15982 matches found
Itsourcecode Employee Management System injection vulnerability
itsourcecode Employee Management System is itsourcecode open source employee management system. An injection vulnerability exists in itsourcecode Employee Management System version 1.0, which originates from a SQL injection due to incorrect manipulation of the parameter Username in the file...
Regular Expression Denial of Service (ReDoS)
Overview calibreweb is a Web app for browsing, reading and downloading eBooks stored in a Calibre database. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the stripwhitespaces function in cps/stringhelper.py file. An attacker can cause the...
CVE-2025-6998
ReDoS in stripwhitespaces function in cps/stringhelper.py in Calibre Web and Autocaliweb allows unauthenticated remote attackers to cause denial of service via specially crafted username parameter that triggers catastrophic backtracking during login. This issue affects Calibre Web: 0.6.24...
CVE-2025-6998 Calibre Web 0.6.24 & Autocaliweb 0.7.0 - ReDoS
ReDoS in stripwhitespaces function in cps/stringhelper.py in Calibre Web and Autocaliweb allows unauthenticated remote attackers to cause denial of service via specially crafted username parameter that triggers catastrophic backtracking during login. This issue affects Calibre Web: 0.6.24...
CVE-2025-6998 Calibre Web 0.6.24 & Autocaliweb 0.7.0 - ReDoS
ReDoS in stripwhitespaces function in cps/stringhelper.py in Calibre Web and Autocaliweb allows unauthenticated remote attackers to cause denial of service via specially crafted username parameter that triggers catastrophic backtracking during login. This issue affects Calibre Web: 0.6.24...
firefox: thunderbird: Incorrect URL stripping in CSP reports
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: The username:password part is incorrectly stripped from URLs in CSP reports, potentially leaking HTTP Basic Authentication credentials...
Tenda FH451 Router Code Execution
The vulnerability of the fromPptpUserAdd function in the Tenda FH451 router’s microprogramming software is related to the issue where the operation exits the buffer boundaries into memory when processing the username parameter. Exploiting this vulnerability allows a remote attacker to execute...
Tenda FH1202 Router fromPptpUserAdd() Code Execution
The vulnerability of the fromPptpUserAdd function in the /goform/PPTPDClient file of the Tenda FH1202 router microprogramming system is related to the issue where the operation exits beyond the buffer in memory when processing the username parameter. Exploiting this vulnerability allows a remote...
Calibre Web -- two vulnerabilities
The Calibre Web Team reports: ReDoS in stripwhitespaces function in cps/stringhelper.py in Calibre Web and Autocaliweb allows unauthenticated remote attackers to cause denial of service via specially crafted username parameter that triggers catastrophic backtracking during login.This issue affect...
CVE-2025-51396
A stored cross-site scripting XSS vulnerability in Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Telegram Bot Username parameter...
Online Appointment Booking System adddoctor.php File SQL Injection Vulnerability
Online Appointment Booking System is an online appointment booking system. Online Appointment Booking System has a SQL injection vulnerability that originates from improper handling of the parameter Username in the file /admin/adddoctor.php, which can be exploited by an attacker to obtain sensiti...
DEBIAN-CVE-2025-8031
The username:password part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1...
UBUNTU-CVE-2025-8031
The username:password part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials. This vulnerability affects Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1...
CVE-2025-7950
A vulnerability was found in code-projects Public Chat Room 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument Username leads to sql injection. The attack may be launched remotely. The exploit has been...
Code-Projects Public Chat Room Injection Vulnerability
Code-Projects Public Chat Room is a Code-Projects open source public chat room software. Code-Projects Public Chat Room version 1.0 suffers from an injection vulnerability that stems from a SQL injection attack due to a misuse of the parameter Username in the file /login.php...
LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via Telegram Bot Username
Exploit Title: LiveHelperChat 4.61 - Stored Cross Site Scripting XSS via Telegram Bot Username Date: 09/06/2025 Exploit Author: Manojkumar J TheWhiteEvil Linkedin: https://www.linkedin.com/in/manojkumar-j-7ba35b202/ Vendor Homepage: https://github.com/LiveHelperChat/livehelperchat/ Software Link:...
CVE-2025-7950: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in code-projects Public Chat Room 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /login.php. The manipulation of the argument Username leads to sql injection. The attack may be launched remotely. The exploit has been...
CVE-2025-51396
A stored cross-site scripting XSS vulnerability in Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Telegram Bot Username parameter...
CVE-2025-51396
A stored cross-site scripting XSS vulnerability in Live Helper Chat v4.60 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Telegram Bot Username parameter...
Library System add-teacher.php File SQL Injection Vulnerability
Library System is a library system. The Library System suffers from a SQL injection vulnerability that originates from the lack of validation of an externally entered SQL statement in the parameter Username in the file /add-teacher.php. An attacker can exploit this vulnerability to execute illega...