CVE-2026-58028: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation CentralAuth. This vulnerability is associated with program files includes/Api/ApiFormatBase.Php, includes/Api/ApiHelp.Php,...

CVE-2026-10172 Bdtask Multi-Store Inventory Management System Component Module.php upload unrestricted upload

A security flaw has been discovered in Bdtask Multi-Store Inventory Management System 1.0. The affected element is the function Upload of the file application/modules/dashboard/controllers/Module.php of the component Component Module. The manipulation of the argument module results in unrestricte...

CVE-2026-10172

The CVE-2026-10172 entry concerns Bdtask Multi-Store Inventory Management System 1.0. The vulnerability lies in the Upload function of the file application/modules/dashboard/controllers/Module.php within the Module component, where manipulating the module argument yields unrestricted file upload....

CVE-2026-10172: Unrestricted Upload of File with Dangerous Type

A security flaw has been discovered in Bdtask Multi-Store Inventory Management System 1.0. The affected element is the function Upload of the file application/modules/dashboard/controllers/Module.php of the component Component Module. The manipulation of the argument module results in unrestricte...

CVE-2026-38931: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in the /admin/config-module.php component of creatorsofcode simplephp GitHub commit 5184cff Latest as of 2026-02-27 via injecting a crafted payload...

PT-2026-42495

Name of the Vulnerable Software and Affected Versions Open ISES Tickets versions prior to 3.44.2 Description A reflected cross-site scripting issue exists in the 'delete module.php' endpoint. Authenticated attackers can inject arbitrary JavaScript by providing unsanitized values through the modul...

CVE-2025-15195: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was determined in code-projects Assessment Management 1.0. Affected by this issue is some unknown functionality of the file /admin/add-module.php. This manipulation of the argument linked causes sql injection. The attack can be initiated remotely. The exploit has been publicly...

CVE-2024-42618

Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /module.php?module=karma...

CVE-2024-42618: Cross-Site Request Forgery (CSRF)

Pligg CMS v2.0.2 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /module.php?module=karma...

CVE-2024-42618

CVE-2024-42618 affects Pligg CMS (also referred to as Kliqqi CMS) v2.0.2. The vulnerability is a Cross-Site Request Forgery (CSRF) that can be triggered via the endpoint /module.php?module=karma, allowing an attacker to forge a request on behalf of a logged-in user. No explicit exploit details ar...

CVE-2023-46304

Vtiger CRM version 7.5.0 is vulnerable to Remote Code Execution (RCE) due to a flaw in modules/Users/models/Module.php. An authenticated attacker can exploit an unprotected endpoint to write arbitrary PHP code into the config.inc.php file, which is executed on every page load. Technical analysis ...

CVE-2023-46304: Improper Neutralization of Special Elements in Output Used by a Downstream Component

modules/Users/models/Module.php in Vtiger CRM 7.5.0 allows a remote authenticated attacker to run arbitrary PHP code because an unprotected endpoint allows them to write this code to the config.inc.php file executed on every page load...

PT-2024-13351 · Vtiger · Vtiger Crm

Name of the Vulnerable Software and Affected Versions: Vtiger CRM version 7.5.0 Description: The issue allows a remote authenticated attacker to run arbitrary PHP code because an unprotected endpoint allows them to write this code to the config.inc.php file, which is executed on every page load...

CVE-2022-1329: Missing Authorization

The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the /core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading malicious files...

Cross site request forgery (csrf)

Kliqqi 3.0.0.5 allows CSRF with resultant Arbitrary File Upload because module.php?module=upload can be used to configure the uploading of .php files, and then modules/upload/uploadmain.php can be used for the upload itself...

CVE-2016-10756

Kliqqi 3.0.0.5 allows CSRF with resultant Arbitrary File Upload because module.php?module=upload can be used to configure the uploading of .php files, and then modules/upload/uploadmain.php can be used for the upload itself...

CVE-2016-10756

CVE-2016-10756 affects Kliqqi 3.0.0.5. A CSRF flaw enables configuring the upload of PHP files via module.php?module=upload and then using modules/upload/upload_main.php to perform the upload, resulting in Arbitrary File Upload. The Red Hat advisory and CNVD/CVE records corroborate a CSRF path le...

CVE-2016-10756: Cross-Site Request Forgery (CSRF)

Kliqqi 3.0.0.5 allows CSRF with resultant Arbitrary File Upload because module.php?module=upload can be used to configure the uploading of .php files, and then modules/upload/uploadmain.php can be used for the upload itself...

VisualShapers EZContents 1.4/2.0 Module.PHP Remote Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/9396/info A problem in handling of specific types of input passed to the module.php script in VisualShapers ezContents has been discovered. Because of this, an attacker may be able to gain unauthorized access to vulnerabl...

CVE-2013-6267: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Claroline before 1.11.9 allow remote attackers to inject arbitrary web script or HTML via the 1 box parameter to messaging/messagebox.php, cidToEdit parameter to 2 adminregisteruser.php or 3 adminusercoursesettings.php in admin/, 4 moduleid...