CVE-2025-0672

An authentication bypass vulnerability exists in multiple WSO2 products when FIDO authentication is enabled. When a user account is deleted, the system does not automatically remove associated FIDO registration data. If a new user account is later created using the same username, the system may...

CVE-2025-10857

A security flaw has been discovered in Campcodes Point of Sale System POS 1.0. Affected by this issue is some unknown functionality of the file /login.php. Performing manipulation of the argument Username results in sql injection. The attack is possible to be carried out remotely. The exploit has...

CVE-2025-10857

A security flaw has been discovered in Campcodes Point of Sale System POS 1.0. Affected by this issue is some unknown functionality of the file /login.php. Performing manipulation of the argument Username results in sql injection. The attack is possible to be carried out remotely. The exploit has...

CVE-2025-10851

A security flaw has been discovered in Campcodes Gym Management System 1.0. Impacted is an unknown function of the file /ajax.php?action=login. Performing manipulation of the argument Username results in sql injection. It is possible to initiate the attack remotely. The exploit has been released ...

CVE-2025-10851

A security flaw has been discovered in Campcodes Gym Management System 1.0. Impacted is an unknown function of the file /ajax.php?action=login. Performing manipulation of the argument Username results in sql injection. It is possible to initiate the attack remotely. The exploit has been released ...

CVE-2025-10851 Campcodes Gym Management System ajax.php sql injection

A security flaw has been discovered in Campcodes Gym Management System 1.0. Impacted is an unknown function of the file /ajax.php?action=login. Performing manipulation of the argument Username results in sql injection. It is possible to initiate the attack remotely. The exploit has been released ...

CVE-2025-10851

Campcodes Gym Management System 1.0 contains a SQL injection in the /ajax.php?action=login endpoint caused by manipulating the Username parameter. This is exploitable remotely, and multiple sources confirm that an exploit has been released publicly. The CVE-2025-10851 records impact to unknown fu...

PT-2025-39152

Name of the Vulnerable Software and Affected Versions Campcodes Gym Management System version 1.0 Description A security flaw exists in Campcodes Gym Management System version 1.0. The issue involves a SQL injection that can be triggered by manipulating the Username argument in the...

CampCodes Point of Sale System POS SQL注入漏洞

CampCodes Point of Sale System POS is a point of sale system from CampCodes Philippines. A SQL injection vulnerability exists in CampCodes Point of Sale System POS version 1.0, which stems from an incorrect manipulation of the parameter Username in the file /login.php, which could lead to a SQL...

PT-2025-39184

Name of the Vulnerable Software and Affected Versions WSO2 products affected versions not specified Description An authentication bypass can occur in WSO2 products when FIDO authentication is enabled. Deletion of a user account does not automatically remove associated FIDO registration data. If a...

CampCodes Gym Management System SQL注入漏洞

CampCodes Gym Management System is a gym management system from CampCodes Philippines. A SQL injection vulnerability exists in CampCodes Gym Management System version 1.0, which stems from an incorrect manipulation of the parameter Username in the file /ajax.php, which could lead to a SQL injecti...

PT-2025-39156

Name of the Vulnerable Software and Affected Versions Campcodes Point of Sale System POS version 1.0 Description A security flaw exists in Campcodes Point of Sale System POS 1.0, related to unknown functionality within the /login.php file. Manipulation of the Username argument can lead to a SQL...

CVE-2025-57434

Creacast Creabox Manager contains a critical authentication flaw that allows an attacker to bypass login validation. The system grants access when the username is creabox and the password begins with the string creacast, regardless of what follows...

CVE-2025-57434

Creacast Creabox Manager contains a critical authentication flaw that allows an attacker to bypass login validation. The system grants access when the username is creabox and the password begins with the string creacast, regardless of what follows...

PT-2025-38750

Name of the Vulnerable Software and Affected Versions Creacast Creabox Manager affected versions not specified Description The software exhibits a critical authentication flaw that permits bypassing login validation. Access is granted when the username is set to creabox and the password starts wi...

CVE-2025-57434

The vulnerability CVE-2025-57434 affects Creacast Creabox Manager. An authentication bypass exists: if the username is creabox and the password begins with creacast, access is granted regardless of the remaining password. This is described consistently across multiple sources. The CVSS 3.1 vector...

CVE-2025-57434

Creacast Creabox Manager contains a critical authentication flaw that allows an attacker to bypass login validation. The system grants access when the username is creabox and the password begins with the string creacast, regardless of what follows...

CVE-2025-57434

Creacast Creabox Manager contains a critical authentication flaw that allows an attacker to bypass login validation. The system grants access when the username is creabox and the password begins with the string creacast, regardless of what follows...

CVE-2025-59715

SMSEagle before 6.11 allows reflected XSS via a username or contact phone number...

CVE-2025-59424

LinkAce is a self-hosted archive to collect website links. Prior to 2.3.1, a Stored Cross-Site Scripting XSS vulnerability has been identified on the /system/audit page. The application fails to properly sanitize the username field before it is rendered in the audit log. An authenticated attacker...