537 matches found
Code-Projects Online Examination System SQL Injection Vulnerability
Code-Projects Online Examination System is an open-source online examination system developed by Code-Projects. Version 1.0 of the Code-Projects Online Examination System has a SQL injection vulnerability. This vulnerability arises from incorrect handling of the User parameter in the...
CVE-2026-24138 FOG vulnerable to unauthenticated SSRF via `/fog/service/getversion.php`
FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Versions 1.5.10.1754 and below contain an unauthenticated SSRF vulnerability in getversion.php which can be triggered by providing a user-controlled url parameter. It can be used to fetch both internal websites an...
CVE-2026-24061
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable...
CVE-2021-47801
Vianeos OctoPUS 5 contains a time-based blind SQL injection vulnerability in the 'loginuser' parameter during authentication requests. Attackers can exploit this vulnerability by crafting malicious POST requests with specially constructed SQL payloads that trigger database sleep functions to...
PT-2026-3172
Vianeos OctoPUS 5 contains a time-based blind SQL injection vulnerability in the 'login user' parameter during authentication requests. Attackers can exploit this vulnerability by crafting malicious POST requests with specially constructed SQL payloads that trigger database sleep functions to...
CVE-2023-29210
XWiki Commons are technical libraries common to several other top level XWiki projects. Any user with view rights on commonly accessible documents including the notification preferences macros can execute arbitrary Groovy, Python or Velocity code in XWiki leading to full access to the XWiki...
CVE-2022-27304
Student Grading System v1.0 was discovered to contain a SQL injection vulnerability via the user parameter...
PT-2026-1966
Name of the Vulnerable Software and Affected Versions MediaWiki - ProofreadPage Extension versions 1.39 through 1.45 Description The MediaWiki - ProofreadPage Extension contains a flaw related to improper input neutralization during web page generation, leading to a Cross-Site Scripting XSS issue...
College Notes Uploading System /login.php File SQL Injection Vulnerability
College Notes Uploading System is a college notes uploading system. College Notes Uploading System suffers from a SQL injection vulnerability that originates from the mishandling of the User parameter operation by an unknown handler function in the /login.php file. An attacker can use this...
PT-2025-53769
Name of the Vulnerable Software and Affected Versions College Notes Uploading System version 1.0 Description A weakness exists in the College Notes Uploading System. The issue relates to the processing of the /login.php file. Manipulation of the User argument can lead to SQL injection. The attack...
Student File Management System user_id Parameter SQL Injection Vulnerability
Student File Management System is a student file management system. A SQL injection vulnerability exists in Student File Management System, which originates from the lack of validation of an externally entered SQL statement in the parameter userid in the file /admin/updateuser.php. An attacker ca...
CVE-2025-14586
A vulnerability was determined in TOTOLINK X5000R 9.1.0cu.2089B20211224. Affected by this issue is the function snprintf of the file /cgi-bin/cstecgi.cgi?action=exportOvpn=user. This manipulation of the argument User causes os command injection. Remote exploitation of the attack is possible. The...
EUVD-2025-203237
A vulnerability was determined in TOTOLINK X5000R 9.1.0cu.2089B20211224. Affected by this issue is the function snprintf of the file /cgi-bin/cstecgi.cgi?action=exportOvpn&type=user. This manipulation of the argument User causes os command injection. Remote exploitation of the attack is possible...
PT-2025-51091
Name of the Vulnerable Software and Affected Versions TOTOLINK X5000R version 9.1.0cu.2089 B20211224 Description A flaw exists in TOTOLINK X5000R that allows for operating system command injection. This occurs due to the manipulation of the User argument within the snprintf function located in th...
CVE-2025-64126 Zenitel TCIV-3+ OS Command Injection
An OS command injection vulnerability exists due to improper input validation. The application accepts a parameter directly from user input without verifying it is a valid IP address or filtering potentially malicious characters. This could allow an unauthenticated attacker to inject arbitrary...
CVE-2025-22170
Jira Align is vulnerable to an authorization issue. A low-privilege user without sufficient privileges to perform an action could if they included a particular state-related parameter of a user with sufficient privileges to perform the action...
CVE-2025-11477
A security flaw has been discovered in SourceCodester Wedding Reservation Management System 1.0. This vulnerability affects unknown code of the file /global.php. The manipulation of the argument User results in sql injection. The attack may be launched remotely. The exploit has been released to t...
CVE-2025-11477 SourceCodester Wedding Reservation Management System global.php sql injection
A security flaw has been discovered in SourceCodester Wedding Reservation Management System 1.0. This vulnerability affects unknown code of the file /global.php. The manipulation of the argument User results in sql injection. The attack may be launched remotely. The exploit has been released to t...
SourceCodester Wedding Reservation Management System SQL注入漏洞
SourceCodester Wedding Reservation Management System is a SourceCodester open source wedding reservation management system. A SQL injection vulnerability exists in SourceCodester Wedding Reservation Management System version 1.0, which stems from an incorrect manipulation of the parameter User in...