3319 matches found
PHPGurukul Online Shopping Portal 安全漏洞
Online Shopping Portal is an online store system. Online Shopping Portal suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements for the name, summary, review, quality, price, and value parameters in product-details.php. An attacker c...
vlife 路径遍历漏洞
vlife is a quasi-zero code platform for individual developers of programmer Chao wwwlike. A path traversal vulnerability exists in vlife 2.0.1 and earlier versions. The vulnerability stems from incorrect operation of the parameter fileName in the file...
CVE-2024-44664
PHPGurukul Online Shopping Portal 2.0 is vulnerable to SQL Injection via the name, summary, review, quality, price, and value parameters in product-details.php...
PT-2025-47200
Name of the Vulnerable Software and Affected Versions PHPGurukul Online Shopping Portal version 2.0 Description The PHPGurukul Online Shopping Portal version 2.0 is susceptible to SQL Injection. This issue affects the name, summary, review, quality, price, and value parameters within the...
PT-2025-47121
Name of the Vulnerable Software and Affected Versions wwwlike vlife versions up to 2.0.1 Description A security issue exists in wwwlike vlife that allows for path traversal. The issue is located in the create function within the vlife-base/src/main/java/cn/wwwlike/sys/api/SysFileApi.java file of...
CVE-2024-44664
PHPGurukul Online Shopping Portal 2.0 is affected by an SQL Injection in product-details.php. The vulnerability arises from lack of input validation for the name, summary, review, quality, price, and value parameters, allowing an attacker to alter SQL queries executed by the application. Based on...
CVE-2025-13202
The CVE-2025-13202 entry concerns code-projects Simple Cafe Ordering System 1.0. A cross-site scripting vulnerability exists in the /add_to_cart mechanism, triggered by manipulating the product_name parameter in that file. The vulnerability is described as exploitable remotely, and public exploit...
FantasticLBP Hotels Server SQL注入漏洞
FantasticLBP Hotels Server is a backend management system for hotel reservation system. FantasticLBP Hotels Server has a SQL injection vulnerability, the vulnerability stems from the incorrect operation of the parameter subjectId/cityName in the file controller/api/hotelList.php, which may lead t...
Code-Projects Simple Cafe Ordering System 代码注入漏洞
Simple Cafe Ordering System is a simple coffee ordering system. The Simple Cafe Ordering System suffers from a cross-site scripting vulnerability that arises from insufficient security filtering of the productname parameter in the /addtocart file. An attacker could use this vulnerability to execu...
CVE-2025-13181
CVE-2025-13181 affects pojoin h3blog 1.0. The vulnerability is in an unknown function within the file /admin/cms/material/add, where manipulation of the Name argument can lead to cross-site scripting. It can be exploited remotely, and public exploits have been disclosed. Remediation guidance from...
Bdtask SalesERP 安全漏洞
Bdtask SalesERP is a sales enterprise resource planning software from Bdtask Bangladesh. A security vulnerability exists in Bdtask SalesERP 20250728 and earlier versions, which stems from incorrect manipulation of the parameters firstname/lastname in the file /editprofile, and could lead to a bas...
EUVD-2024-55084
PHPGurukul Student Record System 3.20 is vulnerable to Cross Site Scripting XSS via adminname and aemailid parameters in /admin-profile.php...
CVE-2025-11994
The Easy Email Subscription plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2025-60646
A stored cross-site scripting XSS in the Business Line Management module of Xxl-api v1.3.0 attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter...
CVE-2025-60646
A stored cross-site scripting XSS in the Business Line Management module of Xxl-api v1.3.0 attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter...
CVE-2025-11994
The Easy Email Subscription plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2025-11994 Easy Email Subscription <= 1.3 - Unauthenticated Stored Cross-Site Scripting
The Easy Email Subscription plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
EUVD-2025-124904
The Easy Email Subscription plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2025-11994
The CVE-2025-11994 entry refers to the WordPress Easy Email Subscription plugin (versions up to and including 1.3) with an unauthenticated stored XSS via the name parameter due to insufficient input sanitization and output escaping. Wordfence’s report confirms this as a real vulnerability affecti...
