CVE-2025-10091

CVE-2025-10091 affects Jinher OA up to version 1.2. The vulnerability is located in the XML Handler component, specifically the file /c6/Jhsoft.Web.projectmanage/ProjectManage/XmlHttp.aspx/?Type=add, where manipulation enables an XML External Entity (XXE) reference. Remote exploitation is possibl...

appRain CMF cross-site scripting vulnerability (CNVD-2025-21131)

appRain CMF is a content management framework. A cross-site scripting vulnerability exists in appRain CMF, which is caused by improper validation of user input in the /apprain/information/manage/emailtemplate/add endpoint. An attacker could use this vulnerability to steal the victim's cookie-base...

appRain CMF SQL Injection Vulnerability (CNVD-2025-21108)

appRain CMF is a content management framework. appRain CMF suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the data%5BAdmin%5D%5Busername%5D parameter of /apprain/admin/manage/add. An attacker could use this vulnerability t...

appRain CMF cross-site scripting vulnerability (CNVD-2025-21109)

appRain CMF is a content management framework. A cross-site scripting vulnerability exists in appRain CMF due to improper validation of user input in the apprain/admin/managegroup/add/ endpoint. An attacker could use this vulnerability to steal the victim's cookie-based authentication credentials...

CVE-2025-58859

Cross-Site Request Forgery CSRF vulnerability in David Merinas Add to Feedly add-to-feedly allows Stored XSS.This issue affects Add to Feedly: from n/a through = 1.2.11...

CVE-2025-10068

A flaw has been found in itsourcecode Online Discussion Forum 1.0. This affects an unknown function of the file /admin/adminforum/addviews.php. Executing manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may...

CVE-2025-10068 itsourcecode Online Discussion Forum add_views.php sql injection

A flaw has been found in itsourcecode Online Discussion Forum 1.0. This affects an unknown function of the file /admin/adminforum/addviews.php. Executing manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may...

CVE-2025-10068 itsourcecode Online Discussion Forum add_views.php sql injection

A flaw has been found in itsourcecode Online Discussion Forum 1.0. This affects an unknown function of the file /admin/adminforum/addviews.php. Executing manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may...

PT-2025-36408

Name of the Vulnerable Software and Affected Versions: itsourcecode Online Discussion Forum version 1.0 Description: A SQL injection issue exists in itsourcecode Online Discussion Forum version 1.0. The flaw is located in the file /admin/admin forum/add views.php and affects an unknown function...

itsourcecode Online Discussion Forum SQL注入漏洞

itsourcecode Online Discussion Forum is an online forum of itsourcecode open source. A SQL injection vulnerability exists in itsourcecode Online Discussion Forum version 1.0, which originates from a SQL injection attack due to a misuse of the parameter ID in the file /admin/adminforum/addviews.ph...

CVE-2025-41038

A vulnerability has been discovered in appRain CMF version 4.0.5, consisting of a stored authenticated XSS due to a lack of proper validation of user input, through the 'dataGroupname' parameter in /apprain/admin/managegroup/add/...

CVE-2025-8564

CVE-2025-8564 — Stored Cross‑Site Scripting in SKT Addons for Elementor (WordPress) up to version 3.7 due to insufficient input sanitization and output escaping on user attributes. Exploitation requires authenticated access at contributor level or higher; attacker can inject scripts that execute ...

Malicious code in soft-add-slip (npm)

The package soft-add-slip was found to contain malicious code...

MAL-2025-46107 Malicious code in soft-add-slip (npm)

The package soft-add-slip was found to contain malicious code...

CVE-2025-58859

Cross-Site Request Forgery CSRF vulnerability in David Merinas Add to Feedly add-to-feedly allows Stored XSS.This issue affects Add to Feedly: from n/a through = 1.2.11...

CVE-2025-58859 WordPress Add to Feedly Plugin <= 1.2.11 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in David Merinas Add to Feedly add-to-feedly allows Stored XSS.This issue affects Add to Feedly: from n/a through = 1.2.11...

CVE-2025-58859

CVE-2025-58859: WordPress Add to Feedly plugin

Mobile Shop Management System AddNewProduct.php file code problem vulnerability

Mobile Shop Management System is a store management system. Mobile Shop Management System has a code issue vulnerability that stems from the lack of valid validation of uploaded files in the parameter ProductImage in the file AddNewProduct.php. An attacker can exploit this vulnerability to upload...

PT-2025-36198

Name of the Vulnerable Software and Affected Versions: Add to Feedly versions through 1.2.11 Description: A Cross-Site Request Forgery CSRF vulnerability exists in David Merinas Add to Feedly, which can also lead to Stored Cross-Site Scripting XSS. Recommendations: Update Add to Feedly to a versi...

CVE-2025-9830

A security flaw has been discovered in PHPGurukul Beauty Parlour Management System 1.1. This affects an unknown function of the file /admin/add-customer-services.php. The manipulation of the argument sids results in sql injection. The attack can be executed remotely. The exploit has been released...