CVE-2025-66603

CVE-2025-66603 affects Yokogawa FAST/TOOLS, specifically the web server component for packages RVSVRN, UNSVRN, HMIWEB, FTEES, HMIMOB, versions R9.01–R10.04 . The issue arises because the web server accepts the HTTP OPTIONS method, which could enable an attacker to carry out other attacks (per the...

CVE-2026-2200

A weakness has been identified in heyewei JFinalCMS 5.0.0. This affects an unknown function of the file /admin/admin/save of the component API Endpoint. Executing a manipulation can lead to cross site scripting. The attack can be launched remotely. The exploit has been made available to the publi...

PT-2026-7056

Name of the Vulnerable Software and Affected Versions FAST/TOOLS versions R9.01 through R10.04 Description The software does not properly validate URLs, potentially allowing an attacker to steal files from the web server by sending specially crafted requests. Recommendations Update to a version...

PT-2026-7085

Name of the Vulnerable Software and Affected Versions Zirve Information Technologies Inc. E-Taxpayer Accounting Website versions through 07082025 Description The E-Taxpayer Accounting Website contains a flaw due to improper neutralization of input during web page generation, leading to a Reflecte...

CVE-2026-2162

A vulnerability was determined in itsourcecode News Portal Project 1.0. This affects an unknown part of the file /admin/aboutus.php. This manipulation of the argument pagetitle causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized...

EUVD-2026-5815

A weakness has been identified in code-projects Online Music Site 1.0. Impacted is an unknown function of the file /Administrator/PHP/AdminUpdateCategory.php. This manipulation of the argument txtimage causes unrestricted upload. The attack is possible to be carried out remotely. The exploit has...

CVE-2026-2122 Xiaopi Panel WAF Firewall demo.php sql injection

A security flaw has been discovered in Xiaopi Panel up to 20260126. This impacts an unknown function of the file /demo.php of the component WAF Firewall. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been released to the public...

Certificate Generation System 操作系统命令注入漏洞

Certificate Generation System is an open-source web-based certificate generation system developed by Great Developers. The Certificate Generation System has a vulnerability related to operating system command injection, which stems from incorrect handling of the parameter “photo” in the file...

Code-Projects Online Student Management System SQL注入漏洞

Code-Projects Online Student Management System is an open-source online student management system developed by Code-Projects. Version 1.0 of the Code-Projects Online Student Management System has a SQL injection vulnerability. This vulnerability arises from incorrect handling of parameters userna...

CVE-2026-2060

A vulnerability was found in code-projects Simple Blood Donor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /simpleblooddonor/editcampaignform.php. Performing a manipulation of the argument ID results in sql injection. It is possible to initiate the...

CVE-2026-25647

Lute

CVE-2026-2013

A vulnerability was identified in itsourcecode Student Management System 1.0. This affects an unknown function of the file /ramonsys/soa/index.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit is publicly available and might be used...

CVE-2020-37148 P5 FNIP-8x16A/FNIP-4xSH 1.0.20, 1.0.11 - Stored Cross-Site Scripting (XSS)

P5 FNIP-8x16A/FNIP-4xSH versions 1.0.20 and 1.0.11 suffer from a stored cross-site scripting vulnerability. Input passed to several GET/POST parameters is not properly sanitized before being returned to the user, allowing attackers to execute arbitrary HTML and script code in a user's browser...

EUVD-2020-31038

Exagate SYSGuard 6001 contains a cross-site request forgery vulnerability that allows attackers to create unauthorized admin accounts through a crafted HTML form. Attackers can trick users into submitting a malicious form to /kulyon.php that adds a new user with administrative privileges without...

CODTECH-Task2-Web-Vulnerability-Scanner

...

CVE-2026-25223

CVE-2026-25223 affects the Fastify web framework for Node.js. Before version 5.7.2, a validation bypass allows an attacker to bypass request body validation by appending a tab character to the Content-Type header, causing the server to process the body as the original content type without proper ...

CVE-2025-8461 Reflected XSS in Seres Software's syWEB

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Seres Software syWEB allows Reflected XSS. This issue affects syWEB: through 03022026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way...

CVE-2025-8589

CVE-2025-8589 is a Reflected XSS in AKCE Software Technology R&D Industry and Trade Inc. SKSPro (AKCE SKSPro) through version 07012026. The issue arises from improper neutralization of input during web page generation, enabling reflected XSS. Affects SKSPro versions up to 07012026; CVSS v3.1 base...

PhpIX SQL注入漏洞

PhpIX is a website building system developed by PhpIX Company in Thailand. PhpIX has a SQL injection vulnerability; this vulnerability stems from the id parameter in the productdetail.php file, which allows for SQL injections, potentially enabling remote attackers to manipulate database queries...

CVE-2025-6594

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Special.Apisandbox/ApiSandbox.Js. This issue affects MediaWiki: from 1.27.0 before...