GHSA-WW33-JPPQ-QFRP phpMyFAQ Vulnerable to Stored HTML Injection at FAQ

Summary Due to insufficient validation on the content of new FAQ posts, it is possible for authenticated users to inject malicious HTML or JavaScript code that can impact other users viewing the FAQ. This vulnerability arises when user-provided inputs in FAQ entries are not sanitized or escaped...

PT-2025-54191

Name of the Vulnerable Software and Affected Versions Composer versions prior to 2.2.26 Composer versions prior to 2.9.3 Description Composer, a dependency manager for PHP, may allow attackers who control remote sources from which Composer downloads to inject ANSI control characters into the...

PHPGurukul Land Record System 代码注入漏洞

PHPGurukul Land Record System is a land management system from PHPGurukul. A code injection vulnerability exists in PHPGurukul Land Record System version 1.0, which originates from the parameter Land Property Type in the file /admin/add-propertytype.php that results in cross-site scripting...

PHPGurukul Land Record System 代码注入漏洞

PHPGurukul Land Record System is a land management system from PHPGurukul Inc. A code injection vulnerability exists in PHPGurukul Land Record System version 1.0, which stems from the parameter Admin Name being vulnerable to cross-site scripting attacks...

Ghostty 代码注入漏洞

Ghostty is a fast, native, feature-rich terminal emulator from the Ghostty open source. A code injection vulnerability exists in Ghostty version 1.0.0. An attacker can exploit this vulnerability to execute arbitrary commands...

When Good Extensions Go Bad: Takeaways from the Campaign Targeting Browser Extensions

News has been making headlines over the weekend of the extensive attack campaign targeting browser extensions and injecting them with malicious code to steal user credentials. Currently, over 25 extensions, with an install base of over two million users, have been found to be compromised, and...

White-Jotter 代码注入漏洞

White-Jotter is an Antabot personal developer's front-end and back-end separation project using Vue+Spring Boot development, comes with a full set of development tutorials. Antabot White-Jotter 0.2.2 and earlier versions have a code injection vulnerability that originates from the component artic...

WordPress plugin Ninja Forms 代码注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code injection...

PHPGurukul Maid Hiring Management System 代码注入漏洞

Maid Hiring Management System is a maid hiring management system. The Maid Hiring Management System suffers from a cross-site scripting vulnerability that stems from a lack of adequate validation and escaping of the title parameter input in the file /admin/aboutus.php. An attacker can exploit thi...

PHPGurukul Maid Hiring Management System 代码注入漏洞

Maid Hiring Management System is a maid hiring management system. Maid Hiring Management System suffers from a cross-site scripting vulnerability in the file /admin/profile.php that stems from a lack of adequate validation and filtering of the input of the name parameter. No details of the...

SourceCodester Road Accident Map Marker 代码注入漏洞

SourceCodester Road Accident Map Marker is a SourceCodester open source road accident map marker project. A code injection vulnerability exists in SourceCodester Road Accident Map Marker version 1.0, which stems from a cross-site scripting attack due to incorrect manipulation of the markname...

PHPGurukul Maid Hiring Management System 代码注入漏洞

Maid Hiring Management System is a maid hiring management system. The Maid Hiring Management System suffers from a cross-site scripting vulnerability that stems from a lack of sufficient input validation of the searchdata parameter in file /admin/search-maid.php. An attacker could use this...

PHPGurukul Maid Hiring Management System 代码注入漏洞

Maid Hiring Management System is a maid hiring management system. Maid Hiring Management System suffers from a cross-site scripting vulnerability that stems from the lack of adequate validation and filtering of searchdata parameter inputs in the file /admin/search-booking-request.php. No details ...

Ruifang-tech Rebuild 代码注入漏洞

Ruifang-tech Rebuild is a zero-code, open-source and free enterprise management system from China Ruifang Ruifang-tech. A code injection vulnerability exists in Ruifang-tech Rebuild version 3.8.6, which stems from a misuse of the parameter description that can lead to cross-site scripting...

Code-Projects Online Car Rental System 代码注入漏洞

Code-Projects Online Car Rental System is an open source car rental system from Code-Projects. A code injection vulnerability exists in Code-Projects Online Car Rental System version 1.0, which originates from a cross-site scripting vulnerability contained in multiple parameters of the /index.php...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection due to an improper parsing of the TypeOne FontBBox. This is due to improper sanitization of the bbox values, which could lead to inconsistencies in font metrics or unexpected behavior. Remediation Upgrade...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection due to an improper parsing of the TypeOne FontBBox. This is due to improper sanitization of the bbox values, which could lead to inconsistencies in font metrics or unexpected behavior. Remediation Upgrade...

TOTOLINK A3002R Remote Code Injection Vulnerability

The TOTOLINK A3002R is a wireless dual-band Gigabit router. A remote code injection vulnerability exists in the TOTOLINK A3002R. The vulnerability is due to the ability to execute remote code in /bin/boa via formWsc in the affected version. An attacker can exploit this vulnerability to remotely...

Code-Projects Job Recruitment 代码注入漏洞

Code-Projects Job Recruitment is an open source job portal from Code-Projects. A code injection vulnerability exists in Code-Projects Job Recruitment version 1.0, which originates from a cross-site scripting vulnerability in the cname parameter of the /parse/alledits.php file...

DBShop 代码注入漏洞

DBShop is a generation of e-commerce system from China Longda Vantage DBShop Company. A code injection vulnerability exists in DBShop 3.3 Release 231225. An attacker exploits this vulnerability to cause a cross-site scripting attack by using the input %22%3E%3Csvg%20onload=alert5888%3E incorrectl...