Grocery-CMS-PHP-Restful-API security vulnerabilities

Grocery-CMS-PHP-Restful-API is an online grocery store by Ajay Randhawa Individual Developer. A security vulnerability exists in Grocery-CMS-PHP-Restful-API v1.3, which stems from the easy uploading of files via /admin/add-category.php...

SourceCodester Web-Based Pharmacy Product Management System has security vulnerabilities.

SourceCodester Web Based Pharmacy Product Management System is an open source web-based pharmaceutical management system from SourceCodester. A security vulnerability exists in SourceCodester Web Based Pharmacy Product Management System version 1.0, which originates from an unvalidated Fullname...

CVE-2025-4157

A vulnerability was found in PHPGurukul Boat Booking System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/booking-details.php. The manipulation of the argument Status leads to sql injection. The attack may be initiated remotely. The exploit has been...

SourceCodester Simple Barangay Management System security vulnerabilities

SourceCodester Simple Barangay Management System is a simple village management system from SourceCodester open source. A security vulnerability exists in SourceCodester Simple Barangay Management System v1.0, which stems from improper handling of /barangaymanagement/admin/?page=viewclearance,...

PHPGurukul Preschool Enrollment System Injection Vulnerability

Pre-School Enrollment System is a web-based preschool enrollment system. The Pre-School Enrollment System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter Status in file /admin/visitor-details.php. An...

CVE-2025-3975

A vulnerability was found in ScriptAndTools eCommerce-website-in-PHP 3.0 and classified as problematic. This issue affects some unknown processing of the file /admin/subscriber-csv.php. The manipulation leads to information disclosure. The attack may be initiated remotely. The exploit has been...

Men Salon Management System /admin/edit-customer-detailed.php File SQL Injection Vulnerability

Men Salon Management System a men's salon management system. The Men Salon Management System suffers from a SQL injection vulnerability that originates from insufficient input validation of the editid parameter in the /admin/edit-customer-detailed.php file. An attacker can use this vulnerability ...

CVE-2025-3821

A vulnerability was found in SourceCodester Web-based Pharmacy Product Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file add-admin.php. The manipulation of the argument txtpassword/txtfullname/txtemail leads to cross site scripting. Th...

CVE-2024-40068

Sourcecodester Online ID Generator System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at idgenerator/admin/?page=templates/managetemplate&id=1...

PT-2025-16794

Name of the Vulnerable Software and Affected Versions Sourcecodester Online ID Generator System version 1.0 Description The issue is related to a SQL injection vulnerability. It can be exploited via the id parameter at the API endpoint "/id generator/admin/?page=generate/index&id=1"...

PT-2025-16795

Name of the Vulnerable Software and Affected Versions Sourcecodester Online ID Generator System version 1.0 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the template parameter at the "/id generator/admin/?page=generate&template=4"...

CVE-2024-40073: Improper Neutralization of Special Elements used in an SQL Command

Sourcecodester Online ID Generator System 1.0 was discovered to contain a SQL injection vulnerability via the template parameter at idgenerator/admin/?page=generate&template=4...

CVE-2025-29389

PbootCMS v3.2.9 contains a XSS vulnerability in admin.php?p=/Content/index/mcode/2tab=t2...

PbootCMS security vulnerabilities

PbootCMS is a PbootCMS open source enterprise website content management system CMS developed using PHP language. A security vulnerability exists in PbootCMS version 3.2.9, which originates from cross-site scripting in the admin.php page...

CVE-2025-3337

A vulnerability was found in codeprojects Online Restaurant Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/memberupdate.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The...

CVE-2025-3244

CVE-2025-3244 affects SourceCodester Web-based Pharmacy Product Management System 1.0. The vulnerability is in the Create User Page’s file /add-admin.php, where manipulation of the Avatar parameter enables unrestricted file upload, with remote exploitation reported. Several connected sources conf...

LzCMS code-related vulnerabilities

LzCMS is a simple blogging system by the individual developer of phplaozhang. A code issue vulnerability exists in LzCMS 1.1.4 and earlier versions, which stems from improper operation of the File parameter in the /admin/upload/upimage.html file, which may result in arbitrary file uploads...

Withdrawn Advisory: Open WebUI Access Control

Withdrawn Advisory This advisory has been withdrawn because it does not describe a valid vulnerability. This link is maintained to preserve external references. Original Description In version v0.3.8 of open-webui/open-webui, there is an improper access control vulnerability. On the frontend admi...

CVE-2024-7040 Improper Access Control in open-webui/open-webui

In version v0.3.8 of open-webui/open-webui, there is an improper access control vulnerability. On the frontend admin page, administrators are intended to view only the chats of non-admin members. However, by modifying the userid parameter, it is possible to view the chats of any administrator,...

PHPGurukul Restaurant Table Booking System has a security vulnerability

Restaurant Table Booking System is a restaurant table reservation system. Restaurant Table Booking System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter username/mobileno in the...