2961 matches found
PT-2026-3116
Name of the Vulnerable Software and Affected Versions Phpgurukul Cyber Cafe Management System version 1.0 Description The application does not properly validate user-supplied input in the username parameter. This occurs within the user management module, specifically at the /add-users.php API...
CVE-2025-70890
A stored cross-site scripting (XSS) vulnerability exists in Cyber Cafe Management System v1.0 . An authenticated attacker can inject arbitrary JavaScript code into the username parameter via the add-users.php endpoint. The malicious payload is stored and subsequently executed in the victim's brow...
CVE-2025-70892: Improper Neutralization of Special Elements used in an SQL Command
Phpgurukul Cyber Cafe Management System v1.0 contains a SQL Injection vulnerability in the user management module. The application fails to properly validate user-supplied input in the username parameter of the add-users.php endpoint...
CVE-2025-70890: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting XSS vulnerability exists in Cyber Cafe Management System v1.0. An authenticated attacker can inject arbitrary JavaScript code into the username parameter via the add-users.php endpoint. The injected payload is stored and executed in the victim s browser when the...
CVE-2025-70892
The Phpgurukul Cyber Cafe Management System v1.0 contains a SQL Injection vulnerability (CWE-89) within its user management module. The root cause is the failure to adequately validate or sanitize user-supplied input in the username parameter at the add-users.php endpoint. This flaw allows an att...
CVE-2025-70892
Phpgurukul Cyber Cafe Management System v1.0 contains a SQL Injection vulnerability in the user management module. The application fails to properly validate user-supplied input in the username parameter of the add-users.php endpoint...
PT-2026-2430
Name of the Vulnerable Software and Affected Versions WorkOrder CMS version 0.1.0 Description WorkOrder CMS version 0.1.0 has a SQL injection issue. An unauthenticated attacker can bypass login by manipulating the username and password parameters. Attackers can inject malicious SQL queries, such ...
CVE-2023-54340: Improper Neutralization of Special Elements used in an SQL Command
WorkOrder CMS 0.1.0 contains a SQL injection vulnerability that allows unauthenticated attackers to bypass login by manipulating username and password parameters. Attackers can inject malicious SQL queries using techniques like OR '1'='1' and stacked queries to access database information or...
CVE-2025-15494
A vulnerability has been found in RainyGao DocSys up to 2.02.37. This affects an unknown function of the file com/DocSystem/mapping/UserMapper.xml. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public...
CVE-2025-15494
A vulnerability has been found in RainyGao DocSys up to 2.02.37. This affects an unknown function of the file com/DocSystem/mapping/UserMapper.xml. The manipulation of the argument Username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public...
CVE-2025-15494
RainyGao DocSys
CVE-2018-18622
An issue was discovered in Waimai Super Cms 20150505. There is XSS via the index.php?m=public=doregister username parameter...
CVE-2021-41825
Verint Workforce Optimization WFO 15.2.5.1033 allows HTML injection via the /wfo/control/signin username parameter...
CVE-2021-27314
SQL injection in admin.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL queries via username parameter at login page...
CVE-2021-31643
An XSS vulnerability exists in several IoT devices from CHIYU Technology, including SEMAC, Biosense, BF-630, BF-631, and Webpass due to a lack of sanitization on the component if.cgi - username parameter...
CVE-2022-38488
logrocket-oauth2-example through 2020-05-27 allows SQL injection via the /auth/register username parameter...
CVE-2022-38637
Hospital Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the Username and Password parameters on the Login page...
CVE-2022-37149
WAVLINK WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability when operating the file adm.cgi. This vulnerability allows attackers to execute arbitrary commands via the username parameter...
CVE-2026-0701
A vulnerability was identified in code-projects Intern Membership Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /intern/admin/addadmin.php. The manipulation of the argument Username leads to sql injection. The attack is possible to be carried out...