CVE-2025-15127 FantasticLBP Hotels_Server Room.php sql injection

A security vulnerability has been detected in FantasticLBP HotelsServer up to 67b44df162fab26df209bd5d5d542875fcbec1d0. Affected by this issue is some unknown functionality of the file /controller/api/Room.php. Such manipulation of the argument hotelId leads to sql injection. The attack may be...

phpok3w SQL注入漏洞

phpok3w is an article management system by the individual developer of sunbingzibo. A SQL injection vulnerability exists in phpok3w, which stems from incorrect manipulation of the parameter ID in the file show.php, which may lead to SQL injection...

PT-2025-53657

Name of the Vulnerable Software and Affected Versions 9786 phpok3w versions prior to 901d96a06809fb28b17f3a4362c59e70411c933c Description A flaw exists in 9786 phpok3w. The issue is related to the manipulation of the ID argument, which can lead to SQL injection within the show.php file. The attac...

EUVD-2025-205362

A security flaw has been discovered in itsourcecode Student Management System 1.0. This issue affects some unknown processing of the file /studentp.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been released to the...

CVE-2025-15075 itsourcecode Student Management System student_p.php sql injection

A security flaw has been discovered in itsourcecode Student Management System 1.0. This issue affects some unknown processing of the file /studentp.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been released to the...

CVE-2025-15034

A security flaw has been discovered in itsourcecode Student Management System 1.0. This affects an unknown part of the file /record.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be...

CVE-2025-66845

A reflected Cross-Site Scripting XSS vulnerability has been identified in TechStore version 1.0. The username endpoint reflects the id query parameter directly into the HTML response without output encoding or sanitization, allowing execution of arbitrary JavaScript code in a victim’s browser...

CVE-2025-66845

A reflected Cross-Site Scripting XSS vulnerability has been identified in TechStore version 1.0. The username endpoint reflects the id query parameter directly into the HTML response without output encoding or sanitization, allowing execution of arbitrary JavaScript code in a victim’s browser...

CVE-2025-66845

A reflected Cross-Site Scripting XSS vulnerability has been identified in TechStore version 1.0. The username endpoint reflects the id query parameter directly into the HTML response without output encoding or sanitization, allowing execution of arbitrary JavaScript code in a victim’s browser...

CVE-2025-15003

A vulnerability was found in SeaCMS up to 13.3. The impacted element is an unknown function of the file adminvideo.php. Performing a manipulation of the argument eid results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used...

TechStore 安全漏洞

TechStore is a subscription software platform from TechStore Inc. in the United Arab Emirates. A security vulnerability exists in TechStore version 1.0, which stems from the id parameter not being encoded or cleaned up, which could lead to a reflective cross-site scripting attack...

SIGB PMB SQL注入漏洞

SIGB PMB is an open source integrated library management system from SIGB. A SQL injection vulnerability exists in SIGB PMB version 7.4.6, which stems from insufficient cleanup of the id parameter in the ajax.php endpoint, which could lead to a SQL injection attack...

CVE-2025-66845

TechStore 1.0 exposes a reflected XSS in the user_name endpoint: the id query parameter is echoed into HTML without output encoding or sanitization, allowing execution of arbitrary JavaScript in a victim’s browser. Root cause is lack of input encoding on reflection. CVE-2025-66845 is documented a...

CVE-2025-66845

A reflected Cross-Site Scripting XSS vulnerability has been identified in TechStore version 1.0. The username endpoint reflects the id query parameter directly into the HTML response without output encoding or sanitization, allowing execution of arbitrary JavaScript code in a victim’s browser...

PT-2025-52753

Name of the Vulnerable Software and Affected Versions TechStore version 1.0 Description A reflected Cross-Site Scripting XSS issue exists. The /user name API endpoint reflects the id query parameter directly into the HTML response without proper output encoding or sanitization. This allows for th...

CVE-2023-53975 Atom CMS 2.0 Unauthenticated SQL Injection via Admin Index Page

Atom CMS 2.0 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries through unvalidated parameters. Attackers can inject malicious SQL code in the 'id' parameter of the admin index page to execute time-based blind SQL injection attacks...

CVE-2023-53975 Atom CMS 2.0 Unauthenticated SQL Injection via Admin Index Page

Atom CMS 2.0 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate database queries through unvalidated parameters. Attackers can inject malicious SQL code in the 'id' parameter of the admin index page to execute time-based blind SQL injection attacks...

Atom CMS SQL注入漏洞

Atom CMS is an open source content management system from The Digital Craft. An SQL injection vulnerability exists in Atom CMS version 2.0, which stems from an unverified SQL injection in the id parameter of the admin index page, which could lead to a remote attacker manipulating database queries...

CVE-2025-14080

CVE-2025-14080 concerns the WordPress plugin Frontend Post Submission Manager Lite. The vulnerability is due to missing authorization on the fpsml_form_process AJAX action, allowing unauthenticated attackers to modify arbitrary posts by supplying a post_id via the guest posting form. Reported imp...

PT-2025-52576

Name of the Vulnerable Software and Affected Versions Frontend Post Submission Manager Lite plugin versions through 1.2.5 Description The Frontend Post Submission Manager Lite plugin for WordPress has an issue where authorization checks are missing on the post update functionality within the fpsm...