CVE-2025-9440 1000projects Online Project Report Submission and Evaluation System add_title.php cross site scripting

A security vulnerability has been detected in 1000projects Online Project Report Submission and Evaluation System 1.0. Affected by this issue is some unknown functionality of the file /admin/addtitle.php. Such manipulation of the argument Title leads to cross site scripting. The attack may be...

CVE-2025-52130

File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller. This flaw allows an authenticated attacker to upload arbitrary files, including PHP scripts, which can be accessed via direct GET requests, potentially resulting in remote code execution RC...

CVE-2025-56216

The phpgurukul Hospital Management System 4.0 is vulnerable to SQL Injection within the about-us.php file. The root cause is a lack of validation for externally-entered SQL statements provided via the pagetitle parameter. An attacker can exploit this flaw to execute unauthorized SQL commands and ...

Linux Distros Unpatched Vulnerability : CVE-2009-3581

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Multiple cross-site scripting XSS vulnerabilities in SQL-Ledger 2.8.24 allow remote authenticated users to inject arbitrary web script or HTML via 1 the DCN...

CVE-2025-27216

Multiple Incorrect Permission Assignment for Critical Resource in UISP Application may allow a malicious actor with certain permissions to escalate privileges...

CVE-2025-9134

A security vulnerability has been detected in AfterShip Package Tracker App up to 5.24.1 on Android. The affected element is an unknown function of the file AndroidManifest.xml of the component com.aftership.AfterShip. The manipulation leads to improper export of android application components. T...

CVE-2025-54925

CWE-918: Server-Side Request Forgery SSRF vulnerability exists that could cause unauthorized access to sensitive data when an attacker configures the application to access a malicious url...

CVE-2025-54017

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows PHP Local File Inclusion.This issue affects Paid Member Subscriptions: from n/a through = 2.15.4...

Hospital Management System SQL Injection Vulnerability

Hospital Management System is a PHP and MySQL based hospital management system. Hospital Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally-entered SQL statements in the parameter doctorspecilization in the file...

Online Shopping Portal Project signup.php File SQL Injection Vulnerability

Online Shopping Portal Project is an online shopping portal project. A SQL injection vulnerability exists in Online Shopping Portal Project, which originates from the lack of validation of externally entered SQL statements in the parameter emailid in the file /shopping/signup.php. An attacker can...

CVE-2025-51543

An issue was discovered in Cicool builder 3.4.4 allowing attackers to reset the administrator's password via the /administrator/auth/resetpassword endpoint...

CVE-2025-55287

CVE-2025-55287 affects Genealogy (PHP) versions prior to 4.4.0. The vulnerability is an authenticated stored XSS in the Person firstname/lastname, allowing an attacker (Editor+ or higher) to inject JavaScript that executes in other users’ sessions, potentially leading to session hijacking, data t...

PT-2025-33631 · 1&1 · Mail.Com App +1

Name of the Vulnerable Software and Affected Versions: 1&1 Mail & Media mail.com App version 8.8.0 Description: A security vulnerability has been detected due to improper export of Android application components. The issue affects an unknown function within the AndroidManifest.xml file of the...

CVE-2025-52620

HCL BigFix SaaS Authentication Service is affected by a Cross-Site Scripting XSS vulnerability. The image upload functionality inadequately validated the submitted image format...

CVE-2025-54729

CVE-2025-54729 refers to a stored Cross‑Site Scripting (XSS) vulnerability in the WordPress plugin Webba Booking (Lite) up to version 6.0.5 . The issue arises from improper input neutralization during web page generation, enabling stored XSS when data is rendered. Public records from NVD, CVE‑Lis...

CVE-2025-28975

CVE-2025-28975 corresponds to a WordPress plugin vulnerability in the Alike – WordPress Custom Post Comparison extension. The issue is a reflected Cross‑Site Scripting (XSS) flaw caused by improper neutralization of user input during web page generation, affecting versions up to and including 3.0...

CVE-2025-8908 Shanghai Lingdang Information Technology Lingdang CRM event.php sql injection

A vulnerability was determined in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.5.4. Affected by this issue is some unknown functionality of the file crm/WeiXinApp/yunzhijia/event.php. The manipulation of the argument openid leads to sql injection. The attack may be launched...

Exploit for Code Injection in Xwiki

CVE-2025-24893 – Unauthenticated Remote Code Execution in XWik...

PT-2025-32004 · Unknown · Onion-Site-Template

Name of the Vulnerable Software and Affected Versions: onion-site-template versions including commit 3196bd89 Description: onion-site-template, a complete and scalable Tor hidden service self-hosting sample, contains a baked-in Tor image when secrets are copied from an existing onion domain. A...

CVE-2025-8516

CVE-2025-8516 affects Kingdee Cloud-Starry-Sky Enterprise Edition up to 8.2. The vulnerability is in BaseServiceFactory.getFileUploadService.deleteFileAction within K3Cloud\BBCMallSite\WEB-INF\lib\Kingdee.K3.O2O.Base.WebApp.jar!kingdee\k3\o2o\base\webapp\action\FileUploadAction.class of the IIS-K...