CVE-2025-12835 WooMulti <= 1.7 - Subscriber+ Arbitrary File Deletion

The WooMulti WordPress plugin through 17 does not validate a file parameter when deleting files, which could allow any authenticated users, such as subscriber to delete arbitrary files on the server...

CVE-2025-67502 Taguette does not safeguard against Open Redirect

Taguette is an open source qualitative research tool. In versions 1.5.1 and below, attackers can craft malicious URLs that redirect users to arbitrary external websites after authentication. The application accepts a user-controlled next parameter and uses it directly in HTTP redirects without an...

PT-2025-50561

Name of the Vulnerable Software and Affected Versions Shopware versions 6.4.6.0 through 6.6.10.9 Shopware versions 6.7.0.0 through 6.7.5.0 Description Shopware, an open commerce platform, is affected by a Reflected Cross-Site Scripting XSS issue. A parameter from the login page URL is directly...

Warehouse Management System security vulnerabilities

Warehouse Management System is a warehouse management system by Carlo Montero Personal Developer. A security vulnerability exists in Warehouse Management System version 1.2, which stems from an unvalidated goodsimg parameter that could cause an authenticated user to delete arbitrary files...

Library System return.php File SQL Injection Vulnerability

Library System is a library system. The Library System suffers from a SQL injection vulnerability that originates from a lack of validation of externally entered SQL statements in the parameter ID of the file /return.php. An attacker can exploit this vulnerability to execute illegal SQL commands ...

Blog Site blog.php File SQL Injection Vulnerability

Blog Site is a blogging system. Blog Site suffers from an SQL injection vulnerability that originates from the lack of validation of the name/field parameter in the file /resources/functions/blog.php for externally typed SQL statements. An attacker can exploit this vulnerability to execute illega...

CVE-2025-12569

The Guest posting / Frontend Posting / Front Editor WordPress plugin (also identified as WP Front User Submit ) is vulnerable to an Open Redirect issue in versions prior to 5.0.0 . The root cause is a failure to validate a parameter before redirecting the user to its value. Exploitation details a...

CVE-2025-12569 WP Front User Submit < 5.0.0 - Open Redirect

The Guest posting / Frontend Posting / Front Editor WordPress plugin before 5.0.0 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue...

CVE-2025-12569 WP Front User Submit < 5.0.0 - Open Redirect

The Guest posting / Frontend Posting / Front Editor WordPress plugin before 5.0.0 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue...

CVE-2025-12569: Undefined Security Weakness

The Guest posting / Frontend Posting / Front Editor WordPress plugin before 5.0.0 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue...

PT-2025-47885

The Guest posting / Frontend Posting / Front Editor WordPress plugin before 5.0.0 does not validate a parameter before redirecting the user to its value, leading to an Open Redirect issue...

Student Record System change-password.php File SQL Injection Vulnerability

Student Record System is a software application. Student Record System suffers from a SQL injection vulnerability that stems from a lack of validation of the currentpassword parameter in change-password.php against an externally entered SQL statement. An attacker can exploit this vulnerability to...

Kashipara Responsive School Management System security vulnerabilities

Kashipara Responsive School Management System is a school management system from Kashipara. A security vulnerability exists in Kashipara Responsive School Management System version 1.0, which originates from an unvalidated parameter in clientuser/feedback.php and could lead to a cross-site...

Kashipara Online Furniture Shopping E-commerce Website Security Vulnerability

Kashipara Online Furniture Shopping Ecommerce Website is a fast online shopping ecommerce website from Kashipara. A security vulnerability exists in Kashipara Online Furniture Shopping Ecommerce Website version 1.0, which stems from an unvalidated useremail parameter in userlogin.php, which could...

PHPGurukul Student Record System security vulnerability

Student Record System is a software application. Student Record System suffers from a SQL injection vulnerability that stems from a lack of validation of the currentpassword parameter in change-password.php against an externally entered SQL statement. An attacker can exploit this vulnerability to...

ZenTao’s various products have security vulnerabilities

ZenTao Biz and others are a project management software from the Chinese company ZenTao. A security vulnerability exists in several ZenTao products, which stems from insufficient validation of the parameter account in the file /zentao/user-login.html, which could lead to an SQL injection attack...

Lila security vulnerabilities

lila is an ad-free and open source chess server from Lichess Open Source. A security vulnerability exists in lila, which stems from the unvalidated direct passing of the players parameter in the game export API, which could lead to server-side request forgery...

TechStore Pro security vulnerabilities

TechStore Pro is an e-commerce platform for nooncarlett individual developers. A security vulnerability exists in TechStore Pro version 1.0, which stems from an unvalidated parameter q in the /searchresults endpoint that could lead to a cross-site scripting attack...

CVE-2025-54941

An example dag exampledagdecorator had non-validated parameter that allowed the UI user to redirect the example to a malicious server and execute code on worker. This however required that the example dags are enabled in production not default or the example dag code copied to build your own...

CVE-2025-64116

Movary (a web app for tracking and exploring movie watch history) is affected by CVE-2025-64116. Prior to version 0.69.0, the login page accepts a redirect parameter without validation, enabling open redirect to arbitrary external sites. The issue is fixed in 0.69.0. Affected components: login/re...