Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the extractImageInfo function for user avatars. An attacker can execute arbitrary scripts in the context of another user by uploading malicious files that are served without proper content type validation...

CVE-2025-57149

phpgurukul Complaint Management System 2.0 is vulnerable to SQL Injection in /complaint-details.php via the cid parameter...

PT-2025-35847

Name of the Vulnerable Software and Affected Versions Jinher OA version 1.0 Description A cross site scripting issue exists due to the manipulation of the Account argument. The issue affects an unknown function within the file /jc6/platform/sys/login!changePassWord.action of the POST Request...

QNAP Qsync Central SQL Injection Vulnerability

QNAP Qsync Central is a private cloud synchronization service launched by QNAP, which is mainly used to achieve real-time synchronization and backup of files between devices. QNAP Qsync Central suffers from a SQL injection vulnerability that stems from the application's lack of validation of...

Linux Distros Unpatched Vulnerability : CVE-2017-5533

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability in the server content cache of TIBCO JasperReports Server, TIBCO JasperReports Server Community Edition, TIBCO JasperReports Server for...

CVE-2025-9749 HKritesh009 Grocery List Management Web App update.php sql injection

A vulnerability was identified in HKritesh009 Grocery List Management Web App up to f491b681eb70d465f445c9a721415c965190f83b. This affects an unknown part of the file /src/update.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The...

CVE-2025-52130

File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller. This flaw allows an authenticated attacker to upload arbitrary files, including PHP scripts, which can be accessed via direct GET requests, potentially resulting in remote code execution RC...

CVE-2025-9610

A vulnerability was determined in code-projects Online Event Judging System 1.0. This issue affects some unknown processing of the file /createaccount.php. This manipulation of the argument fname causes sql injection. The attack is possible to be carried out remotely. The exploit has been publicl...

CVE-2025-9602

Xinhu RockOA versions up to 2.6.9 are affected by an improper authorization vulnerability in the publicsaveAjax function of /index.php. The issue allows remote manipulation and has publicly disclosed exploit material. Remediation is to upgrade to a version beyond 2.6.9 (or applying available patc...

PHPGurukul Directory Management System 安全漏洞

Directory Management System is a directory management system. Directory Management System suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameter fullname in the file /admin/add-directory.php, which can ...

Exploit for Improper Input Validation in Rubyonrails Rails

🔐 Black Box Penetration Test on DVWA This repository document...

CVE-2025-31971 AIML Solutions for HCL SX is susceptible to a URL validation vulnerability

AIML Solutions for HCL SX is vulnerable to a URL validation vulnerability. The issue may allow attackers to launch a server-side request forgery SSRF attack enabling unauthorized network calls from the system, potentially exposing internal services or sensitive information...

Hospital Management System about-us.php File SQL Injection Vulnerability

Hospital Management System is a PHP and MySQL based hospital management system. Hospital Management System suffers from a SQL injection vulnerability that stems from the lack of validation of externally-entered SQL statements in the pagetitle parameter of about-us.php. An attacker can exploit thi...

CVE-2025-9440 1000projects Online Project Report Submission and Evaluation System add_title.php cross site scripting

A security vulnerability has been detected in 1000projects Online Project Report Submission and Evaluation System 1.0. Affected by this issue is some unknown functionality of the file /admin/addtitle.php. Such manipulation of the argument Title leads to cross site scripting. The attack may be...

CVE-2025-52130

File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller. This flaw allows an authenticated attacker to upload arbitrary files, including PHP scripts, which can be accessed via direct GET requests, potentially resulting in remote code execution RC...

ROS-20250825-05

A vulnerability in the Ruby Sinatra web application development framework is related to a flaw in limiting the name of the of the directory path. Exploitation of the vulnerability allows an attacker acting remotely to gain access to sensitive data...

CVE-2025-56216

The phpgurukul Hospital Management System 4.0 is vulnerable to SQL Injection within the about-us.php file. The root cause is a lack of validation for externally-entered SQL statements provided via the pagetitle parameter. An attacker can exploit this flaw to execute unauthorized SQL commands and ...

Linux Distros Unpatched Vulnerability : CVE-2009-3581

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Multiple cross-site scripting XSS vulnerabilities in SQL-Ledger 2.8.24 allow remote authenticated users to inject arbitrary web script or HTML via 1 the DCN...

NextChat 安全漏洞

NextChat is a NextChat open source project for rapid deployment of private ChatGPT web applications. A security vulnerability exists in NextChat that stems from the HTMLPreview component not properly cleaning up user-influenced HTML, which could lead to the execution of arbitrary JavaScript code...

AviaBit-Airport Password Reset Disclosure

The vulnerability of the password-reset module of the WEB application of the “AviaBit-Airport” system is related to insufficient protection of operational data. Exploiting this vulnerability allows a malicious actor to disclose protected information by sending a specially crafted POST request...