CVE-2025-10417

A security flaw has been discovered in Campcodes Grocery Sales and Inventory System 1.0. Affected is an unknown function of the file /ajax.php?action=deleteproduct. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been...

CVE-2025-10416

A vulnerability was identified in Campcodes Grocery Sales and Inventory System 1.0. This impacts an unknown function of the file /ajax.php?action=deletesupplier. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly...

CVE-2025-10416

A vulnerability was identified in Campcodes Grocery Sales and Inventory System 1.0. This impacts an unknown function of the file /ajax.php?action=deletesupplier. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly...

CVE-2025-10417 Campcodes Grocery Sales and Inventory System ajax.php sql injection

A security flaw has been discovered in Campcodes Grocery Sales and Inventory System 1.0. Affected is an unknown function of the file /ajax.php?action=deleteproduct. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been...

CVE-2025-10417

CVE-2025-10417 affects Campcodes Grocery Sales and Inventory System 1.0. The vulnerability lies in the file /ajax.php?action=delete_product where manipulating the parameter ID results in a SQL injection, enabling remote exploitation. Multiple connected sources confirm the flaw and that exploits h...

CVE-2025-10417 Campcodes Grocery Sales and Inventory System ajax.php sql injection

A security flaw has been discovered in Campcodes Grocery Sales and Inventory System 1.0. Affected is an unknown function of the file /ajax.php?action=deleteproduct. The manipulation of the argument ID results in sql injection. It is possible to launch the attack remotely. The exploit has been...

PT-2025-37437

Name of the Vulnerable Software and Affected Versions: Campcodes Grocery Sales and Inventory System version 1.0 Description: A security flaw has been discovered that allows for SQL injection. The vulnerability exists in an unknown function within the /ajax.php?action=delete product file...

CVE-2025-59376

feiskyer mcp-kubernetes-server through 0.1.11 does not consider chained commands in the implementation of --disable-write and --disable-delete, e.g., it allows a "kubectl version; kubectl delete pod" command because the first word i.e., "version" is not a write or delete operation...

CVE-2025-59376

The CVE-2025-59376 entry concerns feiskyer’s mcp-kubernetes-server (through v0.1.11). The issue is improper handling of chained commands in the --disable-write/--disable-delete logic: commands like kubectl version; kubectl delete pod may bypass restrictions because only the first token is checked...

Gotac Statistical Database System 访问控制错误漏洞

Gotac Statistical Database System is a statistical database system from Gotac Corporation in Taiwan, China. An access control error vulnerability exists in the Gotac Statistical Database System, which stems from a lack of authentication, and could allow an unauthenticated, remote attacker to read...

PT-2025-37505

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The mmc add host function may return an error, and ignoring this return value can lead to a memory leak. This memory leak occurs because memory allocated in mmc alloc host is not freed...

PT-2025-37444

Name of the Vulnerable Software and Affected Versions: Gotac Statistical Database System affected versions not specified Description: The Gotac Statistical Database System has a Missing Authentication vulnerability. This allows unauthenticated remote attackers to read, modify, and delete database...

CVE-2025-59376

feiskyer mcp-kubernetes-server through 0.1.11 does not consider chained commands in the implementation of --disable-write and --disable-delete, e.g., it allows a "kubectl version; kubectl delete pod" command because the first word i.e., "version" is not a write or delete operation...

FreePBX 路径遍历漏洞

FreePBX formerly known as Asterisk Management Portal is a suite of tools from the FreePBX project for configuring Asterisk an IP telephony system via a GUI web-based graphical interface. A path traversal vulnerability exists in FreePBX versions 15, 16, and 17, which stems from a malicious...

CVE-2025-59376

feiskyer mcp-kubernetes-server through 0.1.11 does not consider chained commands in the implementation of --disable-write and --disable-delete, e.g., it allows a "kubectl version; kubectl delete pod" command because the first word i.e., "version" is not a write or delete operation...

PT-2025-37488

Name of the Vulnerable Software and Affected Versions feiskyer mcp-kubernetes-server versions through 0.1.11 Description The software does not properly handle chained commands when using the --disable-write and --disable-delete options. Specifically, it allows commands containing chained operatio...

CampCodes Grocery Sales and Inventory System SQL注入漏洞

CampCodes Grocery Sales and Inventory System is a grocery sales and inventory system from CampCodes Philippines. A SQL injection vulnerability exists in CampCodes Grocery Sales and Inventory System version 1.0, which stems from incorrect manipulation of the parameter ID in the file...

CVE-2025-10416 Campcodes Grocery Sales and Inventory System ajax.php sql injection

A vulnerability was identified in Campcodes Grocery Sales and Inventory System 1.0. This impacts an unknown function of the file /ajax.php?action=deletesupplier. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly...

CVE-2025-10416 Campcodes Grocery Sales and Inventory System ajax.php sql injection

A vulnerability was identified in Campcodes Grocery Sales and Inventory System 1.0. This impacts an unknown function of the file /ajax.php?action=deletesupplier. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly...

CVE-2025-10416

Campcodes Grocery Sales and Inventory System 1.0 has a SQL injection vulnerability in /ajax.php?action=delete_supplier caused by unsafely handling the ID parameter. This remote‑accessible flaw can lead to unauthorized database access and manipulation; public exploits exist. Root cause: improper i...