CVE-2025-9756

A vulnerability was found in PHPGurukul User Management System 1.0. This impacts an unknown function of the file /admin/change-emailid.php. The manipulation of the argument uid results in sql injection. The attack can be executed remotely. The exploit has been made public and could be used...

CVE-2025-6707 Race condition in privilege cache invalidation cycle

Under certain conditions, an authenticated user request may execute with stale privileges following an intentional change by an authorized administrator. This issue affects MongoDB Server v5.0 version prior to 5.0.31, MongoDB Server v6.0 version prior to 6.0.24, MongoDB Server v7.0 version prior ...

CVE-2025-5558

A vulnerability was found in PHPGurukul Teacher Subject Allocation Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/changeimage.php. The manipulation of the argument editid leads to sql injection. The attack may be initiated remotely...

CVE-2025-44185

SourceCodester Best Employee Management System V1.0 is vulnerable to Cross Site Request Forgery CSRF in /admin/changepass.php via the password parameter...

CVE-2025-4156

A vulnerability has been found in PHPGurukul Boat Booking System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/change-image.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been...

CVE-2025-1762

The Event Tickets with Ticket Scanner WordPress plugin before 2.5.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

PHPGurukul Medical Card Generation System 安全漏洞

PHPGurukul Medical Card Generation System is a medical card generation system from PHPGurukul Inc. A security vulnerability exists in version 1.0 of the PHPGurukul Medical Card Generation System, which stems from a parameter editid in the file /admin/changeimage.php that can lead to SQL injection...

CVE-2024-9816

A vulnerability was found in Codezips Tourist Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/change-image.php. The manipulation of the argument packageimage leads to unrestricted upload. The attack may be launched remotely...

Codezips Tourist Management System 代码问题漏洞

Codezips Tourist Management System is an open source tourism management system from Codezips. A code issue vulnerability exists in Codezips Tourist Management System version 1.0, which stems from the parameter packageimage in /admin/change-image.php that can lead to unrestricted uploads...

CVE-2024-8091

CVE-2024-8091 concerns the Enhanced Search Box WordPress plugin (≤ 0.6.1). The issue is a missing CSRF check when updating plugin settings, which could allow a logged-in attacker to induce an admin to change settings via CSRF. Impact described across Red Hat and CVE records aligns with unauthoriz...

CVE-2024-8047

The Visual Sound (old) WordPress plugin, v1.06 and earlier, is disclosed as lacking CSRF protection when updating settings. This enables CSRF-based changes by an attacker with a logged‑in admin account. The exact patch version is not provided in the supplied documents; remediation is to upgrade t...

CVE-2024-7859

The Visual Sound WordPress plugin through 1.03 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

WordPress plugin WP Extended 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CVE-2024-7690

The DN Popup WordPress plugin through 1.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-3629

The HL Twitter WordPress plugin through 2014.1.18 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-2429

CVE-2024-2429 affects the Salon Booking System WordPress plugin (up to 9.6.5). The issue is a missing CSRF check in the plugin’s settings update flow, allowing a logged-in admin to alter settings via CSRF. The Red Hat advisory reiterates this description. Exploitation status is not provided in th...

CVE-2023-6390

The WordPress Users WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2023-6292

The Ecwid Ecommerce Shopping Cart WordPress plugin before 6.12.5 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-0362

A vulnerability classified as critical was found in PHPGurukul Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/change-password.php. The manipulation of the argument cpass leads to sql injection. The exploit has been disclosed to the...

CVE-2024-0362

A vulnerability classified as critical was found in PHPGurukul Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/change-password.php. The manipulation of the argument cpass leads to sql injection. The exploit has been disclosed to the...