CVE-2025-2493: Improper Limitation of a Pathname to a Restricted Directory

Path Traversal vulnerability in Softdial Contact Center of Sytel Ltd. This vulnerability allows an attacker to manipulate the ‘id’ parameter of the ‘/softdial/scheduler/load.php’ endpoint to navigate beyond the intended directory. This can allow unauthorised access to sensitive files outside the...

PT-2025-11588

Name of the Vulnerable Software and Affected Versions Softdial Contact Center of Sytel Ltd affected versions not specified Description The issue allows an attacker to manipulate the id parameter of the "/softdial/scheduler/load.php" endpoint to navigate beyond the intended directory, potentially...

CVE-2025-2393

A vulnerability, which was classified as critical, was found in code-projects Online Class and Exam Scheduling System 1.0. Affected is an unknown function of the file /pages/salutdel.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The...

CVE-2025-29430

Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting XSS in /pages/room.php via the id and rome parameters...

CVE-2025-2377

A vulnerability was found in SourceCodester Vehicle Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /confirmbooking.php. The manipulation of the argument id leads to cross site scripting. The attack may be launched remotely. Th...

CVE-2025-29430: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Code-projects Online Class and Exam Scheduling System V1.0 is vulnerable to Cross Site Scripting XSS in /pages/room.php via the id and rome parameters...

SourceCodester Vehicle Management System: Code Injection Vulnerability

SourceCodester Vehicle Management System is an open source vehicle management system from SourceCodester. A code injection vulnerability exists in SourceCodester Vehicle Management System version 1.0, which stems from incorrect manipulation of the parameter id that can lead to cross-site scriptin...

Code-Projects Online Class and Exam Scheduling System Security Vulnerabilities

Code-Projects Online Class and Exam Scheduling System is an online class and exam scheduling system from Code-Projects open source. A security vulnerability exists in Code-Projects Online Class and Exam Scheduling System version 1.0, which stems from an incorrect manipulation of the parameter id...

CVE-2025-2164

The pixelstats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'postid' and 'sortby' parameters in all versions up to, and including, 0.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

PT-2025-11329

Name of the Vulnerable Software and Affected Versions: Thumbnail carousel slider plugin for WordPress version 1.0.4 and earlier Description: The issue arises from insufficient escaping on the user-supplied id parameter and lack of sufficient preparation on the existing SQL query, making it possib...

CVE-2019-25222: Improper Neutralization of Special Elements used in an SQL Command

The Thumbnail carousel slider plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and including, 1.0.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...

CodeZips-Hospital-Management-System

Vulnerability Title + SQL Injection in Hospital Management...

CVE-2025-2107: Improper Neutralization of Special Elements used in an SQL Command

The ArielBrailovsky-ViralAd plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the printResultAndDie function in all versions up to, and including, 1.0.8 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...

PT-2025-11137

Name of the Vulnerable Software and Affected Versions: ArielBrailovsky-ViralAd plugin for WordPress versions up to, and including, 1.0.8 Description: The issue allows unauthenticated attackers to perform SQL Injection via the text and id parameters of the limpia function due to insufficient...

PT-2025-11138

Name of the Vulnerable Software and Affected Versions: ArielBrailovsky-ViralAd plugin for WordPress versions up to, and including, 1.0.8 Description: The issue allows unauthenticated attackers to perform SQL Injection via the id parameter of the printResultAndDie function due to insufficient...

CVE-2024-52812

LF Edge eKuiper is an internet-of-things data analytics and stream processing engine. Prior to version 2.0.8, auser with rights to modify the service e.g. kuiperUser role can inject a cross-site scripting payload into the rule "id" parameter. Then, after any user with access to this service e.g...

PT-2025-10606

Name of the Vulnerable Software and Affected Versions LF Edge eKuiper versions prior to 2.0.8 Description The issue allows a user with modification rights to inject a cross-site scripting payload into the id parameter of a rule. When any user with access to the service makes modifications to the...

CVE-2024-12607: Improper Neutralization of Special Elements used in an SQL Command

The School Management System for Wordpress plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter of the 'mjsmgtshoweventtask' AJAX action in all versions up to, and including, 92.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparatio...

Starsea-Mall security vulnerabilities

starsea-mall is a springboot +thymeleaf based Xiaomi mall management system by StarSea99 individual developer. A security vulnerability exists in starsea-mall version 1.0, which stems from improper manipulation of the userId parameter, which may lead to improper access control...

Projectworlds Life Insurance Management System Injection Vulnerability

Projectworlds Life Insurance Management System is a life insurance management system from Projectworlds India. An injection vulnerability exists in Projectworlds Life Insurance Management System version 1.0, which stems from improper manipulation of the nomineeid parameter and can lead to SQL...