TechStore Pro 安全漏洞

TechStore Pro is an e-commerce platform for nooncarlett individual developers. A security vulnerability exists in TechStore Pro version 1.0, which stems from incorrect manipulation of the parameter id in the file /ordernotes and could lead to a cross-site scripting attack...

CVE-2022-50589

SuiteCRM versions prior to 7.12.6 contain a SQL injection vulnerability within the processing of the ‘uid’ parameter within the ‘export’ functionality. Successful exploitation allows remote unauthenticated attackers to ultimately execute arbitrary code...

CVE-2022-50589 SuiteCRM < 7.12.6 SQL Injection via 'export' Functionality

SuiteCRM versions prior to 7.12.6 contain a SQL injection vulnerability within the processing of the ‘uid’ parameter within the ‘export’ functionality. Successful exploitation allows remote unauthenticated attackers to ultimately execute arbitrary code...

SuiteCRM 安全漏洞

SuiteCRM is a customer relationship management system from the SuiteCRM team. A security vulnerability exists in SuiteCRM versions prior to 7.12.6 that stems from a SQL injection vulnerability when handling the parameter uid in the export function, which could lead to the execution of arbitrary...

Tenda AX-3 get_parentControl_list_Info function stack buffer overflow vulnerability

Tenda AX-3 is a home smart wireless router from Tenda that supports Wi-Fi6 802.11ax standard for home networking environment. The Tenda AX-3 suffers from a stack buffer overflow vulnerability that originates from the deviceId parameter in the getparentControllistInfo function failing to properly...

CVE-2025-41113 Missing Authorization vulnerability in CanalDenuncia.app

A lack of authorisation vulnerability has been detected in CanalDenuncia.app. This vulnerability allows an attacker to access other users' information by sending a POST through the parameter 'iddenuncia' in '/backend/api/buscarDenunciaByPin.php'...

CVE-2025-12609

CVE-2025-12609 affects CodeAstro Gym Management System 1.0. The vulnerability exists in /admin/update-progress.php, where manipulating the id/ini_weight argument enables SQL injection. It is a remote issue with publicly available exploit information across multiple sources, indicating real-world ...

EUVD-2025-37463

A security flaw has been discovered in itsourcecode Online Loan Management System 1.0. The affected element is an unknown function of the file /manageuser.php. Performing manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has...

CVE-2025-12606

A vulnerability was determined in itsourcecode Online Loan Management System 1.0. This issue affects some unknown processing of the file /manageborrower.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly...

CVE-2025-63448

Water Management System v1.0 is reported vulnerable to Cross Site Scripting (XSS) in /edit_product.php?id=1. Concrete details appear across multiple sources (NVD, Red Hat, ENISA, CIRCL, CNNVD, CVE Lists) confirming a XSS issue affecting the /edit_product.php endpoint. The CVSS v3.1 base score is ...

PT-2025-44775

Name of the Vulnerable Software and Affected Versions Water Management System version 1.0 Description The Water Management System version 1.0 is susceptible to Cross Site Scripting XSS. The issue occurs in the /edit product.php?id=1 API endpoint. The id parameter is potentially vulnerable. XSS...

CVE-2025-12605 itsourcecode Online Loan Management System manage_loan.php sql injection

A vulnerability was found in itsourcecode Online Loan Management System 1.0. This vulnerability affects unknown code of the file /manageloan.php. The manipulation of the argument ID results in sql injection. The attack may be launched remotely. The exploit has been made public and could be used...

PT-2025-44738

Name of the Vulnerable Software and Affected Versions itsourcecode Online Loan Management System version 1.0 Description A flaw exists in itsourcecode Online Loan Management System that allows for SQL injection. This issue affects an unspecified part of the /load fields.php file. The loan id...

itsourcecode Online Loan Management System SQL注入漏洞

itsourcecode Online Loan Management System is an online loan management system from itsourcecode open source. A SQL injection vulnerability exists in version 1.0 of itsourcecode Online Loan Management System, which stems from an incorrect manipulation of the parameter loanid in the file...

CVE-2025-63454

Tenda AX-3 v16.03.12.10CN was discovered to contain a stack overflow via the deviceId parameter in the getparentControllistInfo function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...

Client Details System welcome.php File SQL Injection Vulnerability

Client Details System is a client information system. Client Details System suffers from an SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter ID of the file clientdetails/welcome.php. An attacker can exploit this...

Nero Social Networking Site addfriend.php File SQL Injection Vulnerability

Nero Social Networking Site is a social networking site. Nero Social Networking Site suffers from a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements in the parameter ID of the file /addfriend.php. An attacker can exploit this vulnerability to...

CVE-2015-10147

The Easy Testimonial Slider and Form plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

CVE-2015-10146

The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possibl...

CVE-2015-10147

CVE-2015-10147 summary (NORMAL) The Easy Testimonial Slider and Form WordPress plugin is vulnerable to SQL Injection via the id parameter in all versions up to and including 1.0.2 due to insufficient escaping and improper query preparation. This allows authenticated attackers with Administrator-l...