CVE-2022-46104---POC

CVE-2022-46104 https://www.sourcecodester.com/ 在人力资源管理系统项目的loginn.php页面中发现了XSS漏洞： 执行payload： http://localhost/hrm/loginn.php?msg=%3Cscript%3Ealert%27XSS%27%3C/script%3E...

CVE-2021-42663

CVE-2021-42663 CVE-2021-42662 - HTML Injection vulnerability in the Online event booking and reservation system version 2.3.0. Technical description: A HTML injection vulnerability exists in the Online Event Booking and Reservation System version 2.3.0. An attacker can leverage this vulnerability...

CVE-2023-46015-Code-Projects-Blood-Bank-1.0-Reflected-Cross-Site-Scripting-Vulnerability

CVE-2023-46015-Code-Projects-Blood-Bank-1.0-Reflected-Cross-Site-Scripting-Vulnerability 漏洞利用作者：ersinerenler 厂商主页 https://code-projects.org/blood-bank-in-php-with-source-code 软件链接 https://download-media.code-projects.org/2020/11/BloodBankInPHPWithSourcecode.zip 概述 Code-Projects Blood Bank V1.0...

CVE-2025-69606-GSVoIP-XSS

CVE-2025-69606 — GSVoIP Web Panel における反射型 XSS 重要度: 中 | CWE: CWE-79 | 認証の必要性: 不要 | 攻撃ベクトル: リモート 概要 反射型クロスサイトスクリプティング XSS の脆弱性が GSVoIP Web Panel v2.0.90 で特定されました。エラーのエンドポイントの msg パラメータは、HTML 応答に反映する前にユーザー制御の入力をサニタイズしないため、被害者のブラウザで任意の JavaScript が実行される可能性があります。 影響を受ける製品...

CVE-2026-37272

CVE-2026-37272 CVE-2026-37272 描述 /dashboard/settings.php 中的 Bank Management System in Web 1.0 存在反射型跨站脚本（XSS）漏洞。该漏洞是由于对 msg GET 参数中用户提供的输入未进行适当的清理所致。攻击者可以构造包含 JavaScript 代码的恶意 URL，当页面加载时，该代码会在受害者的浏览器中执行。 附加信息 该漏洞的产生是因为应用程序将 msg 参数直接反射到 HTML 响应中，而没有进行适当的输出编码。通过在该参数中注入 HTML 或 JavaScript...

CVE-2023-45158

CVE-2023-45158 步骤 1. 运行 Web 服务器 root@kitploit: cd web2py python3 web2py.py 2. 使用以下 URL 注入你的命令 http://:8000/hack?msg=%27%3B%3B%27。将 和 替换为你的值。 示例 1. 在服务器上创建一个文件 http://:8000/hack?msg=%27%3Btouch%20hack%3B%27 2. 反弹 shell 在攻击者的机器上，运行 nc -l 127.0.0.1 8080 访问 URL...

CVE-2026-87926

CVE-2026-87926 affects the Rizwan17 inventory-management-system (GitHub project), up to commit bfe78a330d01bb26b9daec5dc9ecd5c77900e03f . The vulnerability is a cross-site scripting (XSS) flaw in the Login Page component, specifically in the file index.php . Manipulation of the msg argument allow...

CVE-2026-6161

A vulnerability was determined in code-projects Simple ChatBox up to 1.0. This affects an unknown part of the file /chatbox/insert.php of the component Endpoint. Executing a manipulation of the argument msg can lead to sql injection. It is possible to launch the attack remotely. The exploit has...

CVE-2026-10607

A vulnerability was identified in DedeCMS 5.7.88. The impacted element is the function dedehtmlspecialchars of the file /plus/flink.php. The manipulation of the argument msg leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used...

CVE-2026-10607

The vulnerability CVE-2026-10607 affects DedeCMS 5.7.88. The issue resides in the function dede_htmlspecialchars in /plus/flink.php, where manipulation of the msg argument leads to an SQL injection. Attacks can be remote, and exploitation is publicly available. Impact is described as potentially ...

PT-2026-45818

Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7.88 Description A remote SQL injection is possible through the manipulation of the msg argument within the dede htmlspecialchars function located in the '/plus/flink.php' file. Recommendations As a temporary workaround,...

DesDev DedeCMS SQL注入漏洞

DesDev DedeCMS is an open-source content management system CMS developed by DesDev Corporation, based on PHP. This system offers functions such as content publishing, content management, content editing, and content retrieval. Version 5.7.88 of DesDev DedeCMS contains a SQL injection vulnerabilit...

CVE-2026-9413

A vulnerability was identified in SourceCodester Indian Invoicing System 1.0. The affected element is an unknown function of the file /Invoicing/category.php. The manipulation of the argument msg leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly availabl...

CVE-2026-9413 SourceCodester Indian Invoicing System category.php cross site scripting

A vulnerability was identified in SourceCodester Indian Invoicing System 1.0. The affected element is an unknown function of the file /Invoicing/category.php. The manipulation of the argument msg leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly availabl...

CVE-2026-9413

SourceCodester Indian Invoicing System 1.0 is affected by a cross-site scripting (XSS) flaw in the /Invoicing/category.php file. The vulnerability stems from manipulation of the message parameter (msg) that enables remote execution of an attacker-supplied script. Public exploit code exists. No re...

CVE-2025-69606

Cross-Site Scripting XSS vulnerability was discovered in the GSVoIP web panel version 2.0.90. The msg parameter in the /painel/gateways.php/error endpoint does not properly sanitize user-supplied input, allowing attackers to inject arbitrary JavaScript into the HTML response. A remote attacker ca...

CVE-2025-69606

Cross-Site Scripting XSS vulnerability was discovered in the GSVoIP web panel version 2.0.90. The msg parameter in the /painel/gateways.php/error endpoint does not properly sanitize user-supplied input, allowing attackers to inject arbitrary JavaScript into the HTML response. A remote attacker ca...

CVE-2025-69606

Cross-Site Scripting XSS vulnerability was discovered in the GSVoIP web panel version 2.0.90. The msg parameter in the /painel/gateways.php/error endpoint does not properly sanitize user-supplied input, allowing attackers to inject arbitrary JavaScript into the HTML response. A remote attacker ca...

Code-Projects Simple ChatBox 代码注入漏洞

Code-Projects Simple ChatBox is a simple chat box system developed by Code-Projects as open source. Versions of Code-Projects Simple ChatBox 1.0 and earlier contained a code injection vulnerability. This vulnerability stemmed from incorrect handling of the parameter “msg” in the file...

CVE-2026-30526

A Reflected Cross-Site Scripting XSS vulnerability exists in SourceCodester Zoo Management System v1.0. The vulnerability is located in the login page, specifically within the msg parameter. The application reflects the content of the msg parameter back to the user without proper HTML encoding or...