6118 matches found
CVE-2025-64081
SQL injection vulnerability in /php/apipatientschedule.php in SourceCodester Patients Waiting Area Queue Management System v1 allows attackers to execute arbitrary SQL commands via the appointmentID parameter...
CVE-2025-14258
Affected software: itsourcecode Student Management System 1.0. Vulnerability details: SQL injection in the /newsubject.php file via the sub parameter, caused by improper handling of user input. Exploitation can be remote; multiple sources report public disclosure of the exploit. Impact: high pote...
CVE-2025-14245
IdeaCMS up to version 1.8 contains a SQL injection vulnerability in the whereRaw usage of Coupon.php (app/common/logic/index/Coupon.php). The root cause is improper manipulation of the params argument, enabling remote attacker input to influence SQL queries. Multiple security feeds (NVD, Red Hat,...
Code-Projects Currency Exchange System SQL注入漏洞
Currency Exchange System is a currency exchange system. The Currency Exchange System suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the parameter ID of file /edit.php. An attacker can exploit this vulnerability to execute...
SourceCodester Patients Waiting Area Queue Management System SQL注入漏洞
SourceCodester Patients Waiting Area Queue Management System is SourceCodester open source a patient waiting area queue management system. SourceCodester Patients Waiting Area Queue Management System v1 version exists SQL injection vulnerability , the vulnerability stems from /...
CampCodes Retro Basketball Shoes Online Store 安全漏洞
CampCodes Retro Basketball Shoes Online Store is an online store for retro basketball shoes from CampCodes, Inc. A security vulnerability exists in Campcodes Retro Basketball Shoes Online Store version 1.0, which stems from incorrect manipulation of the parameter productimage in the file...
WordPress Thim Elementor Kit plugin <= 1.3.3 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Mdr in WordPress Plugin Thim Elementor Kit versions = 1.3.3...
WordPress PDF Thumbnail Generator plugin <= 1.4 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Nabil Irawan in WordPress Plugin PDF Thumbnail Generator versions = 1.4...
CVE-2025-12720
The g-FFL Cockpit plugin for WordPress is vulnerable to unauthorized modification of data due to IP-based authorization that can be spoofed in the handleenqueueonly function in all versions up to, and including, 1.7.1. This makes it possible for unauthenticated attackers to delete arbitrary...
CVE-2025-13373
Advantech iView versions 5.7.05.7057 and prior do not properly sanitize SNMP v1 trap Port 162 requests, which could allow an attacker to inject SQL commands...
CVE-2025-12154
CVE-2025-12154 (Auto Thumbnailer, WordPress) The vulnerability is an authenticated arbitrary file upload flaw in the Auto Thumbnailer plugin, affecting versions up to 1.0. The uploadThumb() function lacks proper file-type validation, enabling attackers with Contributor+ privileges to upload arbit...
CVE-2025-13860 Easy Jump Links Menus <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
The Easy Jump Links Menus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the htags parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level...
CVE-2025-12128
CVE-2025-12128 concerns the WordPress plugin “Hide Categories Or Products On Shop Page” and affects versions up to and including 1.0.7. The issue is Cross-Site Request Forgery caused by missing or incorrect nonce validation in the save_data_hcps() function. This enables unauthenticated attackers ...
PT-2025-49238
The Trail Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions a...
Advantech WISE-DeviceOn Server 跨站脚本漏洞
Advantech WISE-DeviceOn Server is Advantech's next-generation unified device management solution based on the WISE-DeviceOn platform. Advantech WISE-DeviceOn Server suffers from a cross-site scripting vulnerability that originates from the lack of effective filtering and escaping of user-supplied...
Fedora 42 : python-kdcproxy (2025-068c570cbf)
The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-068c570cbf advisory. - New upstream version 1.1.0 - Use DNS discovery for declared realms only CVE-2025-59088 - Fix DoS vulnerability based on unbounded TCP buffering...
PT-2025-49264
Name of the Vulnerable Software and Affected Versions warehouse management system version 1.2 Description The software has an arbitrary file read issue. The /file/showImageByPath API endpoint does not properly sanitize user-supplied path parameters, potentially allowing an attacker to use directo...
CVE-2025-13373
Advantech iView is affected by a SQL injection vulnerability (CVE-2025-13373) in SNMP v1 trap handling. Affected versions are 5.7.05.7057 and earlier. The root cause is improper sanitization/cleanup of SNMP v1 trap requests received on UDP port 162, which can allow an attacker to inject arbitrary...