CVE-2024-37791

CVE-2024-37791 CVE-2024-37791 Project address: Preparatory work: Log in to the backend - get cookie Vulnerability URL: http://127.0.0.1:8093/s/article/Content/index?classid=&keyword= Vulnerability parameter: keyword payload: %27andselectfromselect+ifasciisubstrdatabase,1,1%3E97,sleep1,0a//union/...

CVE-2023-51504

CVE-2023-51504 This is a dockerized reproduction of the MotoCMS SQL injection cf exploit db Description MotoCMS Version 3.4.3 SQL Injection via the keyword parameter on the link https://template189526.motopreview.com/store/category/search/?keyword=1 Reproducing the vulnerability involved defining...

CVE-2026-110609 Dromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter

Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw $ substitution. Attackers can send crafted keyword values to the...

CVE-2026-110609 Dromara Skyeye through commit 65d3ddcede70 SQL Injection via keyword Parameter

Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw $ substitution. Attackers can send crafted keyword values to the...

CVE-2026-110609

The Dromara Skyeye application (through commit 65d3ddcede70) is vulnerable to SQL Injection via the keyword parameter in the queryErpOrderItem MyBatis statement. The root cause is the use of raw ${} substitution instead of prepared statements. Authenticated low-privileged users can send crafted k...

EUVD-2026-101237

Dromara Skyeye through commit 65d3ddcede70 contains an sql injection vulnerability that allows authenticated low-privileged users to inject SQL via the keyword parameter in the queryErpOrderItem MyBatis statement using raw $ substitution. Attackers can send crafted keyword values to the...

CVE-2025-51970

CVE-2025-51970 CVE-2025-51970 - SQL Injection in Online Shopping System Advanced Summary A critical SQL Injection vulnerability was discovered in the Online Shopping System Advanced project by PuneethReddyHC. The flaw resides in action.php, which fails to properly sanitize user input from the...

WordPress Pochipp plugin <= 1.20.2 - Reflected Cross-Site Scripting via 'keyword' Parameter vulnerability

Reflected Cross-Site Scripting via 'keyword' Parameter vulnerability discovered by Dmitrii Ignatyev - CleanTalk Inc in WordPress Plugin Pochipp versions = 1.20.2...

CVE-2026-92967

The Pochipp plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'keyword' parameter in versions up to, and including, 1.20.2. This is due to insufficient output escaping , which reads $GET'keyword', applies only sanitizetextfield which strips tags but leaves double quotes...

CVE-2026-92967 Pochipp <= 1.20.2 - Reflected Cross-Site Scripting via 'keyword' Parameter

The Pochipp plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'keyword' parameter in versions up to, and including, 1.20.2. This is due to insufficient output escaping , which reads $GET'keyword', applies only sanitizetextfield which strips tags but leaves double quotes...

EUVD-2026-83479

The Pochipp plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'keyword' parameter in versions up to, and including, 1.20.2. This is due to insufficient output escaping , which reads $GET'keyword', applies only sanitizetextfield which strips tags but leaves double quotes...

PT-2026-95748

Name of the Vulnerable Software and Affected Versions Pochipp versions prior to 1.20.3 Description The plugin is subject to Reflected Cross-Site Scripting, a flaw where an application includes untrusted data in a web page without proper validation or escaping. This occurs because the application...

CVE-2026-92967: Improper Neutralization of Input During Web Page Generation

The Pochipp plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'keyword' parameter in versions up to, and including, 1.20.2. This is due to insufficient output escaping , which reads $GET'keyword', applies only sanitizetextfield which strips tags but leaves double quotes...

PT-2026-90594

Name of the Vulnerable Software and Affected Versions Royal Addons for Elementor – Addons and Templates Kit for Elementor versions prior to 1.7.107 Description The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress allows unauthenticated attackers to extract...

CVE-2026-82701 code-projects Online Shopping System Search Functionality action.php sql injection

A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to initiate the attack...

EUVD-2026-68594

A vulnerability was determined in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /action.php of the component Search Functionality. This manipulation of the argument keyword causes sql injection. It is possible to initiate the attack...

PHPJabbers PHP Forum Script 3.0 - Cross-Site Scripting Detection

PhpJabbers PHP Forum Script 3.0 is vulnerable to Cross Site Scripting XSS via the keyword parameter. !/usr/bin/env python3 -- coding: utf-8 -- """PhpJabbers PHP Forum Script 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

CVE-2026-46686 Emlog Reflected Cross-Site Scripting

Emlog is an open source website building system. In 2.6.13 and earlier, the admin backend user search module's keyword parameter from admin/user.php is processed with addslashes but not HTML-escaped before being rendered into the value attribute in admin/views/user.php, allowing reflected...

CVE-2026-46686: Improper Neutralization of Input During Web Page Generation

Emlog is an open source website building system. In 2.6.13 and earlier, the admin backend user search module's keyword parameter from admin/user.php is processed with addslashes but not HTML-escaped before being rendered into the value attribute in admin/views/user.php, allowing reflected...

CVE-2026-12385

The Smart Slider 3 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.1.37 via the 'keyword' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract titles and full content...