1514 matches found
CVE-2025-4817: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was found in Sourcecodester Doctor's Appointment System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/delete-appointment.php of the component GET Parameter Handler. The manipulation of the argument ID leads to sql injection. The...
The vulnerability of the PCMan FTP Server relates to the occurrence of operations beyond the buffer boundaries in memory. This allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the PCMan FTP Server relates to the execution of operations beyond the buffer boundaries during the processing of the mget parameter. Exploiting this vulnerability allows a remote attacker to compromise the confidentiality, integrity, and accessibility of the protected...
CVE-2025-32389
NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Prior to version 2.1.4, NamelessMC is vulnerable to SQL injection by providing an unexpected square bracket GET parameter syntax. Square bracket GET parameter syntax refers to the structure...
CVE-2025-32389 NamelessMC Vulnerable to SQL Injections in /user/messaging and /panel/users/reports Pages
NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Prior to version 2.1.4, NamelessMC is vulnerable to SQL injection by providing an unexpected square bracket GET parameter syntax. Square bracket GET parameter syntax refers to the structure...
CVE-2025-32389
CVE-2025-32389 concerns NamelessMC prior to 2.1.4, where an SQL injection could be triggered by the square bracket GET parameter syntax (e.g., ?param[0]=a¶m[1]=b¶m[2]=c). The underlying issue is PHP parsing $_GET['param'] as an array when square-bracket syntax is used, enabling injection ...
CVE-2025-32389: Improper Neutralization of Special Elements used in an SQL Command
NamelessMC is a free, easy to use & powerful website software for Minecraft servers. Prior to version 2.1.4, NamelessMC is vulnerable to SQL injection by providing an unexpected square bracket GET parameter syntax. Square bracket GET parameter syntax refers to the structure...
NamelessMC SQL注入漏洞
NamelessMC is a free, easy to use and powerful website software from the NamelessMC team. Suitable for your Minecraft server, it contains tons of features. A SQL injection vulnerability exists in NamelessMC versions prior to 2.1.4, which stems from the square bracketed GET parameter syntax could...
CVE-2025-43717: Inclusion of Sensitive Information in Test Code
In PEAR HTTPRequest2 before 2.7.0, multiple files in the tests directory, notably tests/network/getparameters.php and tests/network/postparameters.php, reflect any GET or POST parameters, leading to XSS...
CVE-2025-3612
CVE-2025-3612 affects Demtec Graphytics 5.0.7. The issue resides in an unknown part of the file /visualization within the HTTP GET Parameter Handler component, where input manipulation enables cross-site scripting. Exploitation is possible remotely and publicized, with the vendor not responding t...
PT-2025-16285 · Demtec · Demtec Graphytics
Name of the Vulnerable Software and Affected Versions: Demtec Graphytics version 5.0.7 Description: A vulnerability was found in Demtec Graphytics, affecting an unknown part of the file/visualization of the component HTTP GET Parameter Handler. The manipulation leads to cross-site scripting. It i...
CVE-2025-3612: Improper Neutralization of Input During Web Page Generation
A vulnerability, which was classified as problematic, was found in Demtec Graphytics 5.0.7. This affects an unknown part of the file /visualization of the component HTTP GET Parameter Handler. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The...
Demtec Graphytics 代码注入漏洞
Demtec Graphytics is an application from Demtec Corporation. A code injection vulnerability exists in Demtec Graphytics version 5.0.7 that stems from improper handling of HTTP GET parameters in the /visualization file, which could lead to a cross-site scripting attack...
CVE-2025-29033
An issue in BambooHR Build v.25.0210.170831-83b08dd allows a remote attacker to escalate privileges via the /saml/index.php?r=" HTTP GET parameter...
CVE-2025-29033
A security vulnerability in BambooHR Build v.25.0210.170831-83b08dd allows a remote attacker to escalate privileges . The root cause is an issue in the `/saml/index.php?r=
CVE-2025-29033
An issue in BambooHR Build v.25.0210.170831-83b08dd allows a remote attacker to escalate privileges via the /saml/index.php?r=" HTTP GET parameter...
PT-2025-35787
Name of the Vulnerable Software and Affected Versions Chamilo versions prior to 1.11.30 Description The application does not adequately validate user-supplied data from the GET parameter in scripts located at '/plugin/vchamilo/views/syncparams.php' and '/plugin/vchamilo/ajax/service.php'. This...
CVE-2025-29033: Improper Privilege Management
An issue in BambooHR Build v.25.0210.170831-83b08dd allows a remote attacker to escalate privileges via the /saml/index.php?r=" HTTP GET parameter...
CVE-2025-2353
A vulnerability, which was classified as critical, was found in VAM Virtual Airlines Manager up to 2.6.2. Affected is an unknown function of the file /vam/index.php of the component HTTP GET Parameter Handler. The manipulation of the argument ID/registryid/planeicao leads to sql injection. It is...
CVE-2025-2353: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability, which was classified as critical, was found in VAM Virtual Airlines Manager up to 2.6.2. Affected is an unknown function of the file /vam/index.php of the component HTTP GET Parameter Handler. The manipulation of the argument ID/registryid/planeicao leads to sql injection. It is...
CVE-2025-2353 VAM Virtual Airlines Manager HTTP GET Parameter index.php sql injection
A vulnerability, which was classified as critical, was found in VAM Virtual Airlines Manager up to 2.6.2. Affected is an unknown function of the file /vam/index.php of the component HTTP GET Parameter Handler. The manipulation of the argument ID/registryid/planeicao leads to sql injection. It is...