CVE-2025-13344 SourceCodester Train Station Ticketing System ajax.php sql injection

A weakness has been identified in SourceCodester Train Station Ticketing System 1.0. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=login. This manipulation of the argument Username causes sql injection. The attack can be initiated remotely. The exploit ha...

CVE-2025-13344

CVE-2025-13344 affects SourceCodester Train Station Ticketing System 1.0. The vulnerability is a SQL injection in the /ajax.php?action=login handler, triggered by manipulating the Username parameter, with remote access and a public exploit. Impact is reported as high/critical on confidentiality, ...

CVE-2025-13271

A vulnerability was determined in Campcodes School Fees Payment Management System 1.0. This impacts an unknown function of the file /ajax.php?action=login. This manipulation of the argument Username causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly...

PT-2025-47302

Name of the Vulnerable Software and Affected Versions SourceCodester Train Station Ticketing System version 1.0 Description A SQL injection weakness exists in the Train Station Ticketing System. This issue is related to the manipulation of the Username argument within the login functionality,...

CVE-2025-13271 Campcodes School Fees Payment Management System ajax.php sql injection

A vulnerability was determined in Campcodes School Fees Payment Management System 1.0. This impacts an unknown function of the file /ajax.php?action=login. This manipulation of the argument Username causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly...

EUVD-2025-197776

A vulnerability was determined in Campcodes School Fees Payment Management System 1.0. This impacts an unknown function of the file /ajax.php?action=login. This manipulation of the argument Username causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly...

CVE-2025-13271 Campcodes School Fees Payment Management System ajax.php sql injection

A vulnerability was determined in Campcodes School Fees Payment Management System 1.0. This impacts an unknown function of the file /ajax.php?action=login. This manipulation of the argument Username causes sql injection. Remote exploitation of the attack is possible. The exploit has been publicly...

CVE-2025-13271

Campcodes School Fees Payment Management System 1.0 is affected by a SQL injection in /ajax.php?action=login, caused by unsafely handling the Username parameter. Multiple connected sources (CNVD-2026-05370, RH:CVE-2025-13271, CNNVD-202511-1928, CVE-2025-13271 listings, and PT-2025-47133) confirm ...

CampCodes School Fees Payment Management System SQL注入漏洞

School Fees Payment Management System is a tuition payment management system. The School Fees Payment Management System suffers from a SQL injection vulnerability that originates from the lack of validation of an externally-entered SQL statement for the parameter Username in the file...

PT-2025-47069

Name of the Vulnerable Software and Affected Versions itsourcecode Inventory Management System version 1.0 Description A SQL injection issue exists in itsourcecode Inventory Management System version 1.0. The issue is related to the manipulation of the user email argument within an unknown functi...

CVE-2022-4984

ZenTao Biz 6.5, ZenTao Max 3.0, ZenTao Open Source Edition 16.5, and ZenTao Open Source Edition 16.5.beta1 contain an SQL injection vulnerability in the login functionality. The application does not properly validate the account parameter on /zentao/user-login.html before using it in a database...

CVE-2022-4984 ZenTao Biz < 6.5, Max < 3.0, & Open Source Edition 16.5/16.5beta1 SQL Injection via user-login.html

ZenTao Biz 6.5, ZenTao Max 3.0, ZenTao Open Source Edition 16.5, and ZenTao Open Source Edition 16.5.beta1 contain an SQL injection vulnerability in the login functionality. The application does not properly validate the account parameter on /zentao/user-login.html before using it in a database...

CVE-2025-20378

In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, 9.2.9, and Splunk Cloud Platform versions below 10.0.2503.5, 9.3.2411.111, and 9.3.2408.121, an unauthenticated attacker could craft a malicious URL using the returnto parameter of the Splunk Web login endpoint. When an authenticated user...

CVE-2025-40681

Summary: CVE-2025-40681 describes a reflected XSS in xCally Omnichannel 3.30.1. The vulnerability arises when a attacker-provided value in the failureMessage parameter of the /login endpoint is reflected into the victim’s browser, allowing execution of arbitrary JavaScript. This can enable theft ...

CVE-2025-56385

A SQL injection vulnerability exists in the login functionality of WellSky Harmony version 4.1.0.2.83 within the 'xmHarmony.asp' endpoint. User-supplied input to the 'TXTUSERID' parameter is not properly sanitized before being incorporated into a SQL query. Successful authentication may lead to...

PT-2025-46825

Name of the Vulnerable Software and Affected Versions xCally Omnichannel version 3.30.1 Description A cross-site scripting XSS issue exists in xCally's Omnichannel version 3.30.1. The issue allows an attacker to execute JavaScript code in a victim’s browser. This is achieved by sending a maliciou...

CVE-2025-56385

A SQL injection vulnerability exists in the login functionality of WellSky Harmony version 4.1.0.2.83 within the 'xmHarmony.asp' endpoint. User-supplied input to the 'TXTUSERID' parameter is not properly sanitized before being incorporated into a SQL query. Successful authentication may lead to...

CVE-2025-20378

CVE-2025-20378 affects Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, 9.2.9 and Splunk Cloud Platform below 10.0.2503.5, 9.3.2411.111, 9.3.2408.121. An unauthenticated attacker can craft a malicious URL using the return_to parameter of the Splunk Web login endpoint; when an authenticated ...

CVE-2025-20378 Open Redirect on Web Login endpoint in Splunk Enterprise

In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, 9.2.9, and Splunk Cloud Platform versions below 10.0.2503.5, 9.3.2411.111, and 9.3.2408.121, an unauthenticated attacker could craft a malicious URL using the returnto parameter of the Splunk Web login endpoint. When an authenticated user...

Splunk Enterprise 9.2.0 < 9.2.9, 9.3.0 < 9.3.7, 9.4.0 < 9.4.5, 10.0.0 < 10.0.1 (SVD-2025-1101)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2025-1101 advisory. - In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, 9.2.9, and Splunk Cloud Platform versions below 10.0.2503.5,...