CVE-2025-4204

CVE-2025-4204: Ultimate Auction Pro for WordPress (

JSite 安全漏洞

JSite is JSite open source a backend management system rapid development framework . JSite 1.0 version has a security vulnerability , the vulnerability stems from the file /a/sys/user/save in the parameter Name operation leads to cross-site scripting attacks...

CVE-2025-3575 Insecure Direct Object Reference en Deporsite de T-INNOVA

Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive information from others users via "idUsuario" parameter in "/helper/Familia/establecerUsuarioSeleccion" endpoint...

CVE-2025-3574 Insecure Direct Object Reference on Deporsite by T-INNOVA

Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive information from others users via "idUsuario" parameter in "/helper/Familia/obtenerFamiliaUsuario" endpoint...

CVE-2025-1321

The teachPress plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the 'tpsearch' shortcode in all versions up to, and including, 9.0.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

CVE-2025-1572

The CVE-2025-1572 entry concerns KiviCare – Clinic & Patient Management System (EHR) WordPress plugin (versions

Palantir Foundry 安全漏洞

Palantir Foundry is a business process management platform from US-based Palantir, Inc. A security vulnerability exists in Palantir Foundry versions prior to 0.1337.0 that originates from a disk exhaustion due to a user parameter that could trigger a denial of service...

Chat System addnewmember.php File SQL Injection Vulnerability

Chat System is a chat system. Chat System has a SQL injection vulnerability that stems from a lack of sufficient input validation and cleanup of the parameter user in the file /user/addnewmember.php. An attacker could exploit this vulnerability to cause database information to be disclosed or...

CVE-2017-18364

phpFK lite has XSS via the faq.php, members.php, or search.php query string or the user.php user parameter...

CVE-2024-2386

The WordPress Plugin for Google Maps – WP MAPS plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'putwpgm' shortcode in all versions up to, and including, 4.6.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...

CVE-2024-0952

The WP ERP | Complete HR solution with recruitment & job listings | WooCommerce CRM & Accounting plugin for WordPress is vulnerable to time-based SQL Injection via the id parameter in all versions up to, and including, 1.12.9 due to insufficient escaping on the user supplied parameter and lack of...

Code-Projects Chat System 注入漏洞

Chat System is a chat system. Chat System has a SQL injection vulnerability that stems from a lack of sufficient input validation and cleanup of the parameter user in the file /user/addnewmember.php. An attacker could exploit this vulnerability to cause database information to be disclosed or...

PT-2025-4086 · Unknown · Code-Projects Chat System

Name of the Vulnerable Software and Affected Versions: code-projects Chat System versions 1.0 and earlier Description: A critical issue has been found in the code-projects Chat System, affecting an unknown functionality of the file /user/addnewmember.php. The manipulation of the user argument lea...

CVE-2024-57016

TOTOLINK X5000R V9.1.0cu.2350B20230313 was discovered to contain an OS command injection vulnerability via the "user" parameter in setVpnAccountCfg...

CVE-2024-57016

TOTOLINK X5000R V9.1.0cu.2350B20230313 was discovered to contain an OS command injection vulnerability via the "user" parameter in setVpnAccountCfg...

CVE-2024-57016

TOTOLINK X5000R V9.1.0cu.2350B20230313 was discovered to contain an OS command injection vulnerability via the "user" parameter in setVpnAccountCfg...

CVE-2024-57016

TOTOLINK X5000R V9.1.0cu.2350B20230313 was discovered to contain an OS command injection vulnerability via the "user" parameter in setVpnAccountCfg...

CVE-2024-12067

The WP Travel – Ultimate Travel Booking System, Tour Management Engine plugin for WordPress is vulnerable to SQL Injection via the 'bookingitinerary' parameter of the 'wptravelgetbookingdata' function in all versions up to, and including, 10.0.0 due to insufficient escaping on the user supplied...

PT-2025-3382 · Totolink · Totolink X5000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X5000R version V9.1.0cu.2350 B20230313 Description: The issue is related to the setVpnAccountCfg function, specifically the /web/cgi-bin/cstecgi.cgi endpoint, where the user parameter is not properly sanitized, allowing for OS comman...

PT-2024-17891 · Unknown · Code-Projects Chat System

Name of the Vulnerable Software and Affected Versions: code-projects Chat System version 1.0 Description: A problematic vulnerability was found in the code-projects Chat System, affecting an unknown part of the file /admin/update user.php. The manipulation of the name argument leads to cross-site...