CVE-2021-39433

CVE-2021-39433 A local file inclusion LFI vulnerability exists in version BIQS IT Biqs-drive v1.83 and below when sending a specific payload as the file parameter to download/index.php. This allows the attacker to read arbitrary files from the server with the permissions of the configured web-use...

CVE-2021-42663

CVE-2021-42663 CVE-2021-42662 - Vulnerabilidad de inyección HTML en el sistema de reservas de eventos en línea versión 2.3.0. Descripción técnica: Existe una vulnerabilidad de inyección HTML en el sistema de reservas de eventos en línea versión 2.3.0. Un atacante puede aprovechar esta...

CVE-2022-27414

CVE-2022-27414 - Inyección SQL College Website CMS v1.0 - CVE-2022-27414 - Inyección SQL URL del CVE root@kitploit: https://vulners.com/cve/CVE-2022-27414 PoC a continuación Código vulnerable comienza en la línea 9 de "cwms\departments\index.php" root@kitploit: query"SELECT FROM departmentlist...

CVE-2023-46015-Code-Projects-Blood-Bank-1.0-Reflected-Cross-Site-Scripting-Vulnerability

CVE-2023-46015-Code-Projects-Blood-Bank-1.0-Reflejado-Cross-Site-Scripting-Vulnerabilidad Autor del Exploit: ersinerenler Página del proveedor https://code-projects.org/blood-bank-in-php-with-source-code Enlace del software...

CVE-2026-84069

The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate a user-supplied path before using it to include a local file, allowing unauthenticated users to perform Local File Inclusion...

CVE-2026-84069 WebFacing Email Accounts for cPanel 5.3 - 5.3.6 - Unauthenticated LFI via assets/index.php

The WebFacing™ WordPress plugin before 5.4 does not restrict access to one of its bundled scripts and does not validate a user-supplied path before using it to include a local file, allowing unauthenticated users to perform Local File Inclusion...

GetSimple CMS 3.3.13 - Open Redirect

GetSimple CMS 3.3.13 contains an open redirect vulnerability via the admin/index.php redirect parameter. An attacker can redirect a user to a malicious site and possibly obtain sensitive information, modify data, and/or execute unauthorized operations. id: CVE-2019-9915 info: name: GetSimple CMS...

Mitel ShoreTel 19.46.1802.0 Devices - Cross-Site Scripting

Mitel ShoreTel 19.46.1802.0 devices and their conference component are vulnerable to an unauthenticated attacker conducting reflected cross-site scripting attacks via the PATHINFO variable to index.php due to insufficient validation for the timezone object in the HOMEMEETING& page. id:...

CVE-2023-34632

CVE-2023-34632 Reflected XSS in 1000projects Book Management System 1.0 CVE-2023-34632 Reflected Cross-Site Scripting XSS in 1000projects Book Management System 1.0 Description A Reflected Cross-Site Scripting XSS vulnerability was discovered in 1000projects Book Management System version 1.0. Th...

CVE-2025-6082

CVE-2025-6082 Full Path Disclosure PoC Author : Byte Reaper Telegram : @ByteReaper0 CVE : CVE-2025-6082 Vulnerability : Full Path Disclosure CWE-200 Description This Proof‑of‑Concept exploits a Full Path Disclosure bug in the Birth Chart Compatibility WordPress plugin versions ≤ 2.0. The POC send...

CVE-2025-61456

🛡️ CVE Disclosure: CVE-2025-61456 — Reflected XSS in E-commerce Project Disclosure Date: 14 October 2025 CVE ID: CVE-2025-61456 Severity: MEDIUM CVSS 6.1 🧩 Summary A reflected Cross-Site Scripting XSS vulnerability exists in the E-commerce Project v1.0, specifically within the index.php endpoint...

CVE-2026-6183-SQLI

SQL Injection via id Parameter in index.php - Simple Content Management System in PHP Description A SQL Injection vulnerability exists in Simple Content Management System PHP. The id parameter in index.php is not sanitized before being passed to the SQL query, allowing an unauthenticated attacker...

CVE-2021-39377

OPENSIS 8.0 SQL INJECTION VULNERABILITY CVE-2021-39377 A SQL Injection vulnerability exists in version 8.0 of openSIS when MySQL MariaDB is being used as the application database. A malicious attacker can issue SQL commands to the Mysql MariaDB database through the vulnerable username= parameter...

EUVD-2026-85674

A vulnerability was detected in Abdurrab5 online-makeup-store. This affects an unknown function of the file index.php of the component Admin Login Handler. The manipulation of the argument id/password results in sql injection. The attack can be executed remotely. The exploit is now public and may...

CVE-2026-96601

A vulnerability was detected in Abdurrab5 online-makeup-store. This affects an unknown function of the file index.php of the component Admin Login Handler. The manipulation of the argument id/password results in sql injection. The attack can be executed remotely. The exploit is now public and may...

CVE-2026-96601

A SQL injection vulnerability exists in the Admin Login Handler component of Abdurrab5 online-makeup-store . The flaw is located within an unknown function of the index.php file and is triggered by manipulating the id/password arguments. This vulnerability can be exploited remotely , and the expl...

CVE-2026-96601 Abdurrab5 online-makeup-store Admin Login index.php sql injection

A vulnerability was detected in Abdurrab5 online-makeup-store. This affects an unknown function of the file index.php of the component Admin Login Handler. The manipulation of the argument id/password results in sql injection. The attack can be executed remotely. The exploit is now public and may...

EUVD-2026-85546

Joomla Extension - joomshaper.com - Missing CSRF Token Verification in Storefront Product Review Submission in Easy Store extension 1.0.0-3.0.0 - The product review submission endpoint index.php?option=comeasystore&task=product.addReview accepted submissions without verifying an anti-CSRF token t...

CVE-2025-63589

CVE-2025-63589 XSS Reflejado en el manejo de rutas de index.php de CMSimpleXH Descubierto: 6 de octubre de 2025 Productos: CMSimpleXH CMS de archivo plano de código abierto Versiones afectadas: 1.8 CVEs: CVE-2025-63589 Autenticación requerida: Ninguna sin autenticar Tipo de ataque: Cross-Site...

EUVD-2026-84988

A weakness has been identified in itsourcecode Leave Management System 1.0. Impacted is an unknown function of the file /module/leavetype/index.php. This manipulation of the argument ID causes sql injection. The attack may be initiated remotely. The exploit has been made available to the public a...