Contact Form Generator <= 2.5.5 - Cross-Site Scripting

The Contact Form Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in wp-admin/admin.php in versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

YesWiki Bazar Widget - Reflected XSS via 'id' Parameter

YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using striptags only. striptags does not escape double quotes, allowing an attacker to break out of the data-formid attribute and inject arbitrary event handlers. id: CVE-2026-52774 info: name: YesWiki Bazar Widget ...

CVE-2026-120544

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.1 via the 'id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to read...

CVE-2026-120544 Academy LMS <= 4.0.1 - Authenticated (Contributor+) Arbitrary HTML File Read via 'id' Parameter in /wp/v2/templates REST Route

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.1 via the 'id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to read...

EUVD-2026-115660

The Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.0.1 via the 'id' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to read...

CVE-2026-120544

The Academy LMS WordPress plugin (all versions up to and including 4.0.1 ) is vulnerable to a Directory Traversal flaw in the id parameter of the /wp/v2/templates REST route. This vulnerability allows authenticated attackers with contributor-level access or higher to read the contents of arbitrar...

CVE-2021-42668

cve-2021-42668 CVE-2021-42668 - SQL Injection vulnerability in the Engineers online portal system. Technical description: An SQL Injection vulnerability exists in the Engineers Online Portal. An attacker can leverage the vulnerable "id" parameter in the "myclassmates.php" web page in order to...

CVE-2021-42666

CVE-2021-42666 CVE-2021-42666 - SQL Injection vulnerability in the Engineers online portal system. Technical description: An SQL Injection vulnerability exists in the Engineers Online Portal system. An attacker can leverage the vulnerable "id" parameter in the "quizquestion.php" web page in order...

CVE-2021-42670

CVE-2021-42670 CVE-2021-42670 - SQL Injection vulnerability in the Engineers online portal system. Technical description: An SQL Injection vulnerability exists in the Engineers Online Portal. An attacker can leverage the vulnerable "id" parameter in the "announcementsstudent.php" web page in orde...

CVE-2020-17530

What's this This is a Simple test Project for S2-061 which can be used to analysis the detail of this vulnerability. How to use Step 1:Use IDEA import this project Step 2:setup tomcat Server Step 3:Use browser access...

Spring-Data-Mongodb-Example

Spring-Data-Mongodb-Example CVE-2022-22980 environment Build docker environment docker build -t mongo . docker run -dit -p 6666:6666 mongo PoC ➜ Spring-Data-Mongodb-Example git:main curl 0:6666/v1/user/get -d 'id=Tjava.lang.Runtime.getRuntime.exec"touch /tmp/aaaa"'...

CVE-2021-42667

CVE-2021-42667 CVE-2021-42667 - SQL Injection vulnerability in the Online event booking and reservation system version 2.3.0. Technical description: An SQL Injection vulnerability exists in the Event management software version 2.3.0. An attacker can leverage the vulnerable "id" parameter in the...

CVE-2024-58290-Xhibiter-SQLi

CVE-2024-58290-Xhibiter-SQLi Proof of Concept PoC for SQL Injection in Xhibiter NFT Marketplace 1.10.2 Collections Endpoint. Discovered by Sohel Yousef. CVE-2024-58290: Xhibiter NFT Marketplace SQL Injection Exploit Title: Xhibiter NFT Marketplace 1.10.2 - SQL Injection Unauthenticated Date:...

CVE-2024-10140

CVE-2024-10140 The script exploits a SQL Injection vulnerability found in the endpoint /php/managesupplier.php?action=delete&id=32. The vulnerability allows an attacker to inject arbitrary SQL commands through the id parameter, potentially compromising the database and exposing sensitive...

CVE-2023-24775-and-CVE-2023-24780

CVE-2023-24775-and-CVE-2023-24780 my python poc 2023-24780 and CVE-2023-24775 this sqli cve funadmin This is a repository with a poc exploit for python cve sqli funadmin. CVE-2023-24774 - https://nvd.nist.gov/vuln/detail/CVE-2023-24780 Vulnerable version of Funadmin v3.2.0 Vulnerability via id...

CVE-2024-50970

CVE-2024-50970 Description A SQL injection vulnerability in orderview1.php of Itsourcecode Online Furniture Shopping Project 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. Vulnerability Type SQL Injection Vendor of Product Itsourcecode Affected Product Code...

rails-cve-2017-17917

rails-cve-2017-17917 The project demonstrates the replication of a SQL injection vulnerability in the id parameter, and subsequently provides insights into mitigating and resolving this security issue. https://www.cvedetails.com/cve/CVE-2017-17917/?q=CVE-2017-17917 Stack : Ruby: 3.2.2 Rails: 7.0....

CVE-2024-13488

CVE-2024-13488 LTL Freight Quotes – Estes Edition = 3.3.7 - Unauthenticated SQL Injection Description The LTL Freight Quotes – Estes Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropshipeditid' and 'editid' parameters in all versions up to, and including, 3.3.7 due to...

CVE-2023-40931-PoC

CVE-2023-40931 The sqlmap payload to exploit CVE-2023-40931 Payload Required Information: Valid Username and Password Domain and path of hosted instance sqlmap -D nagiosxi -T xiusers -u "https:///nagiosxi/admin/bannermessage-ajaxhelper.php?action=acknowledgebannermessage&id=3&token=curl -ksX POST...

CVE-2023-49989

CVE-2023-49989 Hotel Booking Management v1.0 - SQL Injection Vulnerability in the "id" parameter at update.php Description : Hotel Booking Management v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at update.php. Vulnerable Product Version : Hotel Booking...