CVE-2026-0546

A vulnerability was determined in code-projects Content Management System 1.0. This impacts an unknown function of the file search.php. This manipulation of the argument Value causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicly disclosed and may ...

CVE-2026-0565

A weakness has been identified in code-projects Content Management System 1.0. This issue affects some unknown processing of the file /admin/delete.php. Executing a manipulation of the argument del can lead to sql injection. The attack can be executed remotely. The exploit has been made available...

CVE-2026-0544

A security flaw has been discovered in itsourcecode School Management System 1.0. This affects an unknown part of the file /student/index.php. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public an...

PT-2026-1114

Name of the Vulnerable Software and Affected Versions code-projects Online Music Site version 1.0 Description A flaw exists in code-projects Online Music Site version 1.0 that allows for SQL injection. The issue is located in the /Frontend/ViewSongs.php file, specifically through manipulation of...

Code-Projects Online Music Site SQL注入漏洞

Code-Projects Online Music Site is an open source online music site by Code-Projects. A SQL injection vulnerability exists in Code-Projects Online Music Site version 1.0, which stems from incorrect manipulation of the parameter ID in the file /Frontend/ViewSongs.php, which could lead to a SQL...

CVE-2025-49342

Cross-Site Request Forgery CSRF vulnerability in merzedes Custom Style custom-style allows Stored XSS.This issue affects Custom Style: from n/a through = 1.0...

CVE-2025-69413

In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the /api/v1/user endpoint returning different responses for failed authentication attempts depending on whether a username exists. An attacker can enumerate valid usernames by analyzing the variations in...

CVE-2015-10145

Gargoyle router management utility versions 1.5.x expose an authenticated OS command execution vulnerability in /utility/run_commands.sh due to improper validation of the commands parameter. An authenticated attacker can execute arbitrary shell commands on the device, potentially leading to full ...

CVE-2025-53235

The CVE-2025-53235 entry concerns the WordPress Easy Social plugin (osuthorpe Easy Social) versions up to 1.3. The vulnerability is a Reflected Cross-Site Scripting (XSS) flaw caused by improper input neutralization during web page generation. Impact is reflected in the ability for an attacker to...

CVE-2025-23707

CVE-2025-23707 is a reflected Cross‑Site Scripting (XSS) vulnerability in the WordPress plugin En Masse . Public details show the flaw affects the plugin version range “from n/a through 1.0” and stem from improper input neutralization during web page generation. Multiple sources (NVD, Red Hat CVE...

CVE-2025-23608 WordPress LIVE TV plugin <= 1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Omar Mohamed Mohamoud LIVE TV live-tv allows Reflected XSS.This issue affects LIVE TV: from n/a through = 1.2...

CVE-2025-62123 WordPress WP Gmail SMTP plugin <= 1.0.7 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in Ink themes WP Gmail SMTP allows Cross Site Request Forgery.This issue affects WP Gmail SMTP: from n/a through 1.0.7...

CVE-2025-15373

CVE-2025-15373 affects EyouCMS up to version 1.7.7. The issue is in the saveRemote function of application/function.php, allowing server-side request forgery. The exploit has been disclosed publicly and may be used, with remoteability indicated. Vendors acknowledge the vulnerability and plan a fi...

PT-2025-54441

Name of the Vulnerable Software and Affected Versions ZhinaTwitterWidget versions through 1.0 Description The software contains a flaw related to improper input handling during web page generation, specifically a Reflected Cross-site Scripting XSS issue. This allows for the injection of malicious...

Cypress CTM-ONE 信任管理问题漏洞

The Cypress CTM-ONE is a wireless LTE gateway from Cypress Canada. A trust management issue vulnerability exists in Cypress CTM-ONE version 1.3.6, which stems from the presence of hard-coded credentials in the Linux distribution that could allow an attacker to gain remote root access...

WordPress Simple Map No Api plugin <= 1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via width Parameter vulnerability discovered by zaim in WordPress Plugin Simple Map No Api versions = 1.9...

WordPress Top Comments plugin <= 1.0 - Admin+ Stored Cross-Site Scripting vulnerability

Admin+ Stored Cross-Site Scripting vulnerability discovered by Steven Pereira aka Cursed, Anjali Kumari aka HexJello & Muktanand Kale aka Muktimantras in WordPress Plugin Top Comments versions = 1.0...

PT-2025-54455

Name of the Vulnerable Software and Affected Versions Gargoyle router management utility versions 1.5.x Description The application does not properly restrict or validate input provided through the commands parameter, leading to authenticated OS command execution. This occurs in the /utility/run...

WordPress Translate This plugin <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via base_lang Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via baselang Parameter vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Translate This gTranslate Shortcode versions = 1.0...