CVE-2025-14211

A vulnerability was detected in projectworlds Advanced Library Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /deletebook.php. Performing a manipulation of the argument bookid results in sql injection. The attack may be initiated remotely. The exploi...

CVE-2025-14207

A vulnerability was identified in tushar-2223 Hotel-Management-System up to bb1f3b3666124b888f1e4bcf51b6fba9fbb01d15. The impacted element is an unknown function of the file /admin/invoiceprint.php. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack...

OpenBMCS 安全漏洞

OpenBMCS is a building management and control system from OpenBMCS Australia. A security vulnerability exists in OpenBMCS version 2.4 that stems from an information disclosure issue in the directory listing function that could lead to sensitive file access...

itsourcecode Student Management System 安全漏洞

itsourcecode Student Management System is an open source student management system from itsourcecode. A security vulnerability exists in version 1.0 of itsourcecode Student Management System, which originates from the incorrect operation of the parameter grade in the file /newgrade.php, and could...

PT-2025-50209

Name of the Vulnerable Software and Affected Versions itsourcecode Student Management System version 1.0 Description A flaw exists in itsourcecode Student Management System 1.0, specifically within the file /new adviser.php. Manipulation of the Name argument in an unknown function can lead to SQL...

itsourcecode Student Management System SQL注入漏洞

itsourcecode Student Management System is an open source student management system from itsourcecode. A SQL injection vulnerability exists in version 1.0 of itsourcecode Student Management System, which stems from an incorrect operation of the parameter sy in the file /promote.php, which could le...

itsourcecode Student Management System SQL注入漏洞

itsourcecode Student Management System is an open source student management system from itsourcecode. A SQL injection vulnerability exists in version 1.0 of itsourcecode Student Management System, which stems from a misuse of the parameter sy in the file /newschoolyear.php, which could lead to a...

OpenBMCS 跨站请求伪造漏洞

OpenBMCS is a building management and control system from OpenBMCS Australia. A cross-site request forgery vulnerability exists in OpenBMCS version 2.4, which stems from a cross-site request forgery issue in the sendFeedback.php endpoint that could lead to the execution of an administrator action...

itsourcecode Student Management System SQL注入漏洞

itsourcecode Student Management System is an open source student management system from itsourcecode. A SQL injection vulnerability exists in version 1.0 of itsourcecode Student Management System, which originates from a misuse of the parameter Name in the file /newadviser.php, which could lead t...

PT-2025-50211

Name of the Vulnerable Software and Affected Versions itsourcecode Student Management System version 1.0 Description A flaw exists in itsourcecode Student Management System 1.0 related to SQL injection. The issue is located in the file /new school year.php and involves manipulation of the sy...

PT-2025-50212

Name of the Vulnerable Software and Affected Versions itsourcecode Student Management System version 1.0 Description A SQL injection issue exists in the Student Management System due to the manipulation of the sy argument within the /promote.php file. This allows for remote attacks. The exploit h...

PT-2025-50220

Name of the Vulnerable Software and Affected Versions itsourcecode Student Management System version 1.0 Description A flaw exists in itsourcecode Student Management System 1.0. The issue is related to the manipulation of the grade argument within the /new grade.php file, leading to a SQL injecti...

CVE-2025-66204

WBCE CMS 1.6.4 contains a brute-force protection bypass where an attacker can indefinitely reset the password-guess counter by manipulating the X-Forwarded-For header on every request. The application fully trusts X-Forwarded-For without validation or restriction, effectively allowing unlimited p...

CVE-2025-66204 WBCE CMS allows brute-force protection bypass using X-Forwarded-For header

WBCE CMS is a content management system. Version 1.6.4 contains a brute-force protection bypass where an attacker can indefinitely reset the counter by modifying X-Forwarded-For on each request, gaining unlimited password guessing attempts, effectively bypassing all brute-force protection. The...

EUVD-2025-201798

SQL injection vulnerability in /php/apipatientschedule.php in SourceCodester Patients Waiting Area Queue Management System v1 allows attackers to execute arbitrary SQL commands via the appointmentID parameter...

EUVD-2025-201732

A flaw has been found in itsourcecode Student Management System 1.0. Affected is an unknown function of the file /newrecord.php. Executing manipulation of the argument ID can lead to sql injection. The attack can be launched remotely. The exploit has been published and may be used...

EUVD-2025-201733

A vulnerability was detected in itsourcecode Student Management System 1.0. This impacts an unknown function of the file /newcurriculm.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit is now public and may be used...

CVE-2025-64081

SQL injection vulnerability in /php/apipatientschedule.php in SourceCodester Patients Waiting Area Queue Management System v1 allows attackers to execute arbitrary SQL commands via the appointmentID parameter...

CVE-2025-64081

SQL injection vulnerability in /php/apipatientschedule.php in SourceCodester Patients Waiting Area Queue Management System v1 allows attackers to execute arbitrary SQL commands via the appointmentID parameter...

CVE-2025-14258

A vulnerability has been found in itsourcecode Student Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /newsubject.php. The manipulation of the argument sub leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed t...