CVE-2026-71386

CVE-2026-71386 is a cross-site scripting vulnerability affecting Adobe ColdFusion (ColdFusion component). The issue can lead to arbitrary code execution in the context of the current user and is exploitable only when a victim opens a malicious file, with user interaction required. The vulnerable ...

CVE-2026-47929

ColdFusion versions 2023.19, 2025.8 and earlier are affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the current user. A high-privileged attacker could exploit this vulnerability to gain elevated access or control over the victim...

CVE-2026-47933

ColdFusion versions 2023.19, 2025.8 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to...

CVE-2025-67285

A SQL injection vulnerability was found in the '/cts/admin/?page=zone' file of ITSourcecode COVID Tracking System Using QR-Code v1.0. The reason for this issue is that attackers inject malicious code from the parameter 'id' and use it directly in SQL queries without the need for appropriate...

CVE-2025-67285

A SQL injection vulnerability was found in the '/cts/admin/?page=zone' file of ITSourcecode COVID Tracking System Using QR-Code v1.0. The reason for this issue is that attackers inject malicious code from the parameter 'id' and use it directly in SQL queries without the need for appropriate...

CVE-2025-67285

A SQL injection vulnerability exists in ITSourcecode COVID Tracking System Using QR-Code v1.0 within the /cts/admin/?page=zone file. The root cause is the lack of proper sanitization or validation for the id parameter, which allows attackers to inject malicious code directly into SQL queries. Evi...

CVE-2025-14585

A vulnerability was found in itsourcecode COVID Tracking System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/?page=zone. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been made public and...

itsourcecode COVID Tracking System SQL注入漏洞

itsourcecode COVID Tracking System is a new coronavirus tracking system open-sourced by itsourcecode. An SQL injection vulnerability exists in version 1.0 of itsourcecode COVID Tracking System, which stems from a misuse of the parameter ID in the file /admin/?page=zone, which could lead to an SQL...

Remote code execution

Authenticated remote code execution RCE in Composr-CMS 10.0.39 and earlier allows remote attackers to execute arbitrary code via uploading a PHP shell through /adminzone/index.php?page=admin-commandr...

Composr CMS Cross-Site Scripting Vulnerability

Composr CMS is an open source content management system CMS developed using HTML, CSS and WCAG technologies. A cross-site scripting vulnerability exists in Composr CMS version 10.0.13. A remote attacker can exploit this vulnerability by sending a page=admin-setupwizard&type=step3 request to...

SQL INJECTION VULNERABILITIES--ST-Gallery version 0.1 alpha-->

----------------------------------------------------------------- SQL INJECTION VULNERABILITIES--ST-Gallery version 0.1 alpha-- ----------------------------------------------------------------- CMS INFORMATION: --WEB: http://blog.sebastian-thiele.net/projekte/gallery/ --DOWNLOAD:...

Subdreamer 2.2.1 - SQL Injection Command Execution

Subdreamer 2.2.1 - SQL Injection Command Execution !/usr/bin/perl Subdreamer 2.2.1 command exec exploit @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ supported targets: without forum integration with phpBB2 integration with ipb2 integration with vbulletin2...