CVE-2025-52390

Saurus CMS Community Edition since commit d886e5b0 2010-04-23 is vulnerable to a SQL Injection vulnerability in the prepareSearchQuery method in FulltextSearch.class.php. The application directly concatenates user-supplied input $searchword into SQL queries without sanitization, allowing attacker...

Cross-site Scripting (XSS)

Overview panel is a The powerful data exploration & web app framework for Python. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to missing HTML escaping in authentication templates. The errormessage variable in the basiclogin.html template and the error/errormsg...

CVE-2025-52390

CVE-2025-52390 – Saurus CMS Community Edition is affected since commit d886e5b0 (2010-04-23). The vulnerability is a SQL Injection in the FulltextSearch.class.php -> prepareSearchQuery() where user input ($search_word) is directly concatenated into SQL queries without sanitization. This can al...

CVE-2025-52390

Saurus CMS Community Edition since commit d886e5b0 2010-04-23 is vulnerable to a SQL Injection vulnerability in the prepareSearchQuery method in FulltextSearch.class.php. The application directly concatenates user-supplied input $searchword into SQL queries without sanitization, allowing attacker...

PT-2025-31648 · Unknown · Saurus Cms Community Edition

Name of the Vulnerable Software and Affected Versions: Saurus CMS Community Edition versions since commit d886e5b0 2010-04-23 Description: Saurus CMS Community Edition is susceptible to a SQL Injection issue due to the direct concatenation of user-supplied input $search word into SQL queries with...

PT-2025-31659 · Unknown · Institute-Of-Current-Students

Name of the Vulnerable Software and Affected Versions: Institute-of-Current-Students version 1.0 Description: A stored Cross-Site Scripting XSS vulnerability exists in the qureydetails.php page. The input fields for Query and Answer do not properly sanitize user input, allowing authenticated user...

PT-2025-31692 · Linksys · Linksys Routers +1

Name of the Vulnerable Software and Affected Versions: Linksys router versions v2.0.03 Description: An authenticated OS command injection vulnerability exists in various Linksys router models tested on WRT160Nv2. The web interface does not properly sanitize user-supplied input passed to the ping...

CVE-2025-52390

Saurus CMS Community Edition since commit d886e5b0 2010-04-23 is vulnerable to a SQL Injection vulnerability in the prepareSearchQuery method in FulltextSearch.class.php. The application directly concatenates user-supplied input $searchword into SQL queries without sanitization, allowing attacker...

CVE-2025-40980

A Stored Cross Site Scripting vulnerability has been found in UltimatePOS by UltimateFosters. This vulnerability is due to the lack of proper validation of user inputs via ‘/products//edit’, affecting to ‘name’ parameter via POST. The vulnerability could allow a remote attacker to send a speciall...

CVE-2025-40980

Summary: CVE-2025-40980 is a Stored XSS in UltimatePOS by UltimateFosters. An unsanitized value in the name field of POST requests to /products//edit can be reflected in pages (e.g., Reports/Activity Log), enabling an authenticated attacker to execute arbitrary JavaScript in an admin/user browser...

CVE-2025-40980 ddd

A Stored Cross Site Scripting vulnerability has been found in UltimatePOS by UltimateFosters. This vulnerability is due to the lack of proper validation of user inputs via ‘/products//edit’, affecting to ‘name’ parameter via POST. The vulnerability could allow a remote attacker to send a speciall...

CVE-2025-54752

Multiple versions of PowerCMS improperly neutralize formula elements in a CSV file. If a product user creates a malformed entry and a victim user downloads it as a CSV file and opens it in the user's environment, the embedded code may be executed...

CVE-2025-7810

The StreamWeasels Kick Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'data-uuid' attribute in all versions up to, and including, 1.1.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...

CVE-2025-7811

The StreamWeasels YouTube Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'data-uuid' attribute in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2025-51045

Phpgurukul Pre-School Enrollment System 1.0 contains a SQL injection vulnerability in the /admin/password-recovery.php file. This vulnerability is attributed to the insufficient validation of user input for the username parameter...

CVE-2025-52203

A stored cross-site scripting XSS vulnerability exists in DevaslanPHP project-management v1.2.4. The vulnerability resides in the Ticket Name field, which fails to properly sanitize user-supplied input. An authenticated attacker can inject malicious JavaScript payloads into this field, which are...

PT-2025-31500 · Unknown · Ultimatepos

Name of the Vulnerable Software and Affected Versions: UltimatePOS affected versions not specified Description: A Stored Cross Site Scripting vulnerability exists in UltimatePOS due to inadequate validation of user inputs. The vulnerability affects the name parameter via a POST request to the...

PT-2025-31545 · Undefined · Undefined

A path traversal vulnerability exists in A10 Networks AX Loadbalancer versions 2.6.1-GR1-P5, 2.7.0, and earlier. The vulnerability resides in the handling of the filename parameter in the /xml/downloads endpoint, which fails to properly sanitize user input. An unauthenticated attacker can exploit...

CVE-2025-51569

A cross-site scripting XSS vulnerability exists in the LB-Link BL-CPE300M 01.01.02P42U1406 router's web interface. The /goform/goformgetcmdprocess endpoint fails to sanitize user input in the cmd parameter before reflecting it into a text/html response. This allows unauthenticated attackers to...

CVE-2025-52203

A stored cross-site scripting XSS vulnerability exists in DevaslanPHP project-management v1.2.4. The vulnerability resides in the Ticket Name field, which fails to properly sanitize user-supplied input. An authenticated attacker can inject malicious JavaScript payloads into this field, which are...