CVE-2025-43804

CVE-2025-43804 affects Liferay Portal (versions 7.4.3.93–7.4.3.111) and Liferay DXP (2023.Q3.1–2023.Q4.0). The vulnerability is a Cross-site Scripting (XSS) in the Search widget, exploited via the _com_liferay_portal_search_web_portlet_SearchPortlet_userId parameter, which allows remote attackers...

CVE-2025-10385

A vulnerability has been found in Mercury KM08-708H GiGA WiFi Wave2 1.1. Affected by this issue is the function sub450B2C of the file /goform/mcrsetSysAdm. The manipulation of the argument ChgUserId leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-10098

A security flaw has been discovered in PHPGurukul User Management System 1.0. Affected is an unknown function of the file /admin/edit-user-profile.php. The manipulation of the argument uid results in sql injection. The attack may be performed from remote. The exploit has been released to the publ...

User Management System admin/change-emailid.php File SQL Injection Vulnerability

User Management System is a user management system. User Management System suffers from a SQL injection vulnerability that originates from the lack of validation of the parameter uid in the file /admin/change-emailid.php against externally entered SQL statements. An attacker can exploit this...

Apartment Management System updateProfile.php File SQL Injection Vulnerability

Apartment Management System is an apartment management system. Apartment Management System suffers from a SQL injection vulnerability that stems from the lack of validation of an externally entered SQL statement in the parameter userid in the file /ajax/updateProfile.php. An attacker can exploit...

itsourcecode Apartment Management System 安全漏洞

Apartment Management System is an apartment management system. Apartment Management System suffers from a SQL injection vulnerability that stems from the lack of validation of an externally entered SQL statement in the parameter userid in the file /ajax/updateProfile.php. An attacker can exploit...

CVE-2025-30061

In the "utils/Reporter/OpenReportWindow.pl" service, there is an SQL injection vulnerability through the "UserID" parameter...

PT-2025-35219

Name of the Vulnerable Software and Affected Versions: shafhasan chatbox versions prior to 156a39cde62f78532c3265a70eda12c70907e56f Description: A vulnerability exists in shafhasan chatbox due to SQL injection. The issue is located in the /chat.php file and affects an unknown function. Manipulati...

Chatbox 安全漏洞

Chatbox is a chat software by the individual developer Shafqat Hasan. Chatbox has a security vulnerability that stems from SQL injection due to incorrect manipulation of the parameter userid in the file /chat.php...

CGM CLININET SQL Injection Vulnerability (CNVD-2025-19811)

CGM CLININET is a hospital information management system from CGM Germany. CGM CLININET suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the UserID parameter of the OpenReportWindow.pl file. An attacker can exploit this...

CVE-2025-30061

Technical details about CVE-2025-30061 are not publicly available in the provided connected documents. Monitor for updates.

CVE-2025-30060

The CVE-2025-30060 entry describes a SQL injection vulnerability in the ReturnUserUnitsXML.pl service, where the getUserInfo function is exploitable through the UserID parameter. Root cause: unsanitized user input in a SQL query (UserID) leading to unauthorized data access or modification. Impact...

PT-2025-34197 · Mattermost · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost versions 10.5.x through 10.5.8 Mattermost versions 9.11.x through 9.11.17 Description: Mattermost fails to properly validate authorization for team scheme role modifications. This allows Team Admins to demote Team Members to Guests...

PMTicket Project-Management-Software 注入漏洞

PMTicket Project-Management-Software is an agile project management and issue tracking system from PMTicket open source. An injection vulnerability exists in pmTicket Project-Management-Software, which stems from SQL injection due to incorrect manipulation of the parameter userid of the function...

CVE-2025-6874

A vulnerability, which was classified as critical, was found in SourceCodester Best Salon Management System 1.0. Affected is an unknown function of the file /panel/addsubscribe.php. The manipulation of the argument userid/planid leads to sql injection. It is possible to launch the attack remotely...

CVE-2025-6160

A vulnerability, which was classified as critical, has been found in SourceCodester Client Database Management System 1.0. This issue affects some unknown processing of the file /usercustomercreateorder.php. The manipulation of the argument userid leads to sql injection. The attack may be initiat...

SourceCodester Client Database Management System 注入漏洞

SourceCodester Client Database Management System is SourceCodester open source a client database management system . An injection vulnerability exists in SourceCodester Client Database Management System version 1.0, which originates from SQL injection due to incorrect manipulation of the paramete...

Code-Projects Traffic Offense Reporting System 安全漏洞

Traffic Offense Reporting System is a traffic violation reporting system. Traffic Offense Reporting System has a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the saveuser.php file parameters...

PHPGurukul Online Birth Certificate System 安全漏洞

Online Birth Certificate System is an online birth certificate system. Online Birth Certificate System has a SQL injection vulnerability that originates from an incorrect manipulation of the parameter userid in the file /admin/users-applications.php resulting in SQL injection. No details of the...

CVE-2024-4890

A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process. The vulnerability arises due to the improper handling of the 'userid' parameter in the raw SQL query used for deleting users. An attacker can exploit this vulnerability b...