CVE-2023-49971

CVE-2023-49971 Customer Support System 1.0 - "customerlist" ページの "firstname" フィールド/パラメータにおけるクロスサイトスクリプティング XSS 脆弱性 説明 : Customer Support System 1.0 は、ストアド XSS に対して脆弱です。XSS 脆弱性は Customer Support System のバージョン 1 に存在します。悪意のある攻撃者は、顧客の編集または作成時に "firstname" フィールド/パラメータを介して JavaScript...

CVE-2025-7840

CVE-2025-7840 用 XSS エクスプロイト 作者 : Byte Reaper @ByteReaper0 説明 CVE-2025-7840 の概念実証エクスプロイト。予約フォームの Firstname パラメータにおけるユーザー入力のサニタイズが不十分な脆弱な Web アプリケーションエンドポイントを標的としています。次のような GET リクエストを作成することで: root@kitploit: /index.php?page=reserve&Firstname=&Lastname=test 攻撃者はレスポンスがレンダリングされた際に被害者のブラウザで任意の JavaScrip...

EUVD-2026-72182

A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/custtransac.php?action=add. The manipulation of the argument firstname results in sql injection. It is possible to launch the attack remotely. The exploit is now public and...

CVE-2026-86234

A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/custtransac.php?action=add. The manipulation of the argument firstname results in sql injection. It is possible to launch the attack remotely. The exploit is now public and...

CVE-2026-86234

CVE-2026-86234 affects itsourcecode Sales and Inventory System version 1.0. A SQL injection vulnerability exists in the file /pages/cust_transac.php (with the action=add parameter), triggered through manipulation of the firstname argument. The attack can be launched remotely and requires low priv...

CVE-2026-86234 itsourcecode Sales and Inventory System cust_transac.php add sql injection

A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/custtransac.php?action=add. The manipulation of the argument firstname results in sql injection. It is possible to launch the attack remotely. The exploit is now public and...

CVE-2026-85403

A flaw has been found in code-projects Doctor Appointment System 1.0. This issue affects some unknown processing of the file /contactus.php. This manipulation of the argument firstname causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be...

EUVD-2026-70874

A flaw has been found in code-projects Doctor Appointment System 1.0. This issue affects some unknown processing of the file /contactus.php. This manipulation of the argument firstname causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be...

CVE-2026-85403

A SQL injection vulnerability exists in code-projects Doctor Appointment System 1.0 via the firstname argument in /contactus.php. The flaw allows remote exploitation with no required privileges or user interaction, rated CVSS 3.1: 7.3 (HIGH) . The exploit has been published with proof-of-concept ...

CVE-2026-85403 code-projects Doctor Appointment System contactus.php sql injection

A flaw has been found in code-projects Doctor Appointment System 1.0. This issue affects some unknown processing of the file /contactus.php. This manipulation of the argument firstname causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be...

CVE-2026-84438

A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/controller/account/edit.php of the component Autocomplete Workflow. This manipulation of the argument firstname causes cross site scripting. The attack can be initiated remotely. The...

CVE-2026-84438

OpenCart 4.1.0.3 and 4.1.0.4 are affected by a stored cross-site scripting (XSS) vulnerability in the Autocomplete Workflow component, specifically in the file catalog/controller/account/edit.php. The vulnerability is triggered through manipulation of the firstname argument, allowing a remote, au...

EUVD-2026-69801

A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/controller/account/edit.php of the component Autocomplete Workflow. This manipulation of the argument firstname causes cross site scripting. The attack can be initiated remotely. The...

CVE-2026-84438 OpenCart Autocomplete Workflow edit.php cross site scripting

A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/controller/account/edit.php of the component Autocomplete Workflow. This manipulation of the argument firstname causes cross site scripting. The attack can be initiated remotely. The...

EUVD-2026-31703

A vulnerability was detected in yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203. This impacts an unknown function of the file /student.php. Performing a manipulation of the argument FIRSTNAME results in cross site scripting. The attack can be initiated remotely...

PT-2026-43086

A vulnerability was detected in yashpokharna2555 StudentManagementSystem cb2f558ddf8d19396de0f92abf2d224d46a0a203. This impacts an unknown function of the file /student.php. Performing a manipulation of the argument FIRST NAME results in cross site scripting. The attack can be initiated remotely...

CVE-2021-47956

EgavilanMedia PHPCRUD 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the firstname parameter. Attackers can send POST requests to insert.php with malicious firstname values to extract sensitive databas...

CVE-2021-47956

The connected documents identify CVE-2021-47956 as affecting EgavilanMedia PHPCRUD 1.0 and describe a SQL injection vulnerability allowing unauthenticated attackers to manipulate database queries via the firstname parameter. Exploitation details include sending crafted POST requests to insert.php...

EUVD-2021-34824

EgavilanMedia PHPCRUD 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the firstname parameter. Attackers can send POST requests to insert.php with malicious firstname values to extract sensitive databas...

CVE-2021-47956

EgavilanMedia PHPCRUD 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the firstname parameter. Attackers can send POST requests to insert.php with malicious firstname values to extract sensitive databas...