CVE-2025-4021

CVE-2025-4021 affects code-projects Patient Record Management System 1.0. The vulnerability is an SQL injection in an unknown part of the file /edit_spatient.php driven by manipulation of the ID parameter, with remote exploitation possible. Exploit has been disclosed publicly. Connected sources c...

PT-2025-18066 · Unknown · Novel-Plus

Name of the Vulnerable Software and Affected Versions: Novel-Plus versions 20120630 up to 0e156c04b4b7ce0563bef6c97af4476fcda8f160 Description: A critical vulnerability was found in Novel-Plus, affecting the genCode function of the GeneratorController.java file. The manipulation leads to missing...

CVE-2025-3968 codeprojects News Publishing Site Dashboard api.php sql injection

A vulnerability was found in codeprojects News Publishing Site Dashboard 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /api.php. The manipulation of the argument catid leads to sql injection. The attack can be initiated remotely. The exploit has been...

CVE-2025-3829

A vulnerability was found in PHPGurukul Men Salon Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/sales-reports-detail.php. The manipulation of the argument fromdate/todate leads to sql injection. It is possible to launch the attack...

CVE-2025-3807

A vulnerability, which was classified as critical, was found in zhenfeng13 My-BBS 1.0. This affects the function Upload of the file src/main/java/com/my/bbs/controller/common/UploadController.java of the component Endpoint. The manipulation leads to unrestricted upload. It is possible to initiate...

CVE-2025-3802 Tenda W12/i24 httpd cgiPingSet stack-based overflow

A vulnerability was found in Tenda W12 and i24 3.0.0.42887/3.0.0.53644. It has been declared as critical. This vulnerability affects the function cgiPingSet of the file /bin/httpd. The manipulation of the argument pingIP leads to stack-based buffer overflow. The attack can be initiated remotely...

CVE-2025-3798 WCMS Advertisement Image AdvadminController.php sub unrestricted upload

A vulnerability, which was classified as critical, has been found in WCMS 11. This issue affects the function sub of the file app/admin/AdvadminController.php of the component Advertisement Image Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The...

CVE-2025-3765 SourceCodester Web-based Pharmacy Product Management System edit-photo.php unrestricted upload

A vulnerability, which was classified as critical, has been found in SourceCodester Web-based Pharmacy Product Management System 1.0. This issue affects some unknown processing of the file /edit-photo.php. The manipulation of the argument Avatar leads to unrestricted upload. The attack may be...

CVE-2025-3685

The CVE-2025-3685 entry concerns code-projects Patient Record Management System 1.0. The vulnerability is a SQL injection in the file /edit_fpatient.php, exploitable by manipulating the ID parameter. The issue is described as remote-exploitable, with public disclosure of the exploit. Connected so...

CVE-2025-3665 TOTOLINK A3700R cstecgi.cgi setSmartQosCfg access control

A vulnerability has been found in TOTOLINK A3700R 9.1.2u.5822B20200513 and classified as critical. Affected by this vulnerability is the function setSmartQosCfg of the file /cgi-bin/cstecgi.cgi. The manipulation leads to improper access controls. The attack can be launched remotely. The exploit h...

CVE-2025-3536

A vulnerability was found in Tutorials-Website Employee Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/delete-user.php. The manipulation of the argument ID leads to improper authorization. The attack may be launched...

CVE-2025-3590 Adianti Framework deserialization

A vulnerability has been found in Adianti Framework up to 8.0 and classified as critical. Affected by this vulnerability is an unknown functionality. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used...

CVE-2025-3589 SourceCodester Music Class Enrollment System manage_class.php sql injection

A vulnerability, which was classified as critical, was found in SourceCodester Music Class Enrollment System 1.0. Affected is an unknown function of the file /manageclass.php. The manipulation of the argument ID leads to sql injection. It is possible to launch the attack remotely. The exploit has...

CVE-2025-3587 ZeroWdd/code-projects studentmanager getTeacherList improper authorization

A vulnerability classified as critical was found in ZeroWdd/code-projects studentmanager 1.0. This vulnerability affects unknown code of the file /getTeacherList. The manipulation leads to improper authorization. The attack can be initiated remotely. The exploit has been disclosed to the public a...

CVE-2025-3571

CVE-2025-3571 affects Fannuo Enterprise Content Management System versions 1.1 through 4.0, specifically the code path in file admin/cms_chip.php where the parameter del is manipulated, leading to a SQL injection. The vulnerability can be exploited remotely, and the exploit has been disclosed pub...

CVE-2025-3553 phpshe admin.php pe_delete sql injection

A vulnerability was found in phpshe 1.8. It has been declared as critical. This vulnerability affects the function pedelete of the file /admin.php?mod=brand&act=del. The manipulation of the argument brandid leads to sql injection. The attack can be initiated remotely. The exploit has been disclos...

CVE-2025-3552

...

CVE-2025-3350

A vulnerability, which was classified as critical, was found in PHPGurukul Old Age Home Management System 1.0. Affected is an unknown function of the file /admin/view-enquiry.php. The manipulation of the argument viewid leads to sql injection. It is possible to launch the attack remotely. The...

CVE-2025-3336

A vulnerability was found in codeprojects Online Restaurant Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/membersave.php. The manipulation of the argument last leads to sql injection. The attack can be initiated remotely. The...

CVE-2025-3330

A vulnerability classified as critical was found in codeprojects Online Restaurant Management System 1.0. This vulnerability affects unknown code of the file /reservationsave.php. The manipulation of the argument first leads to sql injection. The attack can be initiated remotely. The exploit has...