3931 matches found
ROS-20260417-73-0046
Vulnerability in glpi due to a flaw in the output encoding or escaping mechanism. Exploitation of the vulnerability could allow an attacker acting remotely to execute arbitrary code...
web-vulnerability-scanner
...
VulnForge
VulnForge AI-Powered Vulnerability Scanner & Auto-Exploit E...
CVE-2026-37339
SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/viewgenre.php...
GHSA-8QM8-G55H-XMQR WWBN AVideo is missing CSRF protection in objects/commentDelete.json.php enables mass comment deletion against moderators and content creators
Summary objects/commentDelete.json.php is a state-mutating JSON endpoint that deletes comments but performs no CSRF validation. It does not call forbidIfIsUntrustedRequest, does not verify a CSRF/global token, and does not check Origin/Referer. Because AVideo intentionally sets...
CVE-2026-36950
Sourcecodester Online Thesis Archiving System v1.0 is vulnerable to SQL injection in /otas/projectsperdepartment.php...
CVE-2025-61886
Fortinet FortiSandbox and FortiSandbox PaaS versions 5.0.0–5.0.4 are affected by a Cross-site Scripting (CWE-79) vulnerability due to improper input neutralization during web page generation. An attacker can trigger an XSS attack by sending crafted HTTP requests. The NVD/CVE entry lists a CVSS v3...
CVE-2025-59809
CVE-2025-59809 is a server-side request forgery (SSRF) vulnerability (CWE-918) in Fortinet FortiSOAR PaaS and FortiSOAR on-premise across multiple versions (PaaS: 7.6.0–7.6.2, 7.6.4, 7.5.0–7.5.2, 7.4 all, 7.3 all; on-premise: 7.6.4, 7.6.0–7.6.2, 7.5.0–7.5.2, 7.4 all, 7.3 all). An authenticated at...
EUVD-2025-209449
Leaflet versions up to and including 1.9.4 are vulnerable to Cross-Site Scripting XSS via the bindPopup method. This method renders user-supplied input as raw HTML without sanitization, allowing attackers to inject arbitrary JavaScript code through event handler attributes e.g., . When a victim...
PT-2026-32654
An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability CWE-79 vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.4, FortiSandbox PaaS 5.0.0 through 5.0.4 may allow an attacker to perform an XSS attack via crafted HTTP requests...
CVE-2026-37593
SourceCodester Online Employees Work From Home Attendance System v1.0 is vulnerable to SQL Injection in the file /wfhattendance/admin/viewatt.php...
EUVD-2026-21781
Stored Cross Site Scripting in NightWolf Penetration Testing Platform allows attack trigger and run malicious script in user's browser...
CVE-2026-6179 Stored Cross Site Scripting in NightWolf Penetration Testing Platform
Stored Cross Site Scripting in NightWolf Penetration Testing Platform allows attack trigger and run malicious script in user's browser...
PT-2026-32492
Pachno 1.0.6 contains a stored cross-site scripting vulnerability that allows attackers to execute arbitrary HTML and script code by injecting malicious payloads into POST parameters. Attackers can inject scripts through the value, comment body, article content, description, and message parameter...
CVE-2019-25697 CMSsite 1.0 SQL Injection via category.php
CMSsite 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the catid parameter. Attackers can send GET requests to category.php with malicious catid values to extract sensitive database information includi...
Dir-Listing-Auto-Exploit
Dir...
CVE-2026-6112 Totolink A7100RU CGI cstecgi.cgi setRadvdCfg os command injection
A weakness has been identified in Totolink A7100RU 7.4cu.2313b20191024. Affected is the function setRadvdCfg of the file /cgi-bin/cstecgi.cgi of the component CGI Handler. This manipulation of the argument maxRtrAdvInterval causes os command injection. The attack can be initiated remotely. The...
CVE-2026-6107
A flaw has been found in 1Panel-dev MaxKB up to 2.6.1. This issue affects some unknown processing of the file apps/common/middleware/chatheadersmiddleware.py of the component ChatHeadersMiddleware. This manipulation of the argument Name causes cross site scripting. Remote exploitation of the atta...
CVE-2026-35403
LORIS Longitudinal Online Research and Imaging System is a self-hosted web application that provides data- and project-management for neuroimaging research. From 15.10 to before 27.0.3 and 28.0.1, there is a potential for a cross-site scripting attack in the surveyaccounts module if a user provid...