3937 matches found
EUVD-2019-19423
OPNsense 19.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts by exploiting insufficient input validation in the host parameter. Attackers can submit crafted payloads through POST requests to diagtraceroute.php to execute...
cyart-vapt-week-2
cyart-vapt-team This repository contains the Week 2 VAPT lab w...
CVE-2025-70094
CVE-2025-70094 describes an XSS flaw in the OpenSourcePOS 3.4.1 Generate Item Barcode function. The vulnerability allows an attacker to inject crafted payloads into the Item Category parameter, enabling execution of arbitrary web scripts/HTML in the victim’s browser. The issue affects the Generat...
CVE-2019-25320 elearning-script 1.0 - Authentication Bypass
E Learning Script 1.0 contains an authentication bypass vulnerability that allows attackers to access the dashboard without valid credentials by manipulating login parameters. Attackers can exploit the /login.php file by sending a specific payload '=''or' to bypass authentication and gain...
Pentora
Pentora v1.0 Pentora is a terminal-first web vulnerability...
CVE-2026-2248 Unauthenticated Remote Root Shell Access via Web Console in METIS WIC
METIS WIC devices versions = oscore 2.1.234-r18 expose a web-based shell at the /console endpoint that does not require authentication. Accessing this endpoint allows a remote attacker to execute arbitrary operating system commands with root UID 0 privileges. This results in full system compromis...
CVE-2025-14560 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.1 before 18.6.6, 18.7 before 18.7.4, and 18.8 before 18.8.4 that, under certain conditions could have allowed an authenticated user to perform unauthorized actions on behalf of another user by injecting malicious conten...
CVE-2025-13064
A server-side injection was possible for a malicious admin to manipulate the application to include a malicious script which is executed by the server. This attack is only possible if the admin uses a client that have been tampered with...
CVE-2025-7799 Reflected XSS in Zirve Information Technologies' e-Taxpayer Accounting Website
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Zirve Information Technologies Inc. E-Taxpayer Accounting Website allows Reflected XSS. This issue affects e-Taxpayer Accounting Website: through 07082025...
CVE-2025-66603
CVE-2025-66603 affects Yokogawa FAST/TOOLS, specifically the web server component for packages RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB, versions R9.01–R10.04 . The issue arises because the web server accepts the HTTP OPTIONS method, which could enable an attacker to carry out other attacks (per the...
CVE-2026-2200
A weakness has been identified in heyewei JFinalCMS 5.0.0. This affects an unknown function of the file /admin/admin/save of the component API Endpoint. Executing a manipulation can lead to cross site scripting. The attack can be launched remotely. The exploit has been made available to the publi...
PT-2026-7056
Name of the Vulnerable Software and Affected Versions FAST/TOOLS versions R9.01 through R10.04 Description The software does not properly validate URLs, potentially allowing an attacker to steal files from the web server by sending specially crafted requests. Recommendations Update to a version...
PT-2026-7085
Name of the Vulnerable Software and Affected Versions Zirve Information Technologies Inc. E-Taxpayer Accounting Website versions through 07082025 Description The E-Taxpayer Accounting Website contains a flaw due to improper neutralization of input during web page generation, leading to a Reflecte...
CVE-2026-2162
A vulnerability was determined in itsourcecode News Portal Project 1.0. This affects an unknown part of the file /admin/aboutus.php. This manipulation of the argument pagetitle causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized...
EUVD-2026-5815
A weakness has been identified in code-projects Online Music Site 1.0. Impacted is an unknown function of the file /Administrator/PHP/AdminUpdateCategory.php. This manipulation of the argument txtimage causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has...
CVE-2026-2122 Xiaopi Panel WAF Firewall demo.php sql injection
A security flaw has been discovered in Xiaopi Panel up to 20260126. This impacts an unknown function of the file /demo.php of the component WAF Firewall. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public...
Certificate Generation System 操作系统命令注入漏洞
Certificate Generation System is an open-source web-based certificate generation system developed by Great Developers. The Certificate Generation System has a vulnerability related to operating system command injection, which stems from incorrect handling of the parameter “photo” in the file...
Code-Projects Online Student Management System SQL注入漏洞
Code-Projects Online Student Management System is an open-source online student management system developed by Code-Projects. Version 1.0 of the Code-Projects Online Student Management System has a SQL injection vulnerability. This vulnerability arises from incorrect handling of parameters userna...
CVE-2026-2060
A vulnerability was found in code-projects Simple Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /simpleblooddonor/editcampaignform.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the...