CVE-2026-103535

Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The itemname parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as ../. This...

CVE-2026-103535

Thelia v2.6.1 is vulnerable to path traversal and PHP code injection within its translation editor. The item_name parameter fails to sanitize directory traversal sequences like ../, allowing authenticated users with UPDATE permissions on admin.configuration.language to write files to web-accessib...

CVE-2026-103535 CVE-2026-103535

Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The itemname parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as ../. This...

CVE-2026-103535

Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The "itemname" parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as "../". Th...

CVE-2026-103535: Improper Control of Generation of Code

Thelia v2.6.1 contains path traversal and PHP code injection vulnerabilities in its translation editor that can be chained to achieve remote code execution. The itemname parameter, used to build the translation file's write path, does not sanitize directory traversal sequences such as ../. This...

CVE-2025-14247: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in code-projects Simple Shopping Cart 1.0. This issue affects some unknown processing of the file /Admin/additems.php. Executing manipulation of the argument itemname can lead to sql injection. The attack can be executed remotely. The exploit has been publicly...

CVE-2024-0273: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in Kashipara Food Management System up to 1.0. It has been classified as critical. Affected is an unknown function of the file addwasteentry.php. The manipulation of the argument itemname leads to sql injection. It is possible to launch the attack remotely. The exploit h...

CVE-2024-0270: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability, which was classified as critical, was found in Kashipara Food Management System up to 1.0. This affects an unknown part of the file itemlistsubmit.php. The manipulation of the argument itemname leads to sql injection. It is possible to initiate the attack remotely. The exploit ha...

CVE-2024-0274: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in Kashipara Food Management System up to 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file billAjax.php. The manipulation of the argument itemname leads to sql injection. The attack can be launched remotely. Th...

CVE-2023-6775

A vulnerability was found in CodeAstro POS and Inventory Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /item/itemcon. The manipulation of the argument itemname leads to cross site scripting. It is possible to initiate the attack remotely. T...

CVE-2023-6775: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in CodeAstro POS and Inventory Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /item/itemcon. The manipulation of the argument itemname leads to cross site scripting. It is possible to initiate the attack remotely. T...

CVE-2023-2691: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, was found in SourceCodester Personnel Property Equipment System 1.0. Affected is an unknown function of the file admin/additem.php of the component POST Parameter Handler. The manipulation of the argument itemname leads to cross site scripting...

hits script 1.0 - 'item_name' SQL Injection

Exploit Title: hits script 1.0 - 'itemname' SQL Injection Date: 2020-04-27 Exploit Author: SajjadBnd Vendor Homepage: https://hits.ir Software Link: http://dl.persianscript.ir/script/hitsir-script-persian%28PersianScript.ir%29.zip Software Linkmirror:...