CVE-2025-65380: Improper Neutralization of Special Elements used in an SQL Command

PHPGurukul Billing System 1.0 is vulnerable to SQL Injection in the admin/index.php endpoint. Specifically, the username parameter accepts unvalidated user input, which is then concatenated directly into a backend SQL query...

CVE-2025-65858

Calibre-Web (specifically version v0.6.25 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the insufficient sanitization of the 'username' field during the user creation process. An attacker can inject malicious JavaScript into this field, which is then stored in the...

PT-2025-48688

Name of the Vulnerable Software and Affected Versions Calibre-Web version 0.6.25 Description A Stored Cross-Site Scripting XSS issue exists in Calibre-Web. An attacker can inject malicious JavaScript into the username field during user creation. The injected payload is stored without proper...

CVE-2025-65380

The PHPGurukul Billing System 1.0 is vulnerable to SQL Injection via the admin/index.php endpoint. The root cause is the application's failure to validate the username parameter, which is concatenated directly into a backend SQL query. An attacker can exploit this by submitting a maliciously cons...

PT-2025-48673

Name of the Vulnerable Software and Affected Versions Circutor SGE-PLC1000/SGE-PLC50 version 9.0.2 Description A stack-based buffer overflow exists in the AddEvent function when handling user-supplied usernames. The issue occurs because the function copies the username input to a fixed-size buffe...

CVE-2025-65858

A Stored Cross-Site Scripting XSS vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation. The payload is stored unsanitized and later executed when the /ajax/listusers endpoint is accessed...

PT-2025-48782

Name of the Vulnerable Software and Affected Versions PHPGurukul Billing System version 1.0 Description The PHPGurukul Billing System version 1.0 contains a SQL Injection issue in the admin/index.php endpoint. The username parameter is susceptible because it accepts unvalidated user input that is...

CVE-2025-65379

The PHPGurukul Billing System version 1.0 is vulnerable to SQL Injection within the /admin/password-recovery.php endpoint. The root cause is the lack of input validation for the username and mobileno parameters, which are concatenated directly into backend SQL queries. An attacker can exploit thi...

PT-2025-48776

Name of the Vulnerable Software and Affected Versions PHPGurukul Billing System version 1.0 Description The PHPGurukul Billing System version 1.0 contains a SQL Injection flaw in the /admin/password-recovery.php endpoint. The username and mobileno parameters do not properly validate user-supplied...

CVE-2025-65858

A Stored Cross-Site Scripting XSS vulnerability in Calibre-Web v0.6.25 allows attackers to inject malicious JavaScript into the 'username' field during user creation. The payload is stored unsanitized and later executed when the /ajax/listusers endpoint is accessed...

Incorrect Privilege Assignment

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Incorrect Privilege Assignment due to the absence of username uniqueness validation when creating users. An attacker can gain unauthorized...

CVE-2025-66296

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a privilege escalation vulnerability exists in Grav’s Admin plugin due to the absence of username uniqueness validation when creating users. A user with the create user permission can create a new account using the same username as an...

CVE-2025-66296

CVE-2025-66296 affects Grav (file-based CMS). Before 1.8.0-beta.27, the Admin plugin has a flaw: no username uniqueness validation when creating users. An account with create user permissions can register a new user using an existing admin username, set a new password/email, and then log in as th...

CVE-2025-66296 Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a privilege escalation vulnerability exists in Grav’s Admin plugin due to the absence of username uniqueness validation when creating users. A user with the create user permission can create a new account using the same username as an...

CVE-2025-66296 Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a privilege escalation vulnerability exists in Grav’s Admin plugin due to the absence of username uniqueness validation when creating users. A user with the create user permission can create a new account using the same username as an...

CVE-2025-66296 Grav vulnerable to Privilege Escalation in Grav Admin: Missing Username Uniqueness Check Allows Admin Account Takeover

Grav is a file-based Web platform. Prior to 1.8.0-beta.27, a privilege escalation vulnerability exists in Grav’s Admin plugin due to the absence of username uniqueness validation when creating users. A user with the create user permission can create a new account using the same username as an...

Authorization Bypass Through User-Controlled Key

Overview feehi/cms is a Feehi CMS project template. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the username parameter. An attacker can alter user account information by intercepting and modifying the supposedly immutable parameter duri...

EUVD-2025-200001

FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticated attacker can intercept and modify the parameter in transit and the backend accepts the changes. This can lead to unintended username changes...

FeehiCMS fails to enforce server-side immutability

FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticated attacker can intercept and modify the parameter in transit and the backend accepts the changes. This can lead to unintended username changes...

CVE-2025-63523

FeehiCMS version 2.1.1 fails to enforce server-side immutability for parameters that are presented to clients as "read-only." An authenticated attacker can intercept and modify the parameter in transit and the backend accepts the changes. This can lead to unintended username changes...