CVE-2025-2044

A vulnerability was found in code-projects Blood Bank Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/deletebloodGroup.php. The manipulation of the argument bloodid leads to sql injection. The attack can be...

SourceCodester Best Employee Management System 注入漏洞

SourceCodester Best Employee Management System is a SourceCodester open source employee management system. An injection vulnerability exists in SourceCodester Best Employee Management System version 1.0, which stems from an incorrect manipulation of the parameter id that can lead to SQL injection...

Code-Projects Blood Bank Management System 注入漏洞

Code-Projects Blood Bank Management System is a Code-Projects open source blood bank management system. An injection vulnerability exists in Code-Projects Blood Bank Management System version 1.0, which stems from an incorrect manipulation of the parameter memberid that can lead to SQL injection...

Code-Projects Blood Bank Management System 注入漏洞

Code-Projects Blood Bank Management System is an open source blood bank management system from Code-Projects. An injection vulnerability exists in code-projects Blood Bank Management System version 1.0, which stems from an incorrect manipulation of the parameter bloodid that can lead to SQL...

CVE-2025-1946

A vulnerability was found in hzmanyun Education and Training System 2.1. It has been rated as critical. Affected by this issue is the function exportPDF of the file /user/exportPDF. The manipulation of the argument id leads to command injection. The attack may be launched remotely. The exploit ha...

CVE-2025-0433

The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 2.0.7.1 due to insufficient input sanitization and output...

CVE-2025-0433 Master Addons <= 2.0.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter

The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 2.0.7.1 due to insufficient input sanitization and output...

PT-2025-9646

Name of the Vulnerable Software and Affected Versions The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress versions up to, and including, 2.0.7.1 Description The issue is related to Stored Cross-Site Scripting due to...

CVE-2025-0433: Improper Neutralization of Input During Web Page Generation

The Master Addons – Elementor Addons with White Label, Free Widgets, Hover Effects, Conditions, & Animations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 2.0.7.1 due to insufficient input sanitization and output...

CVE-2025-25949

A stored cross-site scripting XSS vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System SIS EagleR v1.0.118 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the User ID parameter at /rest/staffResource/update...

CVE-2025-25949

The Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 is susceptible to a stored cross-site scripting (XSS) vulnerability. The root cause is the improper neutralization of input during web page generation, specifically within the User ID parameter at the /rest/s...

CVE-2025-25949: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System SIS EagleR v1.0.118 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the User ID parameter at /rest/staffResource/update...

CVE-2025-1831

A vulnerability classified as critical has been found in zj1983 zz up to 2024-8. Affected is the function GetDBUser of the file src/main/java/com/futvan/z/system/zorg/ZorgAction.java. The manipulation of the argument userid leads to sql injection. It is possible to launch the attack remotely. The...

CVE-2025-25379

Cross Site Request Forgery vulnerability in 07FLYCMS v.1.3.9 allows a remote attacker to execute arbitrary code via the id parameter of the del.html component...

CVE-2025-25379

Cross Site Request Forgery vulnerability in 07FLYCMS v.1.3.9 allows a remote attacker to execute arbitrary code via the id parameter of the del.html component...

CVE-2025-1572

The KiviCare – Clinic & Patient Management System EHR plugin for WordPress is vulnerable to SQL Injection via the ‘uid’ parameter in all versions up to, and including, 3.6.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

CVE-2025-25379

The 07FLYCMS content management system (version 1.3.9 ) is vulnerable to a Cross-Site Request Forgery (CSRF) issue. A remote attacker can exploit the id parameter within the del.html component to achieve arbitrary code execution . To mitigate this risk, it is recommended to restrict access to the...

PT-2025-9066 · WordPress · Kivicare – Clinic & Patient Management System (Ehr) Plugin

Name of the Vulnerable Software and Affected Versions: KiviCare – Clinic & Patient Management System EHR plugin for WordPress versions up to, and including, 3.6.7 Description: The issue is related to SQL Injection via the u id parameter due to insufficient escaping on the user-supplied parameter...

CVE-2025-25379: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery vulnerability in 07FLYCMS v.1.3.9 allows a remote attacker to execute arbitrary code via the id parameter of the del.html component...

WordPress KiviCare plugin <= 3.6.7 - Authenticated (Doctor+) SQL Injection via 'u_id' Parameter vulnerability

Authenticated Doctor+ SQL Injection via 'uid' Parameter vulnerability discovered by wesley wcraft in WordPress Plugin KiviCare versions = 3.6.7...