CVE-2026-5357: Improper Neutralization of Input During Web Page Generation

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sid' parameter of the 'wpdmmembers' shortcode in versions up to and including 3.3.52. This is due to insufficient input sanitization and output escaping on the user-supplied 'sid' shortcode attribute...

EUVD-2017-9482

Malware in sbrugna...

EUVD-2013-5151

Malware in sbrugna...

EUVD-2006-6265

Malware in sbrugna...

EUVD-2007-1895

Malware in sbrugna...

PT-2025-7793

Name of the Vulnerable Software and Affected Versions Seacms versions =13.3 Description The issue is related to SQL injection in the admin members.php file. This allows for potential exploitation. No information is provided about the estimated number of potentially affected devices worldwide or...

PT-2024-31927

Name of the Vulnerable Software and Affected Versions CodeAstro Membership Management System version 1.0 Description The issue is related to Cross Site Scripting XSS, which occurs via the address parameter in the "add members.php" and "edit member.php" files. This allows for potential malicious...

PT-2024-31683

Name of the Vulnerable Software and Affected Versions: CodeAstro MembershipM-PHP aka Membership Management System in PHP version 1.0 Description: The issue allows for stored XSS in the fullname parameter of the "add members.php" page. This can lead to malicious script execution when the stored da...

CVE-2020-12461

PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism. An attacker can develop a crafted payload that can be inserted into the sortorder GET parameter on the members.php members search page. This parameter allows for control over anything after the...

Sql injection

PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism. An attacker can develop a crafted payload that can be inserted into the sortorder GET parameter on the members.php members search page. This parameter allows for control over anything after the...

CVE-2020-12461

PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism. An attacker can develop a crafted payload that can be inserted into the sortorder GET parameter on the members.php members search page. This parameter allows for control over anything after the...

PT-2020-5578

Name of the Vulnerable Software and Affected Versions PHP-Fusion version 9.03.50 Description The issue is related to insufficient protection mechanisms in the maincore.php file, allowing for SQL injection attacks. An attacker can craft a payload to insert into the sort order GET parameter on the...

CVE-2020-12461: Improper Neutralization of Special Elements used in an SQL Command

PHP-Fusion 9.03.50 allows SQL Injection because maincore.php has an insufficient protection mechanism. An attacker can develop a crafted payload that can be inserted into the sortorder GET parameter on the members.php members search page. This parameter allows for control over anything after the...

CVE-2017-18364

phpFK lite has XSS via the faq.php, members.php, or search.php query string or the user.php user parameter...

CVE-2017-18364

CVE-2017-18364 concerns phpFK lite and is a reflected cross-site scripting (XSS) vulnerability. The affected components are the web interface files faq.php, members.php, search.php (via query strings) and user.php (via the user parameter). The underlying issue is that user-supplied input in these...

PT-2019-8301

Name of the Vulnerable Software and Affected Versions phpFK lite affected versions not specified Description The issue concerns an XSS vulnerability. It can be exploited via the query string in faq.php, members.php, or search.php, or through the user parameter in user.php. Recommendations At the...

CVE-2017-18364: Improper Neutralization of Input During Web Page Generation

phpFK lite has XSS via the faq.php, members.php, or search.php query string or the user.php user parameter...

CVE-2018-17996

LayerBB before 1.1.3 allows CSRF for adding a user via admin/newuser.php, deleting a user via admin/members.php/deleteuser/, and deleting content via mod/delete.php/...

CVE-2018-17996: Cross-Site Request Forgery (CSRF)

LayerBB before 1.1.3 allows CSRF for adding a user via admin/newuser.php, deleting a user via admin/members.php/deleteuser/, and deleting content via mod/delete.php/...

PT-2019-9540

Name of the Vulnerable Software and Affected Versions LayerBB versions prior to 1.1.3 Description The issue allows for Cross-Site Request Forgery CSRF attacks, which can be used to perform unauthorized actions such as adding a user via "admin/new user.php", deleting a user via...