CVE-2025-5108: Unrestricted Upload of File with Dangerous Type

A vulnerability was found in zongzhige ShopXO 6.5.0. It has been rated as critical. This issue affects the function Upload of the file app/admin/controller/Payment.php of the component ZIP File Handler. The manipulation of the argument params leads to unrestricted upload. The attack may be...

CVE-2019-5310

YUNUCMS 1.1.8 has XSS in app/admin/controller/System.php because crafted data can be written to the sys.php file, as demonstrated by sitetitle in an admin/system/basic POST request...

CVE-2016-10755

AbanteCart 1.2.8 allows SQL Injection via the sourcelanguage parameter to admin/controller/pages/localisation/language.php and core/lib/languagemanager.php, or via POST data to admin/controller/pages/tool/backup.php and admin/model/tool/backup.php...

CVE-2025-29391: Improper Neutralization of Special Elements used in an SQL Command

horvey Library-Manager v1.0 is vulnerable to SQL Injection in Admin/Controller/BookController.class.php...

CVE-2025-29391

horvey Library-Manager v1.0 is vulnerable to SQL Injection in Admin/Controller/BookController.class.php...

CVE-2025-29391

The horvey Library-Manager v1.0 is vulnerable to SQL Injection within the Admin/Controller/BookController.class.php file. This vulnerability allows an attacker to interfere with backend queries, potentially compromising the integrity and confidentiality of the library management system. As of the...

PublicCMS 代码问题漏洞

PublicCMS is an open source content management system CMS written in Java language by PublicCMS China. A security vulnerability exists in PublicCMS version v4.0.202406, which originates from the /cms/CmsWebFileAdminController.java component that allows the upload of specially crafted svg or xml...

CVE-2024-13197 donglight bookstore电商书城系统说明 AdminUserControlle.java updateUser cross site scripting

A vulnerability was found in donglight bookstore电商书城系统说明 1.0.0. It has been rated as problematic. This issue affects the function updateUser of the file src/main/Java/org/zdd/bookstore/web/controller/admin/AdminUserControlle.java. The manipulation leads to cross site scripting. The attack may be...

HouseRent 安全漏洞

HouseRent is a house rental management system by Mr.W individual developer. An auto-caching JWK-Set HTTP client is provided. A security vulnerability exists in HouseRent version 1.0, which stems from unknown functionality in the file src/main/java/com/house/wym/controller/AdminController.java tha...

PT-2025-2067

Name of the Vulnerable Software and Affected Versions SingMR HouseRent version 1.0 Description A critical issue has been found, affecting some unknown functionality of the file src/main/java/com/house/wym/controller/AdminController.java. This leads to improper access controls, and the attack can ...

CVE-2024-13139: Server-Side Request Forgery (SSRF)

A vulnerability was found in wangl1989 mysiteforme 1.0. It has been rated as critical. This issue affects the function doContent of the file src/main/java/com/mysiteform/admin/controller/system/FileController. The manipulation of the argument content leads to server-side request forgery. The atta...

Arbitrary File Upload

Overview alexstack/laravel-cms is a Simple Bootstrap Laravel CMS Affected versions of this package are vulnerable to Arbitrary File Upload due to unchecked access to the downloadFile function in index in LaravelCmsFileAdminController.php. Remediation There is no fixed version for...

PT-2024-7909

Name of the Vulnerable Software and Affected Versions ThinkAdmin versions up to 6.1.67 Description A critical issue was found in the function script of the file /app/admin/controller/api/Plugs.php, related to deserialization weaknesses. The manipulation of the uptoken argument leads to...

CVE-2024-50801

A SQL Injection vulnerability exists in AbanteCart version 1.4.0 within the update() function located in public_html/admin/controller/responses/listing_grid/collections.php. The flaw is exploitable via the id parameter, potentially allowing unauthorized database access or manipulation. To mitigat...

CVE-2024-8694

A vulnerability, which was classified as problematic, was found in JFinalCMS up to 20240903. This affects the function update of the file /admin/template/update of the component com.cms.controller.admin.TemplateController. The manipulation of the argument fileName leads to path traversal. It is...

PHPGurukul Job Portal SQL注入漏洞

PHPGurukul Job Portal is a PHP-based job search website system from PHPGurukul. A SQL injection vulnerability exists in PHPGurukul Job Portal version 1.0, which originates from the CATEGORY parameter in /jobportal/admin/category/controller.php...

CVE-2024-42773

An Incorrect Access Control vulnerability was found in /admin/editroomcontroller.php in Kashipara Hotel Management System v1.0, which allows an unauthenticated attacker to edit the valid hotel room entries in the administrator section...

CVE-2024-42767

Kashipara Hotel Management System v1.0 is vulnerable to Unrestricted File Upload RCE via /admin/addroomcontroller.php...

CVE-2024-42767

Kashipara Hotel Management System v1.0 is vulnerable to Unrestricted File Upload RCE via /admin/addroomcontroller.php...

CVE-2024-3365

A vulnerability was found in SourceCodester Online Library System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file admin/users/controller.php. The manipulation of the argument username leads to cross site scripting. The attack may be initiated remotely...