CVE-2018-25201: Improper Neutralization of Special Elements used in an SQL Command

School Management System CMS 1.0 contains an SQL injection vulnerability in the admin login functionality that allows attackers to bypass authentication by injecting SQL code through the username parameter. Attackers can submit malicious payloads using boolean-based blind SQL injection techniques...

CVE-2025-7714: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Global Interactive Design Media Software Inc. Content Management System CMS allows Command Line Execution through SQL Injection. This issue affects Content Management System CMS: through 21072025...

CVE-2025-7713: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Global Interactive Design Media Software Inc. Content Management System CMS allows XSS Through HTTP Headers. This issue affects Content Management System CMS: through 21072025...

CVE-2025-63551: Improper Restriction of XML External Entity Reference

A Server-Side Request Forgery SSRF vulnerability, achievable through an XML External Entity XXE injection, exists in MetInfo Content Management System CMS thru 8.1. This flaw stems from a defect in the XML parsing logic, which allows an attacker to construct a malicious XML entity that forces the...

PT-2024-13668

Name of the Vulnerable Software and Affected Versions CU Solutions Group CUSG Content Management System CMS versions prior to 7.75 Description A Cross Site Scripting XSS issue allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted...

CVE-2023-48987: Improper Neutralization of Special Elements used in an SQL Command

Blind SQL Injection vulnerability in CU Solutions Group CUSG Content Management System CMS before v.7.75 allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted script to the pages.php component...

CVE-2023-48986: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in CU Solutions Group CUSG Content Management System CMS before v.7.75 allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted script to the users.php component...

CVE-2023-48985: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting XSS vulnerability in CU Solutions Group CUSG Content Management System CMS before v.7.75 allows a remote attacker to execute arbitrary code, escalate privileges, and obtain sensitive information via a crafted script to the login.php component...

CVE-2023-3527: Improper Neutralization of Formula Elements in a CSV File

A CSV injection vulnerability was found in the Avaya Call Management System CMS Supervisor web application which allows a user with administrative privileges to input crafted data which, when exported to a CSV file, may attempt arbitrary command execution on the system used to open the file by a...

PT-2023-25199

Name of the Vulnerable Software and Affected Versions Avaya Call Management System CMS Supervisor affected versions not specified Description A CSV injection issue was found in the Avaya Call Management System CMS Supervisor web application, allowing a user with administrative privileges to input...

[SECURITY] Fedora 36 Update: moodle-3.11.10-1.fc36

Moodle is a course management system CMS - a free, Open Source software package designed using sound pedagogical principles, to help educators create effective online learning communities...

CVE-2018-20589: Improper Neutralization of Input During Web Page Generation

Ivan Cordoba Generic Content Management System CMS through 2018-04-28 has XSS via the Administrator/addpictures.php article ID...

PT-2018-15453

Name of the Vulnerable Software and Affected Versions Ivan Cordoba Generic Content Management System CMS through 2018-04-28 Description The issue concerns a Cross-Site Scripting XSS flaw. It is exploitable via the Administrator/add pictures.php article ID. Recommendations For Ivan Cordoba Generic...

CVE-2018-20590: Improper Neutralization of Input During Web Page Generation

Ivan Cordoba Generic Content Management System CMS through 2018-04-28 has XSS via the Administrator/users.php user ID...

PT-2018-15454

Name of the Vulnerable Software and Affected Versions Ivan Cordoba Generic Content Management System CMS through 2018-04-28 Description The issue allows for XSS via the Administrator/users.php user ID. Recommendations For Ivan Cordoba Generic Content Management System CMS through 2018-04-28, avoi...

CVE-2018-20568: Improper Neutralization of Special Elements used in an SQL Command

Administrator/index.php in Ivan Cordoba Generic Content Management System CMS through 2018-04-28 allows SQL injection for authentication bypass...

PT-2018-15439

Name of the Vulnerable Software and Affected Versions Ivan Cordoba Generic Content Management System CMS versions through 2018-04-28 Description The issue allows for SQL injection, which can be used for authentication bypass. This means an attacker could potentially gain unauthorized access to th...

CVE-2017-15984: Improper Neutralization of Special Elements used in an SQL Command

Creative Management System CMS Lite 1.4 allows SQL Injection via the S parameter to index.php...

PT-2017-14339

Name of the Vulnerable Software and Affected Versions Creative Management System CMS Lite version 1.4 Description The issue allows SQL Injection via the S parameter to the "index.php" endpoint. Recommendations For Creative Management System CMS Lite version 1.4, consider restricting access to the...

CVE-2012-5358: Undefined Security Weakness

The XSLTCompiledTransform function in Ektron Content Management System CMS before 8.02 SP5 configures the XSL with enableDocumentFunction set to true, which allows remote attackers to read arbitrary files and consequently bypass authentication, modify viewstate, cause a denial of service, or...