CVE-2025-12215 projectworlds Online Shopping System login_submit.php sql injection

A flaw has been found in projectworlds Online Shopping System 1.0. Impacted is an unknown function of the file /loginsubmit.php. Executing a manipulation of the argument keywords can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used...

CVE-2025-12208

A vulnerability was found in SourceCodester Best House Rental Management System 1.0. This impacts the function login2 of the file /adminclass.php. Performing manipulation of the argument Username results in sql injection. The attack is possible to be carried out remotely. The exploit has been mad...

[SECURITY] Fedora 42 Update: python-sqlparse-0.4.2-14.fc42

sqlparse is a tool for parsing SQL strings. It can generate pretty-printed renderings of SQL in various formats. It is a python module, together with a command-line tool...

CVE-2025-11447

CVE-2025-11447 affects GitLab CE/EE with DoS risk from unauthenticated GraphQL requests carrying crafted JSON payloads. Affected versions include 11.0–18.3.5, 18.4 prior to 18.4.3, and 18.5 prior to 18.5.1. Remediation has been issued; updates to GitLab 18.5.1 (and later) address the issue. Explo...

CVE-2025-11447 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to cause a denial of service condition by sending GraphQL requests with crafted JSON payloads...

CVE-2025-11447 Allocation of Resources Without Limits or Throttling in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 11.0 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could have allowed an unauthenticated attacker to cause a denial of service condition by sending GraphQL requests with crafted JSON payloads...

PT-2025-43897

Name of the Vulnerable Software and Affected Versions TOTOLINK A3300R version 17.0.0cu.557 B20221024 Description A flaw exists in TOTOLINK A3300R that allows for remote attacks. The issue is a stack-based buffer overflow within the setLanguageCfg function located in the /cgi-bin/cstecgi.cgi file,...

PT-2025-43964

Name of the Vulnerable Software and Affected Versions PingFederate affected versions not specified Description A configuration issue in PingFederate’s HTML Form Adapter, specifically when operating in non-default redirectless mode, can lead to unexpected authentication form rendering. This allows...

编号撤回

dnsmasq is a lightweight DNS forwarding and DHCP, TFTP server written in C. edb is a cross-platform AArch32/x86/x86-64 debugger. This CVE number has been withdrawn...

CVE-2025-61247

CVE-2025-61247 affects indieka900 online-shopping-system-php 1.0. The vulnerability is a SQL Injection in the password parameter of login.php, as described across multiple sources (NVD entry and related advisories). The underlying issue is unvalidated SQL handling in the login flow, enabling pote...

CLTPHP Content Management System SQL注入漏洞

CLTPHP Content Management System is a content management system from the Chinese company CLTPHP. A SQL injection vulnerability exists in CLTPHP Content Management System version 3.0. The vulnerability stems from an incorrect manipulation of the parameter keyword in the file /home/search.html, whi...

Code-Projects Online Event Judging System SQL注入漏洞

Online Event Judging System is an online event judging system. Online Event Judging System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter contestantid in the file /editcontestant.php. An attacker can...

CVE-2025-54967

An issue was discovered in BAE SOCET GXP before 4.6.0.3. It permits external entities in certain XML-based files. An attacker who is able to social engineer a SOCET GXP user into opening a malicious file can trigger a variety of outbound requests, potentially compromising sensitive information in...

CVE-2025-54967

CVE-2025-54967 affects BAE Systems SOCET GXP up to version 4.6.0.3. The issue arises from allowing external entities in certain XML-based files, enabling an attacker who entices a user to open a malicious file to trigger outbound requests and potentially disclose sensitive information. The root c...

PT-2025-44041

A vulnerability has been found in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /panel/forgot-password.php. The manipulation of the argument email leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public...

PT-2025-44017

Name of the Vulnerable Software and Affected Versions Nero Social Networking Site version 1.0 Description A security flaw exists in the /deletemessage.php file of Nero Social Networking Site. Manipulation of the message id argument can lead to SQL injection. This issue can be exploited remotely...

Important: perl-YAML-Syck

Issue Overview: YAML::Syck versions before 1.36 for Perl has missing null-terminators which causes out-of-bounds read and potential information disclosure Missing null terminators in token.c leads to but-of-bounds read which allows adjacent variable to be read The issue is seen with complex YAML...

AhnLab EPP 安全漏洞

AhnLab EPP is a set of endpoint security protection platform from AhnLab, Korea. A security vulnerability exists in AhnLab EPP version 1.0.15, which stems from an incorrect manipulation of the parameter preview and could lead to an SQL injection attack...

Evaluation of Vision-LLMs in Surveillance Video

The widespread use of cameras in our society has created an overwhelming amount of video data, far exceeding the capacity for human monitoring. This presents a critical challenge for public safety and security, as the timely detection of anomalous or criminal events is crucial for effective...

Bdtask Wholesale Inventory Control SQL注入漏洞

Bdtask Wholesale Inventory Control is an inventory management system from Bdtask Bangladesh. A SQL injection vulnerability exists in Bdtask Wholesale Inventory Control 20251013 and earlier versions, which stems from incorrect manipulation of the parameter firstname/lastname in the file...