CVE-2025-63447

Water Management System v1.0 is vulnerable to Cross Site Scripting XSS in /addcustomer.php...

CVE-2025-63446

Water Management System v1.0 is vulnerable to Cross Site Scripting XSS in /addvendor.php...

CVE-2025-12261 CodeAstro Gym Management System remove-announcement.php sql injection

A vulnerability was found in CodeAstro Gym Management System 1.0. This affects an unknown function of the file /admin/actions/remove-announcement.php. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been made public and...

projectworlds Expense Management System 代码注入漏洞

Projectworlds Expense Management System is an open source expense management system from Projectworlds. A code injection vulnerability exists in version 1.0 of the projectworlds Expense Management System, which stems from an incorrect manipulation of an unknown function in the file...

SourceCodester Point of Sales SQL注入漏洞

SourceCodester Point of Sales is an open source point of sale system from SourceCodester. A SQL injection vulnerability exists in SourceCodester Point of Sales version 1.0, which stems from incorrect manipulation of the parameter ID in the file /deletecategory.php, which could lead to a SQL...

PT-2025-43886

Name of the Vulnerable Software and Affected Versions projectworlds Expense Management System version 1.0 Description A security issue exists in the Expense Categories Page component of projectworlds Expense Management System. The issue involves an unknown function within the /public/admin/expens...

CVE-2025-57240

Cross site scripting XSS vulnerability in 17gz International Student service system 1.0 allows attackers to execute arbitrary code via the registration step...

CVE-2025-11878

The ST Categories Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's st-categories shortcode in versions less than, or equal to, 1.0.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2025-60246

CVE-2025-60246 applies to the WordPress plugin Simple Finance Calculator (author: weissmike) in versions <= 1.0. It is described as an improper input neutralization leading to a Reflected Cross-Site Scripting (XSS) vulnerability during web page generation. Affected scope is limited to the plug...

CVE-2025-62007 WordPress Voice Feedback plugin <= 1.0.3 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in bPlugins Voice Feedback voice-feedback allows Privilege Escalation.This issue affects Voice Feedback: from n/a through = 1.0.3...

CVE-2025-60246 WordPress Simple Finance Calculator plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in weissmike Simple Finance Calculator simple-finance-calculator allows Reflected XSS.This issue affects Simple Finance Calculator: from n/a through = 1.0...

CVE-2025-52751

CVE-2025-52751 affects the WordPress Slide Puzzle plugin (versions ≤ 1.0.0). The issue is a Reflected XSS caused by improper input neutralization during web page generation in the slide-puzzle component. Exploitation could allow an attacker to inject and execute scripts in a victim’s browser when...

CVE-2025-11810 Print Button Shortcode <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Print Button Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'print-button' shortcode in all versions up to, and including, 1.0.1. This is due to insufficient input sanitization and output escaping on the 'target' attribute. This makes it possible for...

NETLINK HG322G 安全漏洞

The NETLINK HG322G is a fiber optic network terminal from NETLINK. A security vulnerability exists in the NETLINK HG322G version V1.0.00, which stems from improper authentication of the web-based management interface, which could allow a remote, unauthenticated attacker to elevate privileges and...

CVE-2025-60280

CVE-2025-60280 affects Bang Resto v1.0 and is described as a Cross-Site Scripting (XSS) vulnerability caused by insufficient input sanitization or output encoding. The vulnerability could allow attacker-controlled input to be rendered in the browser, enabling potential theft of session cookies, u...

Restaurant-Management-System-DBMS-project 安全漏洞

Restaurant-Management-System-DBMS-project is a restaurant management system by Rajvi Patel, an individual developer. A security vulnerability exists in Restaurant-Management-System-DBMS-project version 1.0, which stems from improper handling of SQL query strings in login.php, which can lead to SQ...

CVE-2025-10299

The WPBifröst – Instant Passwordless Temporary Login Links plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the ctlcreatelink AJAX action in all versions up to, and including, 1.0.7. This makes it possible for authenticated attackers, with...

Exploit for CVE-2025-61456

🛡️ CVE Disclosure: CVE-2025-61456 — Reflected XSS in E-commerc...

CampCodes Online Beauty Parlor Management System SQL注入漏洞

CampCodes Online Beauty Parlor Management System is an online beauty parlor management system from CampCodes Philippines. A SQL injection vulnerability exists in CampCodes Online Beauty Parlor Management System version 1.0, which stems from an incorrect manipulation of the parameter name in the...

CampCodes Online Apartment Visitor Management SQL注入漏洞

CampCodes Online Apartment Visitor Management is an online apartment visitor management system from CampCodes Philippines. A SQL injection vulnerability exists in CampCodes Online Apartment Visitor Management version 1.0, which stems from the incorrect manipulation of the parameter email in the...