown code within the /invoice/recurring file of the Recurring Invoice Module. Manipulation of...

CVE-2025-9096

A vulnerability has been found in ExpressGateway express-gateway up to 1.16.10. Affected is an unknown function in the library lib/rest/routes/apps.js of the component REST Endpoint. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been...

PT-2025-33695 · Netis · Netis Wf2419

Name of the Vulnerable Software and Affected Versions: Netis WF2419 version 1.2.29433 Description: A cross-site scripting issue exists in the Wireless Settings Page component, specifically within the /index.htm file. Manipulation of the SSID argument with the input triggers the vulnerability...

CVE-2025-9007

A vulnerability has been found in Tenda CH22 1.0.0.1. Affected by this issue is the function formeditFileName of the file /goform/editFileName. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used...

CVE-2025-9004

A vulnerability was found in mtons mblog up to 3.5.0. This issue affects some unknown processing of the file /settings/password. The manipulation leads to improper restriction of excessive authentication attempts. The attack may be initiated remotely. The complexity of an attack is rather high. T...

PT-2025-33607 · Tenda · Tenda Ac20

Name of the Vulnerable Software and Affected Versions: Tenda AC20 version 16.03.08.12 Description: A vulnerability was identified in the Telnet Service component of Tenda AC20. The websFormDefine function within the /goform/telnet file is affected, leading to command injection. The attack can be...

CVE-2025-8954

A vulnerability was identified in PHPGurukul Hospital Management System 4.0. This affects an unknown part of the file /admin/doctor-specilization.php. The manipulation of the argument doctorspecilization leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-9046

A vulnerability was identified in Tenda AC20 16.03.08.12. This issue affects the function sub46A2AC of the file /goform/setMacFilterCfg. The manipulation of the argument deviceList leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the...

CVE-2025-9025 code-projects Simple Cafe Ordering System portal.php sql injection

A vulnerability was determined in code-projects Simple Cafe Ordering System 1.0. Affected by this issue is some unknown functionality of the file /portal.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the...

CVE-2025-9016 Mechrevo Control Center GX V2 Powershell Script Command uncontrolled search path

A vulnerability was identified in Mechrevo Control Center GX V2 5.56.51.48. This affects an unknown part of the file C:\Program Files\OEM\机械革命控制中心\AiStoneService\MyControlCenter\Command of the component Powershell Script Handler. The manipulation leads to uncontrolled search path. Local access is...

PT-2025-33438 · Tenda · Tenda Ch22

Name of the Vulnerable Software and Affected Versions: Tenda CH22 version 1.0.0.1 Description: A buffer overflow vulnerability exists in the formeditFileName function within the /goform/editFileName file. The issue can be exploited remotely. The exploit for this vulnerability has been publicly...

CVE-2025-8986

A vulnerability was determined in SourceCodester COVID 19 Testing Management System 1.0. Affected by this issue is some unknown functionality of the file /search-report-result.php. The manipulation of the argument serachdata leads to sql injection. The attack may be launched remotely. The exploit...

CVE-2025-8978

CVE-2025-8978 concerns D-Link DIR-619L (firmware 6.02CN02) where the Boa component’s FirmwareUpgrade function validates data improperly, enabling a remote attack. The description notes insufficient data authenticity verification, remote exploitability, and a relatively high attack complexity, wit...

CVE-2025-8972 itsourcecode Online Tour and Travel Management System page-login.php sql injection

A vulnerability was identified in itsourcecode Online Tour and Travel Management System 1.0. This issue affects some unknown processing of the file /admin/page-login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been...

CVE-2025-8952

A vulnerability was found in Campcodes Online Flight Booking Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ajax.php?action=login of the component Login. The manipulation of the argument Username leads to sql injection. The attack can be...

CVE-2025-8936

The CVE targets 1000 Projects Sales Management System 1.0. The vulnerability lies in the file /superstore/dist/dordupdate.php, where improper handling of the select2 parameter enables SQL injection. A remote attacker could exploit this, and public disclosures exist. Affected component: the dordup...

PT-2025-33299 · Unknown · Hospital Management System

Name of the Vulnerable Software and Affected Versions: Hostel Management System version 1.0 Description: A vulnerability exists in the Login component of Hostel Management System 1.0, specifically within the hostel manage.exe file. This issue results in improper authentication and allows for loca...

CVE-2025-8929

CVE-2025-8929 affects the code-projects Medical Store Management System 1.0. The vulnerability resides in the file MainPanel.java , where the input parameter searchTxt is not properly filtered, leading to a SQL injection . Exploitation can be performed remotely, and the exploit has been disclosed...

CVE-2025-8925

CVE-2025-8925 affects itsourcecode Sports Management System 1.0. The vulnerability is an SQL injection in /Admin/match.php caused by unsafely handling the code parameter, enabling remote exploitation and unauthorized data access. Exploit details have been publicly disclosed. No official fix/versi...