CVE-2026-38473: Improper Neutralization of Input During Web Page Generation

A Stored XSS vulnerability in the subtitle deletion flow in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScript via a crafted subtitle filename, which is stored during upload and later rendered in...

CVE-2024-42565: Improper Neutralization of Special Elements used in an SQL Command

ERP commit 44bd04 was discovered to contain a SQL injection vulnerability via the id parameter at /index.php/basedata/contact/delete?action=delete...

CVE-2024-42565

ERP commit 44bd04 was discovered to contain a SQL injection vulnerability via the id parameter at /index.php/basedata/contact/delete?action=delete...

CVE-2024-2329: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in Netentsec NS-ASG Application Security Gateway 6.3 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/listresourceicon.php?action=delete. The manipulation of the argument IconId leads to sql injection. The attack may be...

CVE-2024-0522: Cross-Site Request Forgery (CSRF)

A vulnerability was found in Allegro RomPager 4.01. It has been classified as problematic. Affected is an unknown function of the file usertable.htm?action=delete of the component HTTP POST Request Handler. The manipulation of the argument username leads to cross-site request forgery. It is...

CVE-2024-0487: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in code-projects Fighting Cock Information System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/action/delete-vaccine.php. The manipulation of the argument ref leads to sql injection. The attack may be launched...

PT-2023-23105 · Ibos · Ibos

Name of the Vulnerable Software and Affected Versions: IBOS version 4.5.5 Description: A critical issue has been found, affecting the function actionDel of the file "?r=dashboard/approval/del". The manipulation of the id argument leads to SQL injection. The exploit has been disclosed to the publi...

CVE-2022-3774: Improper Control of Resource Identifiers

A vulnerability was found in SourceCodester Train Scheduler App 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /trainschedulerapp/?action=delete. The manipulation of the argument id leads to improper control of resource identifiers. The attack may...

CVE-2022-28423: Improper Neutralization of Special Elements used in an SQL Command

Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/posts.php&action=delete...

CVE-2020-13566: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerabilities exist in phpGACL 3.3.7. A specially crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability In admin/editgroup.php, when the POST parameter action is “Delete”, the POST parameter deletegroup leads to a SQL...

CVE-2019-16867

HongCMS 3.0.0 allows arbitrary file deletion via a ../ in the file parameter to admin/index.php/database/ajax?action=delete, a similar issue to CVE-2018-16774. If the attacker deletes config.php and visits install/index.php, they can reinstall the product...