CVE-2022-46104---POC

CVE-2022-46104 https://www.sourcecodester.com/ XSS has been discovered on Human Resource Management System Project loginn.php page: Execution payload: http://localhost/hrm/loginn.php?msg=%3Cscript%3Ealert%27XSS%27%3C/script%3E...

CVE-2023-46015-Code-Projects-Blood-Bank-1.0-Reflected-Cross-Site-Scripting-Vulnerability

CVE-2023-46015-Code-Projects-Blood-Bank-1.0-Reflejado-Cross-Site-Scripting-Vulnerabilidad Autor del Exploit: ersinerenler Página del proveedor https://code-projects.org/blood-bank-in-php-with-source-code Enlace del software...

CVE-2025-69606-GSVoIP-XSS

CVE-2025-69606 — XSS Reflejado en el Panel Web de GSVoIP Severidad: Media | CWE: CWE-79 | Auth Requerida: No | Vector: Remoto Resumen Se identificó una vulnerabilidad de Cross-Site Scripting XSS Reflejado en el Panel Web de GSVoIP v2.0.90. El parámetro msg del endpoint de error no sanitiza la...

CVE-2026-37272

CVE-2026-37272 CVE-2026-37272 Description A reflected cross-site scripting XSS vulnerability exists in /dashboard/settings.php in Bank Management System in Web 1.0. The vulnerability occurs due to improper sanitization of user-supplied input in the msg GET parameter. An attacker can craft a...

CVE-2023-45158

CVE-2023-45158 Steps 1. Run the webserver root@kitploit: cd web2py python3 web2py.py 2. Inject your command using the URL http://:8000/hack?msg=%27%3B%3B%27. Replace and with your values. Examples 1. Create a file on the server http://:8000/hack?msg=%27%3Btouch%20hack%3B%27 2. Reverse shell On th...

CVE-2021-42663

CVE-2021-42663 CVE-2021-42662 - Vulnerabilidad de inyección HTML en el sistema de reservas de eventos en línea versión 2.3.0. Descripción técnica: Existe una vulnerabilidad de inyección HTML en el sistema de reservas de eventos en línea versión 2.3.0. Un atacante puede aprovechar esta...

CVE-2026-6161

A vulnerability was determined in code-projects Simple ChatBox up to 1.0. This affects an unknown part of the file /chatbox/insert.php of the component Endpoint. Executing a manipulation of the argument msg can lead to sql injection. It is possible to launch the attack remotely. The exploit has...

CVE-2026-10607

A vulnerability was identified in DedeCMS 5.7.88. The impacted element is the function dedehtmlspecialchars of the file /plus/flink.php. The manipulation of the argument msg leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used...

CVE-2026-10607

The vulnerability CVE-2026-10607 affects DedeCMS 5.7.88. The issue resides in the function dede_htmlspecialchars in /plus/flink.php, where manipulation of the msg argument leads to an SQL injection. Attacks can be remote, and exploitation is publicly available. Impact is described as potentially ...

PT-2026-45818

Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7.88 Description A remote SQL injection is possible through the manipulation of the msg argument within the dede htmlspecialchars function located in the '/plus/flink.php' file. Recommendations As a temporary workaround,...

DesDev DedeCMS SQL注入漏洞

DesDev DedeCMS is an open-source content management system CMS developed by DesDev Corporation, based on PHP. This system offers functions such as content publishing, content management, content editing, and content retrieval. Version 5.7.88 of DesDev DedeCMS contains a SQL injection vulnerabilit...

CVE-2026-9413

A vulnerability was identified in SourceCodester Indian Invoicing System 1.0. The affected element is an unknown function of the file /Invoicing/category.php. The manipulation of the argument msg leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly availabl...

CVE-2026-9413

SourceCodester Indian Invoicing System 1.0 is affected by a cross-site scripting (XSS) flaw in the /Invoicing/category.php file. The vulnerability stems from manipulation of the message parameter (msg) that enables remote execution of an attacker-supplied script. Public exploit code exists. No re...

CVE-2026-9413 SourceCodester Indian Invoicing System category.php cross site scripting

A vulnerability was identified in SourceCodester Indian Invoicing System 1.0. The affected element is an unknown function of the file /Invoicing/category.php. The manipulation of the argument msg leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly availabl...

CVE-2025-69606

Cross-Site Scripting XSS vulnerability was discovered in the GSVoIP web panel version 2.0.90. The msg parameter in the /painel/gateways.php/error endpoint does not properly sanitize user-supplied input, allowing attackers to inject arbitrary JavaScript into the HTML response. A remote attacker ca...

CVE-2025-69606

Cross-Site Scripting XSS vulnerability was discovered in the GSVoIP web panel version 2.0.90. The msg parameter in the /painel/gateways.php/error endpoint does not properly sanitize user-supplied input, allowing attackers to inject arbitrary JavaScript into the HTML response. A remote attacker ca...

CVE-2025-69606

Cross-Site Scripting XSS vulnerability was discovered in the GSVoIP web panel version 2.0.90. The msg parameter in the /painel/gateways.php/error endpoint does not properly sanitize user-supplied input, allowing attackers to inject arbitrary JavaScript into the HTML response. A remote attacker ca...

Code-Projects Simple ChatBox 代码注入漏洞

Code-Projects Simple ChatBox is a simple chat box system developed by Code-Projects as open source. Versions of Code-Projects Simple ChatBox 1.0 and earlier contained a code injection vulnerability. This vulnerability stemmed from incorrect handling of the parameter “msg” in the file...

CVE-2026-30526

A Reflected Cross-Site Scripting XSS vulnerability exists in SourceCodester Zoo Management System v1.0. The vulnerability is located in the login page, specifically within the msg parameter. The application reflects the content of the msg parameter back to the user without proper HTML encoding or...

CVE-2026-30526

CVE-2026-30526 affects SourceCodester Zoo Management System v1.0. The vulnerability is located on the login page in the msg parameter, where user-supplied content is echoed back without proper HTML encoding/sanitization, enabling a reflected XSS via a crafted URL. The connected documents confirm ...