CVE-2025-0433 Master Addons <= 2.0.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 2.0.7.1 due to insufficient input sanitization and output...

CVE-2025-25949

A stored cross-site scripting XSS vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System SIS EagleR v1.0.118 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the User ID parameter at /rest/staffResource/update...

CVE-2025-25949

CVE-2025-25949 affects the Serosoft Solutions Academia Student Information System (SIS) EagleR, v1.0.118. The vulnerability is a stored cross-site scripting (XSS) flaw in the web interface, reported to occur via unsanitized input in the User ID parameter (noted also as related fields in variants ...

CVE-2025-1831

A vulnerability classified as critical has been found in zj1983 zz up to 2024-8. Affected is the function GetDBUser of the file src/main/java/com/futvan/z/system/zorg/ZorgAction.java. The manipulation of the argument userid leads to sql injection. It is possible to launch the attack remotely. The...

CVE-2025-25379

Cross Site Request Forgery vulnerability in 07FLYCMS v.1.3.9 allows a remote attacker to execute arbitrary code via the id parameter of the del.html component...

CVE-2025-25379

Cross Site Request Forgery vulnerability in 07FLYCMS v.1.3.9 allows a remote attacker to execute arbitrary code via the id parameter of the del.html component...

CVE-2025-1572

The KiviCare – Clinic & Patient Management System EHR plugin for WordPress is vulnerable to SQL Injection via the ‘uid’ parameter in all versions up to, and including, 3.6.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

CVE-2025-25379

07FLYCMS v1.3.9 is affected by a Cross Site Request Forgery vulnerability that allows a remote attacker to execute arbitrary code via the id parameter in the del.html component. The issue’s root cause is the insecure handling of the id parameter in del.html, enabling code execution under authenti...

PT-2025-9066 · WordPress · Kivicare – Clinic & Patient Management System (Ehr) Plugin

Name of the Vulnerable Software and Affected Versions: KiviCare – Clinic & Patient Management System EHR plugin for WordPress versions up to, and including, 3.6.7 Description: The issue is related to SQL Injection via the u id parameter due to insufficient escaping on the user-supplied parameter...

WordPress KiviCare plugin <= 3.6.7 - Authenticated (Doctor+) SQL Injection via 'u_id' Parameter vulnerability

Authenticated Doctor+ SQL Injection via 'uid' Parameter vulnerability discovered by wesley wcraft in WordPress Plugin KiviCare versions = 3.6.7...

CVE-2024-13695 Enfold <= 6.0.9 - Authenticated (Subscriber+) Server-Side Request Forgery via attachment_id

The Enfold theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.9 via the 'attachmentid' parameter. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations...

CVE-2024-13695

CVE-2024-13695 : The Enfold WordPress theme (versions up to and including 6.0.9) is vulnerable to Server-Side Request Forgery via the attachment_id parameter. Exploitation requires authenticated access at Subscriber level or higher, enabling web requests originating from the vulnerable instance t...

CVE-2024-13846

The Indeed Ultimate Learning Pro plugin for WordPress is vulnerable to time-based SQL Injection via the ‘postid’ parameter in all versions up to, and including, 3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes...

WordPress plugin LTL Freight Quotes SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

CVE-2024-13369 Tour Master - Tour Booking, Travel, Hotel <= 5.3.7 - Authenticated (Subscriber+) SQL Injection via review_id Parameter

The Tour Master - Tour Booking, Travel, Hotel plugin for WordPress is vulnerable to time-based SQL Injection via the ‘reviewid’ parameter in all versions up to, and including, 5.3.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

Code-Projects Real Estate Property Management System 注入漏洞

Code-Projects Real Estate Property Management System is a Code-Projects open source real estate property management system. An injection vulnerability exists in Code-Projects Real Estate Property Management System version 1.0, which stems from an incorrect manipulation of the parameters...

CVE-2025-1356

A vulnerability was found in needyamin Library Card System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file card.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed...

Library Card System 注入漏洞

Library Card System is a library management system. A SQL injection vulnerability exists in Library Card System version 1.0, which originates from a lack of validation of the id parameter of the card.php file against externally entered SQL statements. An attacker can use this vulnerability to...

CVE-2025-25994

SQL Injection vulnerability in FeMiner wms wms 1.0 allows a remote attacker to obtain sensitive information via the parameters date1, date2, id...

CVE-2025-0821

Bit Assist plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in all versions up to, and including, 1.5.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...