PT-2026-99383

Name of the Vulnerable Software and Affected Versions froxlor versions prior to 2.3.12 Description An issue exists where two-factor authentication 2FA is disabled immediately upon a GET request to the 2FA management page, such as the endpoint '/customer index.php?page=2fa&action=delete'. This...

CVE-2026-38473

A Stored XSS vulnerability in the subtitle deletion flow in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via a crafted subtitle filename, which is stored during upload and later rendered in...

CVE-2026-38473: Improper Neutralization of Input During Web Page Generation

A Stored XSS vulnerability in the subtitle deletion flow in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via a crafted subtitle filename, which is stored during upload and later rendered in...

PT-2026-69098

A security flaw has been discovered in SourceCodester Simple Doctors Appointment System 1.0. This vulnerability affects unknown code of the file /admin/ajax.php?action=delete appointment. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploi...

CVE-2024-42565

ERP commit 44bd04 was discovered to contain a SQL injection vulnerability via the id parameter at /index.php/basedata/contact/delete?action=delete...

CVE-2024-42565: Improper Neutralization of Special Elements used in an SQL Command

ERP commit 44bd04 was discovered to contain a SQL injection vulnerability via the id parameter at /index.php/basedata/contact/delete?action=delete...

PT-2024-38237

Name of the Vulnerable Software and Affected Versions SourceCodester Establishment Billing Management System version 1.0 Description A critical issue has been found in the system, affecting an unknown functionality of the file "/ajax.php?action=delete block". The manipulation of the id argument...

PT-2024-36604

Name of the Vulnerable Software and Affected Versions Netentsec NS-ASG Application Security Gateway version 6.3 Description A critical issue has been found, affecting an unknown part of the file /admin/config MT.php?action=delete. The manipulation of the Mid argument leads to SQL injection. It is...

CVE-2024-2329: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/listresourceicon.php?action=delete. The manipulation of the argument IconId leads to sql injection. The attack may be...

CVE-2024-0522: Cross-Site Request Forgery (CSRF)

A vulnerability was found in Allegro RomPager 4.01. It has been classified as problematic. Affected is an unknown function of the file usertable.htm?action=delete of the component HTTP POST Request Handler. The manipulation of the argument username leads to cross-site request forgery. It is...

CVE-2024-0487: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in code-projects Fighting Cock Information System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/action/delete-vaccine.php. The manipulation of the argument ref leads to sql injection. The attack may be launched...

PT-2023-23105 · Ibos · Ibos

Name of the Vulnerable Software and Affected Versions: IBOS version 4.5.5 Description: A critical issue has been found, affecting the function actionDel of the file "?r=dashboard/approval/del". The manipulation of the id argument leads to SQL injection. The exploit has been disclosed to the publi...

CVE-2022-3774: Improper Control of Resource Identifiers

A vulnerability was found in SourceCodester Train Scheduler App 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /trainschedulerapp/?action=delete. The manipulation of the argument id leads to improper control of resource identifiers. The attack may...

PT-2022-25902

Name of the Vulnerable Software and Affected Versions Open Source SACCO Management System version 1.0 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/sacco shield/ajax.php?action=delete loan" API endpoint...

CVE-2022-28523

HongCMS 3.0.0 allows arbitrary file deletion via the component /admin/index.php/template/ajax?action=delete...

PT-2022-19063

Name of the Vulnerable Software and Affected Versions HongCMS version 3.0.0 Description The issue allows for arbitrary file deletion. This can be achieved via the component /admin/index.php/template/ajax?action=delete. Recommendations For HongCMS version 3.0.0, as a temporary workaround, consider...

CVE-2022-28423: Improper Neutralization of Special Elements used in an SQL Command

Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php&action=delete...

PT-2022-19019

Name of the Vulnerable Software and Affected Versions Baby Care System version 1.0 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the /admin/inbox.php endpoint with specific parameters, such as action=delete and msgid=. Recommendations F...

PT-2022-19029

Name of the Vulnerable Software and Affected Versions Baby Care System version 1.0 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the /admin/uesrs.php endpoint with specific parameters such as action=delete and userid=4. Recommendations...

PT-2022-19014

Name of the Vulnerable Software and Affected Versions Baby Care System version 1.0 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the "/admin/posts.php&action=delete" endpoint. The action parameter in this endpoint is vulnerable to SQL...