CVE-2025-7809 StreamWeasels Twitch Integration <= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting

The StreamWeasels Twitch Integration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'data-uuid' attribute in all versions up to, and including, 1.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

CVE-2025-51044

phpgurukul Nipah virus NiV Testing Management System 1.0 contains a SQL injection vulnerability in the /new-user-testing.php file, due to insufficient validation of user input for the " govtissuedid" parameter...

CVE-2025-51044

CVE-2025-51044 concerns the phpgurukul Nipah virus (NiV) Testing Management System 1.0. The vulnerability is a SQL injection in the web path “/new-user-testing.php” triggered by insufficient validation of the input parameter “govtissuedid.” The issue is evidenced by multiple connected sources, wh...

CVE-2025-51045

Summary : CVE-2025-51045 affects Phpgurukul Pre-School Enrollment System 1.0. The vulnerability is a SQL injection in the /admin/password-recovery.php endpoint caused by insufficient validation of the username parameter. The CVSS v3.1 base score is 6.5 (Medium) with network attack vector, low com...

CVE-2025-51045

Phpgurukul Pre-School Enrollment System 1.0 contains a SQL injection vulnerability in the /admin/password-recovery.php file. This vulnerability is attributed to the insufficient validation of user input for the username parameter...

CVE-2025-51045

Phpgurukul Pre-School Enrollment System 1.0 contains a SQL injection vulnerability in the /admin/password-recovery.php file. This vulnerability is attributed to the insufficient validation of user input for the username parameter...

CVE-2025-51970

CVE-2025-51970 affects PuneethReddyHC Online Shopping System Advanced v1.0 with an SQL Injection in the action.php endpoint, caused by improper sanitization of the keyword POST parameter. Exploitation details in connected documents show PoCs and tooling (e.g., sqlmap usage) that illustrate how an...

CVE-2025-51044

phpgurukul Nipah virus NiV Testing Management System 1.0 contains a SQL injection vulnerability in the /new-user-testing.php file, due to insufficient validation of user input for the " govtissuedid" parameter...

PT-2025-31218 · Unknown · Puneethreddyhc Online-Shopping-System-Advanced

Name of the Vulnerable Software and Affected Versions: PuneethReddyHC Online Shopping System Advanced version 1.0 Description: A SQL Injection issue exists due to improper sanitization of user-supplied input in the keyword POST parameter of the /action.php API endpoint. Recommendations: Apply inp...

CVE-2025-29534

An authenticated remote code execution vulnerability in PowerStick Wave Dual-Band Wifi Extender V1.0 allows an attacker with valid credentials to execute arbitrary commands with root privileges. The issue stems from insufficient sanitization of user-supplied input in the /cgi-bin/cgivista.cgi...

CVE-2025-38483 comedi: das16m1: Fix bit shift out of bounds

In the Linux kernel, the following vulnerability has been resolved: comedi: das16m1: Fix bit shift out of bounds When checking for a supported IRQ number, the following test is used: / only irqs 2, 3, 4, 5, 6, 7, 10, 11, 12, 14, and 15 are valid / if 1 options1 & 0xdcfc However, it-optionsi is an...

CVE-2025-6987

The Advanced iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'advancediframe' shortcode in all versions up to, and including, 2025.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-29534

An authenticated remote code execution vulnerability in PowerStick Wave Dual-Band Wifi Extender V1.0 allows an attacker with valid credentials to execute arbitrary commands with root privileges. The issue stems from insufficient sanitization of user-supplied input in the /cgi-bin/cgivista.cgi...

PT-2025-31104 · Meddream · Meddream Pacs Premium

Name of the Vulnerable Software and Affected Versions: meddream MedDream PACS Premium version 7.3.5.860 Description: A reflected cross-site scripting xss vulnerability exists in the radiationDoseReport.php functionality. A specially crafted URL can lead to arbitrary javascript code execution. An...

Cisco Identity Services Engine Injection Vulnerability

Cisco Identity Services Engine contains an injection vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC due to insufficient validation of user-supplied input allowing an attacker to exploit this vulnerability by submitting a crafted API request. Successful exploitation could allow an...

CVE-2025-29534

The CVE-2025-29534 entry describes an authenticated remote code execution in PowerStick Wave Dual-Band Wifi Extender V1.0. The vulnerability is due to insufficient sanitization of user-supplied input in the /cgi-bin/cgi_vista.cgi executable, which is passed to a system-level function call. This a...

PT-2025-30909 · Unknown · Codeigniter4

Name of the Vulnerable Software and Affected Versions: CodeIgniter4 version 4.6.0 Description: A stored cross-site scripting XSS vulnerability exists in CodeIgniter4. Attackers can execute arbitrary web scripts or HTML by injecting a crafted payload into the debugbar time parameter...

PT-2025-30815 · Unknown · Institute-Of-Current-Students

Name of the Vulnerable Software and Affected Versions: Institute-of-Current-Students version 1.0 Description: A reflected cross-site scripting XSS issue exists due to improper sanitization of user input. Specifically, the application fails to sanitize the email parameter before reflecting it in t...

CVE-2025-51411

A reflected cross-site scripting XSS vulnerability exists in Institute-of-Current-Students v1.0 via the email parameter in the /postquerypublic endpoint. The application fails to properly sanitize user input before reflecting it in the HTML response. This allows unauthenticated attackers to injec...

CVE-2025-43484

A potential reflected cross-site scripting vulnerability has been identified in the Poly Clariti Manager for versions prior to 10.12.1. The website does not validate or sanitize the user input before rendering it in the response. HP has addressed the issue in the latest software update...