CVE-2025-13346

CVE-2025-13346 affects SourceCodester Train Station Ticketing System v1.0. The vulnerability is in /ajax.php?action=save_station where manipulating id/station enables SQL injection. Reported as exploitable remotely with a public exploit; CVSS data indicate high/confidentiality/ integrity/availabi...

EUVD-2025-197961

The wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.2.2. This is due to the plugin not properly verifying that a user is authorized to access sensitive information via the AJAX...

CVE-2025-13345

A security vulnerability has been detected in SourceCodester Train Station Ticketing System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=saveticket. Such manipulation leads to sql injection. The attack can be launched remotely. The exploit has been...

CVE-2025-12639

The WordPress plugin wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions (WooCommerce) is affected by CVE-2025-12639. Versions up to and including 1.2.2 are vulnerable to an authorization bypass via an AJAX endpoint, enabling authenticated attackers with subscriber-level access and...

CVE-2025-12639 wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions | for WooCommerce <= 1.2.2 - Missing Authorization to Sensitive Information Disclosure

The wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.2.2. This is due to the plugin not properly verifying that a user is authorized to access sensitive information via the AJAX...

CVE-2025-12775 WP Dropzone <= 1.1.0 - Authenticated (Subscriber+) Arbitrary File Upload

The WP Dropzone plugin for WordPress is vulnerable to authenticated arbitrary file upload in all versions up to, and including, 1.1.0 via the ajaxuploadhandle function. This is due to the chunked upload functionality writing files directly to the uploads directory before any file type validation...

SourceCodester Train Station Ticketing System SQL注入漏洞

SourceCodester Train Station Ticketing System is SourceCodester open source a train station ticketing system. A SQL injection vulnerability exists in SourceCodester Train Station Ticketing System version 1.0, which stems from an incorrect operation of the function saveticket in the file /ajax.php...

PT-2025-47303

Name of the Vulnerable Software and Affected Versions SourceCodester Train Station Ticketing System version 1.0 Description A security issue exists in SourceCodester Train Station Ticketing System 1.0. The issue involves a SQL injection point within the application, specifically through...

PT-2025-47318

Name of the Vulnerable Software and Affected Versions Pixel Manager for WooCommerce – Track Conversions and Analytics, Google Ads, TikTok and more plugin for WordPress versions prior to 1.49.3 Description The software contains a flaw that allows unauthenticated attackers to extract data from...

SourceCodester Train Station Ticketing System SQL注入漏洞

SourceCodester Train Station Ticketing System is SourceCodester open source a train station ticketing system. A SQL injection vulnerability exists in SourceCodester Train Station Ticketing System version 1.0, which stems from an incorrect manipulation of the parameter Username in the file...

WordPress Survey Maker plugin unauthorized access vulnerability

WordPress Survey Maker plugin is a tool for creating questionnaires with support for multiple question types and data analysis features for businesses or individuals to collect user feedback. An unauthorized access vulnerability exists in the WordPress Survey Maker plugin, which stems from a lack...

PT-2025-47282

Name of the Vulnerable Software and Affected Versions wModes – Catalog Mode, Product Pricing, Enquiry Forms & Promotions plugin for WordPress versions up to and including 1.2.2 Description The plugin does not properly verify user authorization when accessing sensitive information through an AJAX...

PT-2025-47306

Name of the Vulnerable Software and Affected Versions SourceCodester Train Station Ticketing System version 1.0 Description A flaw exists in SourceCodester Train Station Ticketing System version 1.0 that allows for remote manipulation. Specifically, altering the id/station argument within the...

SourceCodester Train Station Ticketing System SQL注入漏洞

SourceCodester Train Station Ticketing System is SourceCodester open source a train station ticketing system. A SQL injection vulnerability exists in SourceCodester Train Station Ticketing System version 1.0, which stems from an incorrect manipulation of the parameter Username in the file...

CVE-2025-13286

A security flaw has been discovered in itsourcecode Online Voting System 1.0. The impacted element is an unknown function of the file /ajax.php?action=saveuser. Performing manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been...

CVE-2025-13286

CVE-2025-13286 affects itsourcecode Online Voting System 1.0. The vulnerability is an SQL injection in the parameter ID of the file "/ajax.php?action=save_user" caused by inadequate input validation. Remote exploitation is possible and exploit code has been publicly released. Connected sources id...

CVE-2025-13286 itsourcecode Online Voting System ajax.php sql injection

A security flaw has been discovered in itsourcecode Online Voting System 1.0. The impacted element is an unknown function of the file /ajax.php?action=saveuser. Performing manipulation of the argument ID results in sql injection. Remote exploitation of the attack is possible. The exploit has been...

CVE-2025-64084

An authenticated SQL injection vulnerability exists in Cloudlog 2.7.5 and earlier. The vuccdetailsajax function in application/controllers/Awards.php does not properly sanitize the user-supplied Gridsquare POST parameter. This allows a remote, authenticated attacker to execute arbitrary SQL...

CVE-2025-13273

A security flaw has been discovered in Campcodes School Fees Payment Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=deletepayment. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be...

CVE-2025-13274 Campcodes School Fees Payment Management System ajax.php sql injection

A weakness has been identified in Campcodes School Fees Payment Management System 1.0. Affected by this issue is some unknown functionality of the file /ajax.php?action=deletefees. Executing a manipulation of the argument ID can lead to sql injection. The attack may be performed from remote. The...