CVE-2025-60500

QDocs Smart School Management System 7.1 allows authenticated users with roles such as "accountant" or "admin" to bypass file type restrictions in the media upload feature by abusing the alternate YouTube URL option. This logic flaw permits uploading of arbitrary PHP files, which are stored in a...

PT-2022-14807 · Dolibarr · Dolibarr

Name of the Vulnerable Software and Affected Versions: dolibarr/dolibarr versions prior to 16.0 Description: The issue is related to a Cross-site Scripting XSS - Stored vulnerability. It affects the admin/accountant.php file, where the fields town, name, and Accountant code can be used to escape...