CVE-2025-7840

CVE-2025-7840 XSS漏洞利用工具 作者 : Byte Reaper @ByteReaper0 描述 针对 CVE-2025-7840 的概念验证利用代码，目标是预订表单中 Firstname 参数未正确清理用户输入的可疑 Web 应用端点。通过构造如下 GET 请求： /index.php?page=reserve&Firstname=&Lastname=test 攻击者可以在受害者浏览器渲染响应时注入并执行任意 JavaScript。 功能特性 通过 -b 选项注入自定义载荷 通过 -c 选项处理基于 Cookie 的会话 详细日志记录，用于请求/响应分析（-v）...

SQL Injection Vulnerability in Sales and Inventory System (CNVD-2026-37981)

Sales and Inventory System is an enterprise resource planning system for sales and inventory management developed by itsourcecode. The Sales and Inventory System has a SQL injection vulnerability, which stems from incorrect handling of the parameter “firstname” in the...

EUVD-2026-77055

A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/emptransac.php?action=add. The manipulation of the argument firstname results in sql injection. The attack may be performed from remote. The exploit has been...

CVE-2026-90574

CVE-2026-90574 affects itsourcecode Sales and Inventory System 1.0 , specifically the file /pages/emp_transac.php?action=add. The SQL injection is triggered by manipulating the firstname argument, allowing a remote attacker with low privileges to compromise data. CVSS 3.1 scores it 6.3 (MEDIUM) w...

CVE-2026-90574 itsourcecode Sales and Inventory System emp_transac.php add sql injection

A security flaw has been discovered in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/emptransac.php?action=add. The manipulation of the argument firstname results in sql injection. The attack may be performed from remote. The exploit has been...

CVE-2026-90525

A weakness has been identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/custpostrans.php. Executing a manipulation of the argument firstname can lead to sql injection. The attack may be launched remotely. The exploit has been made availab...

EUVD-2026-77023

A weakness has been identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/custpostrans.php. Executing a manipulation of the argument firstname can lead to sql injection. The attack may be launched remotely. The exploit has been made availab...

CVE-2026-90525 itsourcecode Sales and Inventory System cust_pos_trans.php sql injection

A weakness has been identified in itsourcecode Sales and Inventory System 1.0. This affects an unknown function of the file /pages/custpostrans.php. Executing a manipulation of the argument firstname can lead to sql injection. The attack may be launched remotely. The exploit has been made availab...

PT-2026-90862

Name of the Vulnerable Software and Affected Versions itsourcecode Sales and Inventory System version 1.0 Description A remote SQL injection exists in the /pages/cust pos trans.php endpoint. This issue occurs when the firstname variable is manipulated, allowing an attacker to execute unauthorized...

PT-2026-90931

Name of the Vulnerable Software and Affected Versions itsourcecode Sales and Inventory System version 1.0 Description A remote SQL injection flaw exists in the file /pages/emp transac.php?action=add. The issue occurs when the firstname argument is manipulated, allowing an attacker to execute...

CVE-2026-86234

A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/custtransac.php?action=add. The manipulation of the argument firstname results in sql injection. It is possible to launch the attack remotely. The exploit is now public and...

CVE-2026-86234 itsourcecode Sales and Inventory System cust_transac.php add sql injection

A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/custtransac.php?action=add. The manipulation of the argument firstname results in sql injection. It is possible to launch the attack remotely. The exploit is now public and...

CVE-2026-86234

CVE-2026-86234 affects itsourcecode Sales and Inventory System version 1.0. A SQL injection vulnerability exists in the file /pages/cust_transac.php (with the action=add parameter), triggered through manipulation of the firstname argument. The attack can be launched remotely and requires low priv...

CVE-2026-86234 itsourcecode Sales and Inventory System cust_transac.php add sql injection

A vulnerability was detected in itsourcecode Sales and Inventory System 1.0. This affects an unknown part of the file /pages/custtransac.php?action=add. The manipulation of the argument firstname results in sql injection. It is possible to launch the attack remotely. The exploit is now public and...

CVE-2026-85403 code-projects Doctor Appointment System contactus.php sql injection

A flaw has been found in code-projects Doctor Appointment System 1.0. This issue affects some unknown processing of the file /contactus.php. This manipulation of the argument firstname causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be...

CVE-2026-85403

A SQL injection vulnerability exists in code-projects Doctor Appointment System 1.0 via the firstname argument in /contactus.php. The flaw allows remote exploitation with no required privileges or user interaction, rated CVSS 3.1: 7.3 (HIGH) . The exploit has been published with proof-of-concept ...

EUVD-2026-69801

A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/controller/account/edit.php of the component Autocomplete Workflow. This manipulation of the argument firstname causes cross site scripting. The attack can be initiated remotely. The...

CVE-2026-84438 OpenCart Autocomplete Workflow edit.php cross site scripting

A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/controller/account/edit.php of the component Autocomplete Workflow. This manipulation of the argument firstname causes cross site scripting. The attack can be initiated remotely. The...

CVE-2026-84438 OpenCart Autocomplete Workflow edit.php cross site scripting

A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/controller/account/edit.php of the component Autocomplete Workflow. This manipulation of the argument firstname causes cross site scripting. The attack can be initiated remotely. The...

CVE-2021-47956

EgavilanMedia PHPCRUD 1.0 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the firstname parameter. Attackers can send POST requests to insert.php with malicious firstname values to extract sensitive databas...