3442 matches found
CVE-2025-7800 cgpandey hotelmis HTTP GET Request admin.php cross site scripting
A vulnerability classified as problematic was found in cgpandey hotelmis up to c572198e6c4780fccc63b1d3e8f3f72f825fc94e. This vulnerability affects unknown code of the file admin.php of the component HTTP GET Request Handler. The manipulation of the argument Search leads to cross site scripting...
CVE-2025-7800
CVE-2025-7800 affects cgpandey hotelmis (admin.php) with a vulnerability in the HTTP GET Request Handler: manipulation of the Search parameter enables cross-site scripting. The issue is exploitable remotely and is tied to versions prior to c572198e6c4780fccc63b1d3e8f3f72f825fc94e6. PT-Security no...
CVE-2025-51651
An authenticated arbitrary file download vulnerability in the component /admin/Backups.php of Mccms v2.7.0 allows attackers to download arbitrary files via a crafted GET request...
PT-2025-29888 · Unknown · Rips Scanner
Name of the Vulnerable Software and Affected Versions: RIPS Scanner version 0.54 Description: A path traversal vulnerability exists that allows remote attackers to read arbitrary files on the system with the privileges of the web server. This is achieved by sending crafted HTTP GET requests to th...
CVE-2025-51651
The CVE-2025-51651 issue affects MCCMS v2.7.0, specifically the /admin/Backups.php component. An authenticated attacker can trigger an arbitrary file download by sending a crafted GET request, implying that sensitive files on the server may be exposed. The vulnerability stems from improper access...
CVE-2025-51651
An authenticated arbitrary file download vulnerability in the component /admin/Backups.php of Mccms v2.7.0 allows attackers to download arbitrary files via a crafted GET request...
CVE-2025-51651
An authenticated arbitrary file download vulnerability in the component /admin/Backups.php of Mccms v2.7.0 allows attackers to download arbitrary files via a crafted GET request...
CVE-2025-53531
WeGIA is a web manager for charitable institutions. The Wegia server has a vulnerability that allows excessively long HTTP GET requests to a specific URL. This issue arises from the lack of validation for the length of the fid parameter. Tests confirmed that the server processes URLs up to 8,142...
CVE-2025-29267
SQL Injection vulnerability in Abis, Inc Adjutant Core Accounting ERP build v.PreBeta250F allows a remote attacker to obtain a sensitive information via the cid parameter in the GET request...
CVE-2025-29267
CVE-2025-29267 affects Abis, Inc Adjutant Core Accounting ERP build v.PreBeta250F. The vulnerability is a SQL Injection in the cid parameter of a GET request, enabling a remote attacker to retrieve sensitive information. Affected component is the Adjutant Core Accounting ERP application; root cau...
CVE-2025-53531
WeGIA is a web manager for charitable institutions. The Wegia server has a vulnerability that allows excessively long HTTP GET requests to a specific URL. This issue arises from the lack of validation for the length of the fid parameter. Tests confirmed that the server processes URLs up to 8,142...
CVE-2025-53530 WeGIA allows Uncontrolled Resource Consumption via the errorstr parameter
WeGIA is a web manager for charitable institutions. The Wegia server has a vulnerability that allows excessively long HTTP GET requests to a specific URL. This issue arises from the lack of validation for the length of the errorstr parameter. Tests confirmed that the server processes URLs up to...
CVE-2025-34086
Bolt CMS versions 3.7.0 and earlier contain a chain of vulnerabilities that together allow an authenticated user to achieve remote code execution. A user with valid credentials can inject arbitrary PHP code into the displayname field of the user profile, which is rendered unsanitized in backend...
CVE-2025-50369
A Cross-Site Request Forgery CSRF vulnerability exists in the Manage Card functionality /mcgs/admin/manage-card.php of PHPGurukul Medical Card Generation System 1.0. The vulnerable endpoint allows an authorized admin to delete medical card records by sending a simple GET request without verifying...
CVE-2025-50369
A Cross-Site Request Forgery CSRF vulnerability exists in the Manage Card functionality /mcgs/admin/manage-card.php of PHPGurukul Medical Card Generation System 1.0. The vulnerable endpoint allows an authorized admin to delete medical card records by sending a simple GET request without verifying...
CVE-2025-50369
The CVE-2025-50369 entry affects PHPGurukul Medical Card Generation System 1.0. The vulnerability is a CSRF in the Manage Card function at /mcgs/admin/manage-card.php that allows an authorized admin to delete medical card records by issuing a simple GET request without origin verification. Root c...
CVE-2025-34044
A remote command injection vulnerability exists in the confirm.php interface of the WIFISKY 7-layer Flow Control Router via a specially-crafted HTTP GET request to the t parameter. Insufficient input validation allows unauthenticated attackers to execute arbitrary OS commands. Exploitation eviden...
The vulnerability of the sub_415EF8 function in Netgear EX6100 router microprogramming software allows a hacker to execute arbitrary code.
The vulnerability of sub415EF8 in Netgear EX6100 router microprogramming software relates to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code by sending a specially crafted GET request...
CVE-2023-47030
An issue in NCR Terminal Handler v.1.5.1 allows a remote attacker to execute arbitrary code and obtain sensitive information via a GET request to a UserService SOAP API endpoint to validate if a user exists...