Contact Form Generator <= 2.5.5 - Cross-Site Scripting

The Contact Form Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in wp-admin/admin.php in versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

YesWiki Bazar Widget - Reflected XSS via 'id' Parameter

YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using striptags only. striptags does not escape double quotes, allowing an attacker to break out of the data-formid attribute and inject arbitrary event handlers. id: CVE-2026-52774 info: name: YesWiki Bazar Widget ...

PT-2026-139985

OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl eob invoice.php that allows any authenticated user to read and modify billing data for any encounter. Attackers can iterate the id parameter to read patient names and billing notes, and post payments,...

CVE-2024-58290-Xhibiter-SQLi

CVE-2024-58290-Xhibiter-SQLi Proof of Concept PoC for SQL Injection in Xhibiter NFT Marketplace 1.10.2 Collections Endpoint. Discovered by Sohel Yousef. CVE-2024-58290: Xhibiter NFT Marketplace SQL Injection Exploit Title: Xhibiter NFT Marketplace 1.10.2 - SQL Injection Unauthenticated Date:...

CVE-2024-50970

CVE-2024-50970 Description A SQL injection vulnerability in orderview1.php of Itsourcecode Online Furniture Shopping Project 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. Vulnerability Type SQL Injection Vendor of Product Itsourcecode Affected Product Code...

CVE-2021-42667

CVE-2021-42667 CVE-2021-42667 - SQL Injection vulnerability in the Online event booking and reservation system version 2.3.0. Technical description: An SQL Injection vulnerability exists in the Event management software version 2.3.0. An attacker can leverage the vulnerable "id" parameter in the...

CVE-2020-17530

What's this This is a Simple test Project for S2-061 which can be used to analysis the detail of this vulnerability. How to use Step 1:Use IDEA import this project Step 2:setup tomcat Server Step 3:Use browser access...

rails-cve-2017-17917

rails-cve-2017-17917 The project demonstrates the replication of a SQL injection vulnerability in the id parameter, and subsequently provides insights into mitigating and resolving this security issue. https://www.cvedetails.com/cve/CVE-2017-17917/?q=CVE-2017-17917 Stack : Ruby: 3.2.2 Rails: 7.0....

CVE-2024-13488

CVE-2024-13488 LTL Freight Quotes – Estes Edition = 3.3.7 - Unauthenticated SQL Injection Description The LTL Freight Quotes – Estes Edition plugin for WordPress is vulnerable to SQL Injection via the 'dropshipeditid' and 'editid' parameters in all versions up to, and including, 3.3.7 due to...

CVE-2024-34310

CVE-2024-34310 CVE-2024-34310 Suggested description Jin Fang Times Content Management System v3.2.3 was discovered to contain a SQL injection vulnerability via the id parameter. Vulnerability Type SQL Injection Vendor of Product https://www.bjjfsd.com/ Affected Product Code Base Jin Fang times...

Spring-Data-Mongodb-Example

Spring-Data-Mongodb-Example CVE-2022-22980 environment Build docker environment docker build -t mongo . docker run -dit -p 6666:6666 mongo PoC ➜ Spring-Data-Mongodb-Example git:main curl 0:6666/v1/user/get -d 'id=Tjava.lang.Runtime.getRuntime.exec"touch /tmp/aaaa"'...

CVE-2026-118801

The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.18.0 via the 'id' parameter. This makes it possible for authenticated attackers, wit...

CVE-2026-118801

The aBlocks plugin for WordPress (versions up to and including 2.18.0 ) is vulnerable to Sensitive Information Exposure via the id parameter in the ablocks_template shortcode. This flaw allows authenticated attackers with contributor-level access to extract the full rendered body content of any p...

EUVD-2026-118972

The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.18.0 via the 'id' parameter. This makes it possible for authenticated attackers, wit...

CVE-2026-118801 aBlocks <= 2.18.0 - Authenticated (Contributor+) Sensitive Information Exposure in 'ablocks_template' Shortcode

The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.18.0 via the 'id' parameter. This makes it possible for authenticated attackers, wit...

CVE-2023-24775-and-CVE-2023-24780

CVE-2023-24775-and-CVE-2023-24780 my python poc 2023-24780 and CVE-2023-24775 this sqli cve funadmin This is a repository with a poc exploit for python cve sqli funadmin. CVE-2023-24774 - https://nvd.nist.gov/vuln/detail/CVE-2023-24780 Vulnerable version of Funadmin v3.2.0 Vulnerability via id...

CVE-2024-10140

CVE-2024-10140 The script exploits a SQL Injection vulnerability found in the endpoint /php/managesupplier.php?action=delete&id=32. The vulnerability allows an attacker to inject arbitrary SQL commands through the id parameter, potentially compromising the database and exposing sensitive...

CVE-2023-49968

CVE-2023-49968 Customer Support System 1.0 - SQL Injection Vulnerability in managedepartment.php via "id" URL Parameter Description : A SQL Injection vulnerability exists in version 1 of the Customer Support System. An attacker with malicious intent can execute SQL commands on the MySQL database ...

CVE-2024-32370

CVE-2024-32370 Vulnerability Description Issue An issue in HSC Cybersecurity HSC Mailinspector version 5.2.17-3 has been identified, allowing a remote attacker to obtain sensitive information via a crafted payload to the id parameter in the mliSystemUsers.php component. Vulnerable Component...

CVE-2023-49989

CVE-2023-49989 Hotel Booking Management v1.0 - SQL Injection Vulnerability in the "id" parameter at update.php Description : Hotel Booking Management v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at update.php. Vulnerable Product Version : Hotel Booking...