CVE-2025-48063 XWiki Platform Security Authorization Bridge allows users with just edit right can enforce required rights with programming right

XWiki is a generic wiki platform. In XWiki 16.10.0, required rights were introduced as a way to limit which rights a document can have. Part of the security model of required rights is that a user who doesn't have a right also cannot define that right as required right. That way, users who are...

CVE-2025-48063 XWiki Platform Security Authorization Bridge allows users with just edit right can enforce required rights with programming right

XWiki is a generic wiki platform. In XWiki 16.10.0, required rights were introduced as a way to limit which rights a document can have. Part of the security model of required rights is that a user who doesn't have a right also cannot define that right as required right. That way, users who are...

CampCodes Online Shopping Portal 代码问题漏洞

CampCodes Online Shopping Portal is an online shopping portal from CampCodes, Inc. A code issue vulnerability exists in CampCodes Online Shopping Portal version 1.0, which stems from improper manipulation of the productimage1/productimage2/productimage3 parameter in file...

Nipah virus Testing Management System /edit-phlebotomist.php File SQL Injection Vulnerability

Nipah Virus Testing Management System is an online virus diagnostic platform. Nipah Virus Testing Management System suffers from a SQL injection vulnerability that originates from improper manipulation of the parameter mobilenumber in the file /edit-phlebotomist.php, no details of the vulnerabili...

CampCodes Online Shopping Portal 注入漏洞

CampCodes Online Shopping Portal is an online shopping portal from CampCodes, Inc. An injection vulnerability exists in CampCodes Online Shopping Portal version 1.0, which stems from improper manipulation of the Category parameter in the file /admin/edit-category.php, which could lead to SQL...

CampCodes Online Shopping Portal 注入漏洞

CampCodes Online Shopping Portal is an online shopping portal from CampCodes, Inc. An injection vulnerability exists in CampCodes Online Shopping Portal version 1.0, which stems from improper manipulation of the Category parameter in the file /admin/edit-products.php, which could lead to SQL...

CVE-2025-44896

FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the bindEditMACName parameter in the webaclbindEditpost function...

CVE-2025-44898

FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the theauthName parameter in the webaaaloginAuthlistEdit function...

CVE-2025-44886

FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the byruleEditName parameter in the webaclmgmtRulesEditpostcontains function...

Directory Management System /admin/edit-directory.php File SQL Injection Vulnerability

Directory Management System is a directory management system. Directory Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter editid in the file /admin/edit-directory.php. An attacker can...

Vehicle Record Management System /edit-brand.php file cross-site scripting vulnerability

Vehicle Record Management System is a vehicle record management system. Vehicle Record Management System suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in /edit-brand.php, which can be exploited by an attacker t...

CVE-2025-44896

FW-WGS-804HPT v1.305b241111 was discovered to contain a stack overflow via the bindEditMACName parameter in the webaclbindEditpost function...

Patient Record Management System edit_upatient.php File SQL Injection Vulnerability

Patient Record Management System is a medical record management system. Patient Record Management System suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the ID parameter of the /editupatient.php file. An attacker can exploi...

PLANET FW-WGS-804HPT 安全漏洞

PLANET FW-WGS-804HPT is a wall-mounted managed switch from PLANET China. A security vulnerability exists in PLANET FW-WGS-804HPT v1.305b241111, which originates from a stack overflow in the tacIp parameter of the webtacplusserverEditpost function...

Vehicle Record Management System /edit-vehicle.php File Cross-Site Scripting Vulnerability

Vehicle Record Management System is a vehicle record management system. Vehicle Record Management System has a cross-site scripting vulnerability that originates from the lack of effective filtering and escaping of user-supplied data in the vehiclename parameter in /admin/edit-vehicle.php, which...

PYSEC-2025-180

OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.5.2, any user with the capability manage customizations can edit webhook that will execute javascript code. This can be abused to cause a denial of service attack by prototype...

CVE-2025-4934

A vulnerability has been found in PHPGurukul User Registration & Login and User Management System 3.3 and classified as critical. This vulnerability affects unknown code of the file /edit-profile.php. The manipulation of the argument Contact leads to sql injection. The attack can be initiated...

CVE-2025-4934

CVE-2025-4934 affects PHPGurukul User Registration & Login and User Management System 3.3. The vulnerability is in unknown code of /edit-profile.php where manipulating the Contact parameter triggers an SQL injection. Exploitation is possible remotely and has been disclosed publicly. Multiple sour...

CVE-2025-4928

A vulnerability was found in projectworlds Online Lawyer Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /savelawyereditprofile.php. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been...

CVE-2025-4928

CVE-2025-4928 concerns the Projectworlds Online Lawyer Management System v1.0. Multiple connected sources confirm a SQL injection in the unknown-code path /save_lawyer_edit_profile.php that can be exploited remotely and with public disclosure. The evidence consistently states the issue is critica...