CVE-2023-51320

CVE-2023-51320 affects PHPJabbers Night Club Booking Software v1.0. The vulnerability is a CSV Injection in the CSV export, caused by insufficient input validation on the Languages → Labels parameter (in System Options) used to construct the CSV file. The issue is evidenced by concrete exploitati...

CVE-2023-51311

PHPJabbers Car Park Booking System v3.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on Languages section Labels any parameters field in System Options that is used to construct CSV file...

CVE-2023-51298

PHPJabbers Event Booking Calendar v4.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on Languages section Labels any parameters field in System Options that is used to construct CSV file...

CVE-2023-51298

PHPJabbers Event Booking Calendar v4.0 is vulnerable to CSV Injection due to insufficient input validation on the Languages section Labels field in System Options used to construct CSV files, potentially enabling remote code execution via crafted CSV payloads. Public writeups (e.g., PacketStorm) ...

CVE-2023-51298

PHPJabbers Event Booking Calendar v4.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on Languages section Labels any parameters field in System Options that is used to construct CSV file...

CVE-2023-51302

PHPJabbers Hotel Booking System v4.0 is vulnerable to CSV Injection vulnerability which allows an attacker to execute remote code. The vulnerability exists due to insufficient input validation on Languages section Labels any parameters field in System Options that is used to construct CSV file...

CVE-2023-51302

PHPJabbers Hotel Booking System v4.0 is vulnerable to a CSV Injection flaw. The root cause is insufficient input validation on the Languages/Labels parameters used to construct CSV files, specifically in the Reservations list (Unique ID field). This can allow an attacker to execute remote code vi...

CVE-2024-13691

The Uncode theme for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'uncoderecordMedia' function in all versions up to, and including, 2.9.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary...

CVE-2024-13691 Uncode <= 2.9.1.6 - Authenticated (Subscriber+) Arbitrary File Read in uncode_recordMedia

The Uncode theme for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'uncoderecordMedia' function in all versions up to, and including, 2.9.1.6. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary...

CVE-2024-13681 Uncode <= 2.9.1.6 - Unauthenticated Arbitrary File Read in uncode_admin_get_oembed

The Uncode theme for WordPress is vulnerable to arbitrary file read due to insufficient input validation in the 'uncodeadmingetoembed' function in all versions up to, and including, 2.9.1.6. This makes it possible for unauthenticated attackers to read arbitrary files on the server...

CVE-2024-13681

CVE-2024-13681 affects the WordPress theme Uncode. The vulnerability is an unauthenticated arbitrary file read due to insufficient input validation in the uncode_admin_get_oembed function, affecting all versions up to 2.9.1.6. Patch/mitigation: upgrade to Uncode 2.9.1.6 or apply the vendor fix th...

Remote Code Execution (RCE)

islandora/crayfish is vulnerable to Remote Code Execution RCE. The vulnerability is due to insufficient input validation and lack of proper access controls in the web-accessible installation of Hypercube, allow attackers to inject and execute arbitrary code remotely...

CVE-2025-25203

CtrlPanel is open-source billing software for hosting providers. Prior to version 1.0, a Cross-Site Scripting XSS vulnerability exists in the TicketsController and Moderation/TicketsController due to insufficient input validation on the priority field during ticket creation and unsafe rendering o...

Prompt Injection

pandasai is vulnerable to Prompt Injection. The vulnerability is due to insufficient input validation in the interactive prompt function, allowing prompt injection to execute arbitrary Python code...

PT-2025-6308 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to a denial-of-service vulnerability in the implementation of the Kerberos protocol in Windows operating systems, caused by insufficient input validation. This could...

CVE-2022-20924

A vulnerability in the Simple Network Management Protocol SNMP feature of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, remote attacker to cause a denial of service DoS condition on an affected device. This vulnerabili...

CVE-2020-7849

A vulnerability of uPrism.io CURIXVideo conferecing solution could allow an unauthenticated attacker to execute arbitrary code. This vulnerability is due to insufficient inputserver domain validation. An attacker could exploit this vulnerability through crafted URL...

CVE-2025-20204

CVE-2025-20204 affects Cisco Identity Services Engine (ISE) web-based management interface. The issue is a cross-site scripting (XSS) vulnerability caused by insufficient validation of user-supplied input, enabling an authenticated attacker with valid admin credentials to inject malicious script ...

CVE-2025-20204

Multiple vulnerabilities in the web-based management interface of Cisco Identity Services Engine ISE guest portals could allow an authenticated, remote attacker to conduct cross-site scripting XSS attacks against a user of the interface. These vulnerabilities are due to insufficient validation of...

CVE-2020-15097

loklak is an open-source server application which is able to collect messages from various sources, including twitter. The server contains a search index and a peer-to-peer index sharing interface. All messages are stored in an elasticsearch index. In loklak less than or equal to commit 5f48476, ...