CVE-2025-41003 Multiple vulnerabilities in Imaster products Open configuration options

Imaster's Patient Record Management System contains a stored Cross-Site Scripting XSS vulnerability in the endpoint ‘/projects/hospital/admin/editpatient.php’. By injecting a malicious script into the ‘firstname’ parameter, the JavaScript code is stored and executed every time a user accesses the...

CVE-2025-41003

The CVE-2025-41003 entry concerns Imaster’s Patient Record Management System, where a stored XSS vulnerability exists in the endpoint /projects/hospital/admin/edit_patient.php. The issue is triggered by injecting a malicious script into the firstname parameter, whose payload is persisted and exec...

CVE-2025-41003 Multiple vulnerabilities in Imaster products Open configuration options

Imaster's Patient Record Management System contains a stored Cross-Site Scripting XSS vulnerability in the endpoint ‘/projects/hospital/admin/editpatient.php’. By injecting a malicious script into the ‘firstname’ parameter, the JavaScript code is stored and executed every time a user accesses the...

Imaster Patient Record Management System 跨站脚本漏洞

Imaster Patient Record Management System is a patient record management system by the individual developer Nzioka Victor. The Imaster Patient Record Management System suffers from a cross-site scripting vulnerability that stems from insufficient validation of the firstname parameter in the endpoi...

PT-2026-2262

Name of the Vulnerable Software and Affected Versions Imaster Patient Record Management System affected versions not specified Description The software contains a stored Cross-Site Scripting XSS issue in the /projects/hospital/admin/edit patient.php endpoint. An attacker can inject a malicious...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key over the /addresses/addressId/edit endpoint, allowing the exposure of guest addresses. An attacker can retrieve address information belonging to guest users by sending requests for other...

Authorization Bypass Through User-Controlled Key

Overview spreestorefront is a modern fully featured storefront and checkout for Spree Commerce Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key over the /addresses/addressId/edit endpoint, allowing the exposure of guest addresses. An attacker ca...

CVE-2023-25169

discourse-yearly-review is a discourse plugin which publishes an automated Year in Review topic. In affected versions a user present in a yearly review topic that is then anonymised will still have some data linked to its original account. This issue has been patched in commit b3ab33bbf7 which is...

CVE-2023-43610

SQL injection vulnerability in Order Data Edit page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor without setting authority or higher privilege to perform unintended database operations...

CVE-2023-29906

H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the EditBasicSSID interface at /goform/aspForm...

CVE-2023-29192

SilverwareGames.io versions before 1.2.19 allow users with access to the game upload panel to edit download links for games uploaded by other developers. This has been fixed in version 1.2.19...

CVE-2023-29907

H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the EditBasicSSID5G interface at /goform/aspForm...

CVE-2023-31703

Cross Site Scripting XSS in the edit user form in Microworld Technologies eScan management console 14.0.1400.2281 allows remote attacker to inject arbitrary code via the from parameter...

CVE-2023-31944

SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the empid parameter at employeeedit.php...

CVE-2018-10726

A stored XSS vulnerability was found in Datenstrom Yellow 0.7.3 via an "Edit page" action. NOTE: the vendor disputes the relevance of this report because an installation accessible to untrusted users is supposed to have parserSafeMode=1 in system/config/config.ini to prevent XSS...

CVE-2018-18802

The Tubigan "Welcome to our Resort" 1.0 software allows CSRF via admin/modusers/controller.php?action=edit...

CVE-2018-19923

An issue was discovered in Sales & Company Management System SCMS through 2018-06-06. There is member/memberemail.php?action=edit CSRF...

CVE-2022-38621

Doufox v0.0.4 was discovered to contain a remote code execution RCE vulnerability via the edit file page. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file...

CVE-2022-38605

Church Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/editevent.php...

CVE-2022-23378

A Cross-Site Scripting XSS vulnerability exists within the 3.2.2 version of TastyIgniter. The "items%5B0%5D%5Bpath%5D" parameter of a request made to /admin/allergens/edit/1 is vulnerable...