CVE-2025-2353 VAM Virtual Airlines Manager HTTP GET Parameter index.php sql injection

A vulnerability, which was classified as critical, was found in VAM Virtual Airlines Manager up to 2.6.2. Affected is an unknown function of the file /vam/index.php of the component HTTP GET Parameter Handler. The manipulation of the argument ID/registryid/planeicao leads to sql injection. It is...

CVE-2025-2353 VAM Virtual Airlines Manager HTTP GET Parameter index.php sql injection

A vulnerability, which was classified as critical, was found in VAM Virtual Airlines Manager up to 2.6.2. Affected is an unknown function of the file /vam/index.php of the component HTTP GET Parameter Handler. The manipulation of the argument ID/registryid/planeicao leads to sql injection. It is...

CVE-2025-2353

CVE-2025-2353 affects VAM Virtual Airlines Manager (up to 2.6.2). The root cause is SQL injection in an HTTP GET parameter handler in the /vam/index.php file, via the arguments ID/registry_id/plane_icao. This permits remote exploitation and can lead to unauthorized database access or manipulation...

CVE-2025-2126

A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla and classified as critical. This issue affects some unknown processing of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties of the component GET Parameter Handler. The manipulation of the...

CVE-2025-2126 JoomlaUX JUX Real Estate GET Parameter realties sql injection

A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla and classified as critical. This issue affects some unknown processing of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties of the component GET Parameter Handler. The manipulation of the...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the $GET"id" parameter because of improper user input sanitization. An attacker can execute arbitrary code or access sensitive user information by injecting malicious scripts into this parameter. Details...

CVE-2024-45059

i-Educar is free, fully online school management software that can be used by school secretaries, teachers, coordinators, and area managers. A SQL Injection vulnerability was found prior to the 2.9 branch in the ieducar/intranet/funcionariovinculodet.php file, which creates the query by...

Selesta Visual Access Manager SQL Injection Vulnerability (CNVD-2025-22657)

Selesta Visual Access Manager is a visual access manager from Selesta. A SQL injection vulnerability exists in Selesta Visual Access Manager. The vulnerability stems from the application's lack of validation of externally entered SQL statements, which can be exploited by an attacker to perform SQ...

CVE-2023-42236

An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in a GET parameter of /common/ajaxfunction.php...

CVE-2023-42242

An issue was discovered in Selesta Visual Access Manager VAM prior to 4.42.2. An authenticated attacker can perform SQL Injection in a GET parameter of /monitor/sterminal.php...

PT-2025-1468 · Selesta · Selesta Visual Access Manager

Name of the Vulnerable Software and Affected Versions: Selesta Visual Access Manager VAM versions prior to 4.42.2 Description: An issue was discovered in Selesta Visual Access Manager VAM where an authenticated attacker can perform SQL Injection in a GET parameter of "/monitor/s terminal.php"...

Selesta Visual Access Manager 安全漏洞

Selesta Visual Access Manager is a visual access manager from Selesta. A SQL injection vulnerability exists in Selesta Visual Access Manager. The vulnerability stems from the application's lack of validation of externally entered SQL statements, which can be exploited by an attacker to perform SQ...

PT-2025-1462 · Selesta · Selesta Visual Access Manager

Name of the Vulnerable Software and Affected Versions: Selesta Visual Access Manager VAM versions prior to 4.42.2 Description: An issue was discovered in Selesta Visual Access Manager VAM where an authenticated attacker can perform SQL Injection in a GET parameter of "/common/ajaxfunction.php"...

Selesta Visual Access Manager 安全漏洞

Selesta Visual Access Manager is a visual access manager from Selesta. Selesta Visual Access Manager suffers from a SQL injection vulnerability that stems from a lack of validation of the GET parameter of /common/ajaxfunction.php against an externally entered SQL statement. An attacker can exploi...

Selesta Visual Access Manager 安全漏洞

Selesta Visual Access Manager is a visual access manager from Selesta. A SQL injection vulnerability exists in Selesta Visual Access Manager. An attacker can exploit this vulnerability to perform SQL injection in the GET parameter of /monitor/sterminal.php...

CVE-2024-57687

An OS Command Injection vulnerability was found in /landrecordsys/admin/dashboard.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the "Cookie" GET request parameter...

CVE-2024-11717

Tokens in CTFd used for account activation and password resetting can be used interchangeably for these operations. When used, they are sent to the server as a GET parameter and they are not single use, which means, that during token expiration time an on-path attacker might reuse such a token to...

PT-2025-1978 · Kentico · Kentico Cms

Name of the Vulnerable Software and Affected Versions: Kentico CMS version 7 Description: The issue is a Reflected XSS attack that occurs through the manipulation of a specific GET request parameter sent to the "/CMSMessages/AccessDenied.aspx" endpoint. Support for Kentico CMS version 7 ended in...

PT-2024-17207 · Ctfd · Ctfd

Name of the Vulnerable Software and Affected Versions: CTFd versions prior to 3.7.5 Description: The issue concerns tokens used for account activation and password resetting in CTFd, which can be used interchangeably for these operations. When used, they are sent to the server as a GET parameter...

CVE-2024-12998

A vulnerability, which was classified as problematic, was found in code-projects Online Car Rental System 1.0. This affects an unknown part of the file /index.php of the component GET Parameter Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely...