CVE-2025-63451

CVE-2025-63451 affects Car-Booking-System-PHP v1.0 vulnerable via SQL Injection in /carlux/sign-in.php due to insufficient input validation. Underlying flaw enables unauthorized data access/manipulation with high impact across confidentiality, integrity, and availability (CVSS 3.1: 9.8). Evidence...

school-management-system 安全漏洞

school-management-system is a PHP school management system for schools or small organizations developed by Shubham kumar, an individual developer. A security vulnerability exists in school-management-system version 1.0, which stems from an unvalidated parameter password in /login.php, which could...

CVE-2025-63447

Water Management System v1.0 is vulnerable to Cross Site Scripting XSS in /addcustomer.php...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Denial of Service in huggingface/transformers [CVE-2025-3262, CVE-2025-3264, CVE-2025-3933, CVE-2025-3263]

Summary IBM Watson Speech Services Cartridge is vulnerable to a Denial of Service in huggingface/transformers, due to various issues identified within the package CVE-2025-3262, CVE-2025-3264, CVE-2025-3933, CVE-2025-3263. Huggingface/transformers is used in our speech service runtimes. This...

CVE-2025-11806 Qzzr Shortcode Plugin <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Qzzr Shortcode Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'qzzr' shortcode in all versions up to, and including, 1.0.1. This is due to insufficient input sanitization and output escaping on the 'quiz' attribute. This makes it possible for authenticated attackers...

CVE-2025-12261 CodeAstro Gym Management System remove-announcement.php sql injection

A vulnerability was found in CodeAstro Gym Management System 1.0. This affects an unknown function of the file /admin/actions/remove-announcement.php. Performing a manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been made public and...

SourceCodester Point of Sales SQL注入漏洞

SourceCodester Point of Sales is an open source point of sale system from SourceCodester. A SQL injection vulnerability exists in SourceCodester Point of Sales version 1.0, which stems from incorrect manipulation of the parameter ID in the file /deletecategory.php, which could lead to a SQL...

PT-2025-43886

Name of the Vulnerable Software and Affected Versions projectworlds Expense Management System version 1.0 Description A security issue exists in the Expense Categories Page component of projectworlds Expense Management System. The issue involves an unknown function within the /public/admin/expens...

projectworlds Expense Management System 代码注入漏洞

Projectworlds Expense Management System is an open source expense management system from Projectworlds. A code injection vulnerability exists in version 1.0 of the projectworlds Expense Management System, which stems from an incorrect manipulation of an unknown function in the file...

CVE-2025-57240

Cross site scripting XSS vulnerability in 17gz International Student service system 1.0 allows attackers to execute arbitrary code via the registration step...

CVE-2025-11128 Feedzy RSS Feeds Lite <= 5.1.0 - Authenticated (Subscriber+) Server-Side Request Forgery

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.1.0 via the 'feedzysanitizefeeds' function. This makes it possible for authenticated attackers...

CVE-2025-11878

The ST Categories Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's st-categories shortcode in versions less than, or equal to, 1.0.0. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

Oracle WebLogic Server (October 2025 CPU)

The 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 versions of WebLogic Server installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2025 CPU advisory. - Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware component: Centralized...

CVE-2025-62007 WordPress Voice Feedback plugin <= 1.0.3 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in bPlugins Voice Feedback voice-feedback allows Privilege Escalation.This issue affects Voice Feedback: from n/a through = 1.0.3...

CVE-2025-60246 WordPress Simple Finance Calculator plugin <= 1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in weissmike Simple Finance Calculator simple-finance-calculator allows Reflected XSS.This issue affects Simple Finance Calculator: from n/a through = 1.0...

CVE-2025-60246

CVE-2025-60246 applies to the WordPress plugin Simple Finance Calculator (author: weissmike) in versions &lt;= 1.0. It is described as an improper input neutralization leading to a Reflected Cross-Site Scripting (XSS) vulnerability during web page generation. Affected scope is limited to the plug...

CVE-2025-52751

CVE-2025-52751 affects the WordPress Slide Puzzle plugin (versions ≤ 1.0.0). The issue is a Reflected XSS caused by improper input neutralization during web page generation in the slide-puzzle component. Exploitation could allow an attacker to inject and execute scripts in a victim’s browser when...

CVE-2025-11810 Print Button Shortcode <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

The Print Button Shortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'print-button' shortcode in all versions up to, and including, 1.0.1. This is due to insufficient input sanitization and output escaping on the 'target' attribute. This makes it possible for...

CVE-2025-62773

Mercku M6a devices through 2.1.0 allow TELNET sessions via a router.telnet.enabled.update request by an administrator...

EUVD-2025-35253

Vulnerability in the Identity Manager product of Oracle Fusion Middleware component: REST WebServices. Supported versions that are affected are 12.2.1.4.0 and 14.1.2.1.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Identity Manager...