CVE-2025-0347

CVE-2025-0347 concerns code-projects Admission Management System 1.0, where the Login component’s file index.php is vulnerable. The underlying issue is an SQL injection caused by manipulation of the parameter u_id , allowing remote exploitation. Public exploitation is indicated across multiple so...

CVE-2025-0331 YunzMall HTTP POST Request ResetpwdController.php changePwd password recovery

A vulnerability, which was classified as critical, has been found in YunzMall up to 2.4.2. This issue affects the function changePwd of the file /app/platform/controllers/ResetpwdController.php of the component HTTP POST Request Handler. The manipulation of the argument pwd leads to weak password...

CVE-2024-13210 donglight bookstore电商书城系统说明 AdminBookController. java uploadPicture unrestricted upload

A vulnerability was found in donglight bookstore电商书城系统说明 1.0. It has been declared as critical. Affected by this vulnerability is the function uploadPicture of the file src/main/java/org/zdd/bookstore/web/controller/admin/AdminBookController. java. The manipulation of the argument pictureFile lea...

CVE-2024-13200

wander-chu SpringBoot-Blog 1.0 contains a critical flaw in the HTTP POST Request Handler: the preHandle function in BaseInterceptor.java has improper access controls, enabling remote exploitation. Multiple connected sources confirm the affected component and remote attack possibility, with public...

CVE-2024-13195 donglight bookstore电商书城系统说明 HttpUtil.java getHtml server-side request forgery

A vulnerability was found in donglight bookstore电商书城系统说明 1.0.0. It has been classified as critical. This affects the function getHtml of the file src/main/java/org/zdd/bookstore/rawl/HttpUtil.java. The manipulation of the argument url leads to server-side request forgery. It is possible to initia...

CVE-2024-13194

CVE-2024-13194 affects Sucms 1.0. The vulnerability is in the file /admin/admin_members.php?ac=search, where manipulation of the uid parameter leads to SQL injection. Exploitation is remote and the exploit has been disclosed publicly. The cited disclosures consistently describe this as a critical...

CVE-2024-13193 SEMCMS Image Library Management Page SEMCMS_Images.php sql injection

A vulnerability has been found in SEMCMS up to 4.8 and classified as critical. Affected by this vulnerability is an unknown functionality of the file SEMCMSImages.php of the component Image Library Management Page. The manipulation leads to sql injection. The attack can be launched remotely. The...

CVE-2024-13187

CVE-2024-13187 affects Kingsoft WPS Office 6.14.0 for macOS, with the vulnerable element being the TCC Handler. The documented impact is code injection that can be triggered by a local attacker on the host. Exploitation has been disclosed publicly per sources, and the vendor was not responsive to...

CVE-2025-0230 code-projects Responsive Hotel Site print.php sql injection

A vulnerability, which was classified as critical, was found in code-projects Responsive Hotel Site 1.0. Affected is an unknown function of the file /admin/print.php. The manipulation of the argument pid leads to sql injection. It is possible to launch the attack remotely. The exploit has been...

CVE-2024-13108

CVE-2024-13108 affects the D-Link DIR-816 A2 router (firmware version 1.10CNB05_R1B011D88210). The issue is an access control failure in the /goform/form2NetSniper.cgi handler that can be triggered remotely, with the exploit disclosed publicly. Multiple sources concur on improper access controls ...

CVE-2024-13104 D-Link DIR-816 A2 WiFi Settings form2AdvanceSetup.cgi access control

A vulnerability, which was classified as critical, was found in D-Link DIR-816 A2 1.10CNB05R1B011D88210. Affected is an unknown function of the file /goform/form2AdvanceSetup.cgi of the component WiFi Settings Handler. The manipulation leads to improper access controls. It is possible to launch t...

CVE-2024-13102

CVE-2024-13102 concerns a critical flaw in the D-Link DIR-816 A2 (firmware 1.10CNB05_R1B011D88210) where the DDNS Service’s /goform/DDNS path allows improper access control. The vulnerability enables remote attackers to manipulate DDNS settings and potentially access sensitive information. Multip...

CVE-2024-13092

CVE-2024-13092 affects code-projects Job Recruitment 1.0, specifically the Job Post Handler’s file _parse/_call_job/search_ajax.php. The vulnerability arises from improper handling of the parameter n, enabling SQL injection via remote access. Multiple sources confirm the impact and disclosure of ...

CVE-2024-13039 code-projects Simple Chat System add_user.php sql injection

A vulnerability was found in code-projects Simple Chat System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /adduser.php. The manipulation of the argument name/email/password/number leads to sql injection. The attack may be launched remotely...

CVE-2024-13035

A vulnerability has been found in code-projects Chat System 1.0 and classified as critical. This vulnerability affects unknown code of the file /admin/updateuser.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed t...

CVE-2024-13008

A vulnerability has been found in code-projects Responsive Hotel Site 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/newsletter.php. The manipulation of the argument eid leads to sql injection. The attack can be launched remotely. The...

CVE-2024-12948 code-projects Travel Management System detail.php sql injection

A vulnerability was found in code-projects Travel Management System 1.0. It has been classified as critical. This affects an unknown part of the file /detail.php. The manipulation of the argument pid leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2024-12931

CVE-2024-12931 affects code-projects Simple Admin Panel 1.0. The vulnerable element is an unknown function in the file /addCatController.php where manipulating the size parameter yields an SQL injection. This enables remote exploitation and the exploit has been publicly disclosed. Multiple source...

CVE-2024-12785

The CVE-2024-12785 vulnerability affects itsourcecode Vehicle Management System 1.0, specifically the sendmail.php file. The issue arises from unsafely handling the id (or idcabs) parameter, enabling SQL injection. Exploitation appears to be remote and has been publicly disclosed. Multiple connec...

CVE-2024-12784

Affected software: itsourcecode Vehicle Management System 1.0. The vulnerability exists in the editbill.php file, in the handling of the id parameter, where improper input handling leads to an SQL injection (root cause). Impact described as remote, with exploitation disclosed publicly; multiple d...