📄 bludit 3.16.2 Cross Site Scripting

bludit version 3.16.2 suffers from a cross site scripting vulnerability that leverages an SVG file upload. Exploit Title: XSS via SVG File Upload - bluditv3.16.2 Date: 07/2025 Exploit Author: Andrey Stoykov Version: 3.16.2 Tested on: Debian 12 Blog: https://msecureltd.blogspot.com/ XSS via SVG Fi...

📄 TinyWebGallery 2.7 Cross Site Scripting

TinyWebGallery version 2.7 suffers from a persistent cross site scripting vulnerability. Exploit Title: TinyWebGallery 2.7 - Authenticated Stored XSS Date: 2025-27-06 Exploit Author: tmrswrr Vendor Homepage: https://www.tinywebgallery.com Version: 2.7 Tested on:...

📄 TinyWebGallery 2.7 Shell Upload

TinyWebGallery version 2.7 suffers from an authenticated remote shell upload vulnerability. Exploit Title: TinyWebGallery 2.7 - Authenticated Shell Upload Date: 2025-27-06 Exploit Author: tmrswrr Vendor Homepage: https://www.tinywebgallery.com Version: 2.7 Tested on:...

CVE-2025-6688

The Simple Payment plugin for WordPress is vulnerable to Authentication Bypass in versions 1.3.6 to 2.3.8. This is due to the plugin not properly verifying a user's identity prior to logging them in through the createuser function. This makes it possible for unauthenticated attackers to log in as...

CVE-2025-6762 diyhi bbs HTTP Header login getUrl server-side request forgery

A vulnerability classified as critical has been found in diyhi bbs up to 6.8. This affects the function getUrl of the file /admin/login of the component HTTP Header Handler. The manipulation of the argument Host leads to server-side request forgery. It is possible to initiate the attack remotely...

Code-Projects Food Distributor Site 注入漏洞

Code-Projects Food Distributor Site is a Code-Projects open source food distributor site. Code-Projects Food Distributor Site version 1.0 suffers from an injection vulnerability that originates from SQL injection due to incorrect manipulation of the parameters username/password in the file...

CVE-2025-26198

CloudClassroom-PHP-Project v1.0 contains a critical SQL Injection vulnerability in the loginlinkadmin.php component. The application fails to sanitize user-supplied input in the admin login form before directly including it in SQL queries. This allows unauthenticated attackers to inject arbitrary...

CVE-2025-49182

Files in the source code contain login credentials for the admin user and the property configuration password, allowing an attacker to get full access to the application...

CVE-2025-5177

A vulnerability was found in Realce Tecnologia Queue Ticket Kiosk up to 20250517. It has been rated as problematic. This issue affects some unknown processing of the file /adm/index.php of the component Admin Login Page. The manipulation of the argument Usuário leads to cross site scripting. The...

CVE-2025-5176

A vulnerability was found in Realce Tecnologia Queue Ticket Kiosk up to 20250517. It has been declared as critical. This vulnerability affects unknown code of the file /adm/index.php of the component Admin Login Page. The manipulation of the argument Usuário leads to sql injection. The attack can...

CVE-2025-5128

A vulnerability, which was classified as critical, was found in ScriptAndTools Real-Estate-website-in-PHP 1.0. Affected is an unknown function of the file /admin/ of the component Admin Login Panel. The manipulation of the argument Password leads to sql injection. It is possible to launch the...

CVE-2025-5177

A vulnerability was found in Realce Tecnologia Queue Ticket Kiosk up to 20250517. It has been rated as problematic. This issue affects some unknown processing of the file /adm/index.php of the component Admin Login Page. The manipulation of the argument Usuário leads to cross site scripting. The...

CVE-2025-5177

A vulnerability was found in Realce Tecnologia Queue Ticket Kiosk up to 20250517. It has been rated as problematic. This issue affects some unknown processing of the file /adm/index.php of the component Admin Login Page. The manipulation of the argument Usuário leads to cross site scripting. The...

CVE-2025-5177 Realce Tecnologia Queue Ticket Kiosk Admin Login Page index.php cross site scripting

A vulnerability was found in Realce Tecnologia Queue Ticket Kiosk up to 20250517. It has been rated as problematic. This issue affects some unknown processing of the file /adm/index.php of the component Admin Login Page. The manipulation of the argument Usuário leads to cross site scripting. The...

CVE-2025-5177 Realce Tecnologia Queue Ticket Kiosk Admin Login Page index.php cross site scripting

A vulnerability was found in Realce Tecnologia Queue Ticket Kiosk up to 20250517. It has been rated as problematic. This issue affects some unknown processing of the file /adm/index.php of the component Admin Login Page. The manipulation of the argument Usuário leads to cross site scripting. The...

CVE-2025-5177

The CVE-2025-5177 entry concerns Realce Tecnologia Queue Ticket Kiosk (Admin Login Page). Affected component is the Admin Login Page, specifically the /adm/index.php path, where manipulating the Usuário parameter enables a cross-site scripting vulnerability. The issue is described as remotely ini...

CVE-2025-5176

A vulnerability was found in Realce Tecnologia Queue Ticket Kiosk up to 20250517. It has been declared as critical. This vulnerability affects unknown code of the file /adm/index.php of the component Admin Login Page. The manipulation of the argument Usuário leads to sql injection. The attack can...

CVE-2025-5176

A vulnerability was found in Realce Tecnologia Queue Ticket Kiosk up to 20250517. It has been declared as critical. This vulnerability affects unknown code of the file /adm/index.php of the component Admin Login Page. The manipulation of the argument Usuário leads to sql injection. The attack can...

CVE-2025-5176

CVE-2025-5176 affects Realce Tecnologia Queue Ticket Kiosk (up to 20250517). The vulnerability is an SQL injection in the Admin Login Page, targeting the file /adm/index.php via the argument Usuário. Impact: high confidentiality/integrity risk per CVSS details; vector is network with low attack c...

CVE-2025-5176 Realce Tecnologia Queue Ticket Kiosk Admin Login Page index.php sql injection

A vulnerability was found in Realce Tecnologia Queue Ticket Kiosk up to 20250517. It has been declared as critical. This vulnerability affects unknown code of the file /adm/index.php of the component Admin Login Page. The manipulation of the argument Usuário leads to sql injection. The attack can...