EUVD-2025-203109

A security vulnerability has been detected in haxxorsid Stock-Management-System up to fbbbf213e9c93b87183a3891f77e3cc7095f22b0. This impacts an unknown function of the file model/User.php. The manipulation of the argument employeeid/id/admin leads to sql injection. The attack can be initiated...

CVE-2025-14568

A security vulnerability has been detected in haxxorsid Stock-Management-System up to fbbbf213e9c93b87183a3891f77e3cc7095f22b0. This impacts an unknown function of the file model/User.php. The manipulation of the argument employeeid/id/admin leads to sql injection. The attack can be initiated...

Stock-Management-System SQL injection vulnerability

Stock-Management-System is an inventory management system by Mr Erick Personal Developer. Stock-Management-System version fbbbf213e9c93b87183a3891f77e3cc7095f22b0 has a SQL injection vulnerability that stems from incorrect manipulation of the parameter employeeid/id/admin in the file...

EUVD-2021-0934

Malware in sbrugna...

EUVD-2018-13062

Malware in sbrugna...

CVE-2025-56161

YOSHOP 2.0 allows unauthenticated information disclosure via comment-list API endpoints in the Goods module. The Comment model eagerly loads the related User model without field filtering; because User.php defines no $hidden or $visible attributes, sensitive fields bcrypt password hash, mobile...

CVE-2023-23015

Cross Site Scripting XSS vulnerability in Kalkun 0.8.0 via username input in file Usermodel.php...

CVE-2018-20508

CrashFix 1.0.4 has SQL Injection via the Userstatus parameter. This is related to actionIndex in UserController.php, and the protected\models\User.php search function...

Vaales Technologies V_QRS SQL Injection Vulnerability

Vaales Technologies VQRS is a digital business card solution from Vaales Technologies, India. A SQL injection vulnerability exists in Vaales Technologies VQRS version v.2024-01-17, which originates from a vulnerability that allows remote attackers to obtain sensitive information via the...

PT-2024-20354 · Vaales Technologies · V Qrs

Name of the Vulnerable Software and Affected Versions: Vaales Technologies V QRS version 2024-01-17 Description: The issue allows a remote attacker to obtain sensitive information via the Models/UserModel.php component. This is achieved through a SQL injection vulnerability. Recommendations: For...

Mastodon security vulnerabilities

Mastodon is an open source social networking server based on ActivityPub. A security vulnerability exists in app/models/user.rb in versions prior to Mastodon 3.5.0, which can be exploited by an attacker to bypass email restrictions...

User (Encrypted) Password Field Being Serialised

Impact Leaking Password field during serialisation of the User model. Password is in the encrypted form but if User model is requested in json or array form the value is printed. Patches Issue has been patched in version 0.3.7-beta and onwards. Workarounds Add the 'password' field to the Users...

GHSA-7FJP-G4M7-FX23 User (Encrypted) Password Field Being Serialised

Impact Leaking Password field during serialisation of the User model. Password is in the encrypted form but if User model is requested in json or array form the value is printed. Patches Issue has been patched in version 0.3.7-beta and onwards. Workarounds Add the 'password' field to the Users...

PT-2021-24392

Name of the Vulnerable Software and Affected Versions: Laravel Core versions prior to 0.3.7-beta Description: The issue involves the leaking of the password field during the serialization of the User model. Although the password is in encrypted form, it can be printed if the User model is request...

Sql injection

OpenSNS v6.1.0 allows SQL Injection via the index.php?s=/ucenter/Config/ uid parameter because of the getNeedQueryData function in Application/Common/Model/UserModel.class.php...

Cross-site Scripting (XSS)

github.com/gogits/gogs is vulnerable to cross-site scripting XSS attacks. The vulnerability exists due to the lack of sanitization in the username field of the user model...

CVE-2016-7788

SQL injection vulnerability in framework/modules/users/models/user.php in Exponent CMS 2.3.9 and earlier allows remote attackers to execute arbitrary SQL commands via the username parameter...

Exponent CMS 'username' Parameter SQL Injection Vulnerability

Exponent CMS is a free, open source PHP-based modular content management system CMS of the U.S. OIC Group of companies. The system supports direct editing in the page, and provides user management, site configuration, content editing and other functions. Exponent CMS...

Private Data Disclosure

Overview Affected versions of express-restify-mongoose are susceptible to an information leakage vulnerability which may allow an attacker to access fields on a model even if those fields are marked as private. Proof of Concept If you have a user model that you want to protect, such as the...

Cicada-known Enterprise Portal system v2. 5. 1 to bypass the patch to continue injection-vulnerability warning-the black bar safety net

/system/module/user/model.php public function update$account / If the user want to change his password. / if$this-post-password1 != false $this-checkPassword; ifdao::isError return false; $password = $this-createPassword$this-post-password1, $account; $this-post-set'password', $password; $user =...