CVE-2025-27892

Shopware prior to version 6.5.8.13 is affected by a SQL injection vulnerability in the /api/search/order endpoint. NOTE: this issue exists because of a CVE-2024-22406 and CVE-2024-42357 regression...

CVE-2025-20232

In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.3.2408.103, 9.2.2406.108, 9.2.2403.113, 9.1.2312.208 and 9.1.2308.212, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a saved search with a risky command...

CVE-2025-20232 Risky Command Safeguards Bypass in “/app/search/search“ endpoint through “s“ parameter in Splunk Enterprise

In Splunk Enterprise versions below 9.3.3, 9.2.5, and 9.1.8 and Splunk Cloud Platform versions below 9.3.2408.103, 9.2.2406.108, 9.2.2403.113, 9.1.2312.208 and 9.1.2308.212, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a saved search with a risky command...

PHPGurukul Art Gallery Management System 注入漏洞

Art Gallery Management System is an art gallery management system. Art Gallery Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter Search of /search.php. An attacker can exploit this...

PHPGurukul Emergency Ambulance Hiring Portal 注入漏洞

Emergency Ambulance Hiring Portal is an emergency ambulance hiring portal. Emergency Ambulance Hiring Portal suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the searchdata parameter of the /admin/search.php file. An attacke...

Serosoft Solutions Academia Student Information System EagleR 安全漏洞

Serosoft Solutions Academia Student Information System EagleR is a student information system from Serosoft Solutions, India. A security vulnerability exists in Serosoft Solutions Academia Student Information System EagleR v1.0.118, which originates in the /rest/cb/executeBasicSearch component...

Cross-site Scripting (XSS)

Overview opencart/opencart is a shopping cart system Affected versions of this package are vulnerable to Cross-site Scripting XSS via the /product/search endpoint. An attacker can execute arbitrary JavaScript in the victim's browser and potentially access sensitive information or perform actions ...

PT-2025-9101 · Opencart · Opencart

Name of the Vulnerable Software and Affected Versions: OpenCart versions prior to 4.1.0 Description: The issue allows an attacker to execute JavaScript code in the victim's browser by sending a malicious URL using the search in the "/product/search" endpoint. This could be exploited to steal...

CVE-2024-32037

GeoNetwork is a catalog application to manage spatially referenced resources. In versions prior to 4.2.10 and 4.4.5, the search end-point response headers contain information about Elasticsearch software in use. This information is valuable from a security point of view because it allows software...

Information Exposure

Overview org.geonetwork-opensource:gn-services is a GeoNetwork Services. Affected versions of this package are vulnerable to Information Exposure through the search end-point response headers. An attacker can gather sensitive information about the server's software stack by analyzing these header...

GeoNetwork 信息泄露漏洞

GeoNetwork is a catalog application from the GeoNetwork open source. It is used to manage spatially referenced resources. An information disclosure vulnerability exists in GeoNetwork that stems from a search endpoint response header containing information about the Elasticsearch software being us...

PT-2025-3773 · Unknown · Code-Projects Point Of Sales/Inventory Management System

Name of the Vulnerable Software and Affected Versions: code-projects Point of Sales and Inventory Management System version 1.0 Description: A critical issue has been found in the system, affecting an unknown functionality of the file /user/search num.php. The manipulation of the search argument...

PT-2024-33185 · Unknown · Phpgurukul Medical Card Generation System

Name of the Vulnerable Software and Affected Versions: PhpGurukul Medical Card Generation System version 1.0 Description: The issue is related to Cross Site Scripting XSS in the /admin/search-medicalcard.php endpoint via the searchdata parameter. This allows for potential malicious script...

PT-2024-34518 · Unknown · Phpgurukul Online Dj Booking Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online DJ Booking Management System version 1.0 Description: A Reflected Cross Site Scripting XSS issue was found in the "/odms/admin/booking-search.php" API endpoint, allowing remote attackers to execute arbitrary code via the...

PT-2024-34517 · Unknown · Phpgurukul Online Dj Booking Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online DJ Booking Management System version 1.0 Description: A Reflected Cross Site Scripting XSS issue was found in the /odms/admin/user-search.php endpoint, allowing remote attackers to execute arbitrary code via the searchdata...

PT-2024-15981 · Code Projects · Pharmacy Management System

Name of the Vulnerable Software and Affected Versions: code-projects Pharmacy Management System version 1.0 Description: A critical issue has been found in the Pharmacy Management System. This issue affects the file /php/manage supplier.php?action=search, where the manipulation of the text argume...

PT-2024-30027 · Unknown · School Management System

Name of the Vulnerable Software and Affected Versions: School Management System version bae5aa Description: A SQL injection issue was discovered in the School Management System, allowing unauthorized data access and manipulation via the sid parameter at the "/search.php?action=2" endpoint. This...

PT-2024-28870 · Unknown · Phpgurukul Old Age Home Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Old Age Home Management System version 1.0 Description: A Reflected Cross Site Scripting XSS issue was found in the "/oahms/search.php" endpoint, which allows remote attackers to execute arbitrary code via the searchdata parameter...

PT-2024-22018 · Unknown · Campcodes Online Marriage Registration System

Name of the Vulnerable Software and Affected Versions: Campcodes Online Marriage Registration System version 1.0 Description: A critical vulnerability was found in the Campcodes Online Marriage Registration System. This issue affects unknown code in the file /user/search.php. The manipulation of...

PT-2024-12878 · Unknown · Openclinic Ga

Name of the Vulnerable Software and Affected Versions: OpenClinic GA version 5.247.01 Description: An issue was discovered in OpenClinic GA, allowing retrieval of patient lists via queries such as findFirstname= to "/ common/search/searchByAjax/patientslistShow.jsp". Recommendations: For OpenClin...