6119 matches found
CVE-2025-4315 CubeWP – All-in-One Dynamic Content Framework <= 1.1.23 - Authenticated (Subscriber+) Privilege Escalation
The CubeWP – All-in-One Dynamic Content Framework plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.23. This is due to the plugin allowing a user to update arbitrary user meta through the updateusermeta function. This makes it possible for...
WordPress Spare theme <= 1.7 - PHP Object Injection Vulnerability
PHP Object Injection Vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Spare versions = 1.7...
Code-Projects School Fees Payment System 注入漏洞
School Fees Payment System is a tuition payment system. The School Fees Payment System suffers from a SQL injection vulnerability that originates from the parameter ID of the /branch.php file not being securely filtered. The vulnerability can be exploited by an attacker to obtain sensitive...
CVE-2025-30948
Cross-Site Request Forgery CSRF vulnerability in Giraphix Creative Layouts for Elementor layouts-for-elementor allows Cross Site Request Forgery.This issue affects Layouts for Elementor: from n/a through = 1.11...
CVE-2025-30942
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in OTWthemes Post Custom Templates Lite post-custom-templates-lite allows Stored XSS.This issue affects Post Custom Templates Lite: from n/a through = 1.14...
CVE-2025-30990 WordPress ThemeHunk plugin <= 1.2.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in ThemeHunk ThemeHunk themehunk-megamenu-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ThemeHunk: from n/a through = 1.2.0...
Code-Projects Patient Record Management System 注入漏洞
Code-Projects Patient Record Management System is a Code-Projects open source patient record management system. Code-Projects Patient Record Management System version 1.0 suffers from an injection vulnerability, which stems from an incorrect manipulation of the parameter itrno in the file...
Code-Projects Traffic Offense Reporting System 安全漏洞
Traffic Offense Reporting System is a traffic violation reporting system. The Traffic Offense Reporting System suffers from a cross-site request forgery vulnerability that arises from a web application that does not adequately validate that a request is coming from a trusted user. An attacker cou...
SourceCodester Student Result Management System 代码注入漏洞
SourceCodester Student Result Management System is a SourceCodester open source student result management system. A code injection vulnerability exists in SourceCodester Student Result Management System version 1.0, which is caused by incorrect manipulation of the file...
PT-2025-24002 · Sourcecodester · Sourcecodester Open Source Clinic Management System
Name of the Vulnerable Software and Affected Versions: SourceCodester Open Source Clinic Management System version 1.0 Description: A critical issue has been found in the system, affecting an unknown functionality of the file /appointment.php. The manipulation of the patient argument leads to SQL...
Code-Projects Patient Record Management System 注入漏洞
Patient Record Management System is a medical record management system. Patient Record Management System suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the parameter itrno/compid in the file /birthing.php. An attacker can...
SourceCodester Student Result Management System 安全漏洞
SourceCodester Student Result Management System is a SourceCodester open source student result management system. A security vulnerability exists in SourceCodester Student Result Management System version 1.0, which results from cross-site scripting due to incorrect manipulation of the file...
Code-Projects Laundry System 代码注入漏洞
Laundry System is a laundry system. Laundry System suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameter Customer in the file /data/editlaundry.php, which can be exploited by an attacker to execute...
Code-Projects Real Estate Property Management System 注入漏洞
Code-Projects Real Estate Property Management System is a Code-Projects open source real estate property management system. Code-Projects Real Estate Property Management System version 1.0 has an injection vulnerability, the vulnerability stems from the wrong operation of the parameter txtUserNam...
Code-Projects Patient Record Management System 注入漏洞
Patient Record Management System is a medical record management system. Patient Record Management System suffers from a SQL injection vulnerability that stems from a lack of validation of externally-entered SQL statements in the urinalysisform.php file parameter urinalysisid. An attacker can...
CVE-2025-5549
A vulnerability has been found in FreeFloat FTP Server 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the component PASV Command Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed t...
PHPGurukul Teacher Subject Allocation Management System 注入漏洞
Teacher Subject Allocation Management System a teacher subject allocation management system. The Teacher Subject Allocation Management System suffers from a SQL injection vulnerability that originates from the lack of validation of an externally-entered SQL statement in the parameter editid in fi...
PHPGurukul Teacher Subject Allocation Management System 注入漏洞
Teacher Subject Allocation Management System a teacher subject allocation management system. The Teacher Subject Allocation Management System suffers from a SQL injection vulnerability that originates from the lack of validation of an externally-entered SQL statement in the parameter editid in th...
IdeaCMS 注入漏洞
IdeaCMS is a shopping mall system of IdeaCMS open source. IdeaCMS 1.7 and previous versions of the injection vulnerability exists, the vulnerability stems from the file / api / v1.index.article / getList.html in the parameter Field improperly handled resulting in SQL injection...