CVE-2023-49544

CVE-2023-49544 Customer Support System 1.0 - تضمين الملفات المحلية الوصف : Customer Support System 1.0 عرضة لثغرة تضمين الملفات المحلية Local File Inclusion. يمكن للمستخدم المُصادَق عليه الوصول إلى ملفات PHP وقراءتها من نظام التشغيل عبر استغلال ثغرة تضمين الملفات المحلية LFI من خلال مرشح الغلاف...

CVE-2023-31705

CVE-2023-31705 الوصف ثغرة برمجية من نوع Cross-site scripting XSS المنعكسة في نظام تذكير المهام Task Reminder System 1.0 من Sourcecodester تسمح لمستخدم مصادق عليه بحقن جافا سكريبت خبيث في معامل الصفحة page parameter. نوع الثغرة Cross Site Scripting XSS بائع المنتج Sourcecodster قاعدة كود المنتج...

CVE-2021-39408

CVE-2021-39408 توجد ثغرة Cross Site Scripting XSS انعكاسية في إصدارات متعددة من الإصدار 1.0 من تطبيق Online Student Rate System، والتي تسمح بتنفيذ أوامر JavaScript بشكل تعسفي. الصفحة المعرضة للثغرة على index.php، تكون المعامل page معرضًا للثغرة، مما يسمح للمهاجم بتضمين أي كود JavaScript داخل وسوم...

CVE-2024-46878-TikiCMS-XSS

CVE-2024-46878 - Vulnérabilité de Cross-Site Scripting XSS Réfléchie dans Tiki CMS Vulnérabilité de Cross-Site Scripting XSS Réfléchie dans le paramètre 'page' de Tiki CMS Avertissement Destiné uniquement à des fins éducatives, de recherche et défensives. Toute utilisation non autorisée contre de...

CVE-2024-39210

معرف CVE CVE-2024-39210 المنتج Best house rental management system الإصدار =1.0 نوع المشكلة التحكم غير الصحيح في الوصول الوصف تم اكتشاف أن نظام Best House Rental Management System الإصدار v1.0 يحتوي على ثغرة قراءة ملفات عشوائية عبر معامل Page في index.php. تسمح هذه الثغرة للمهاجمين بقراءة ملفات P...

CVE-2023-46974

CVE-2023-46974 POC Description Vulnérabilité de Cross Site Scripting dans Best Courier Management System v.1.000 permet à un attaquant distant d'exécuter du code arbitraire via un payload conçu dans le paramètre page de l'URL. Type de vulnérabilité Cross Site Scripting XSS Vendeur du produit...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: struts (UTSA-2026-031330)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-031330 advisory. The MultiPageValidator implementation in Apache Struts 1 1.1 through 1.3.10 allows remote attackers to bypass intended access restrictions via a modified page...

CVE-2026-19056

The ProSolution WP Client WordPress plugin (versions before 2.0.11) fails to sanitise and escape the page parameter before reflecting it into an HTML attribute on an admin page, enabling reflected XSS in an administrator's session via a crafted request. CVSS 7.1 (HIGH). Remediation: update to ver...

CVE-2026-19056 ProSolution WP Client < 2.0.11 - Reflected XSS via 'page' Parameter

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted...

EUVD-2026-54509

A flaw has been found in SourceCodester Photo Share Website 1.0. The affected element is an unknown function of the file /social/index.php?page=home. This manipulation of the argument Comment causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may...

CVE-2026-16229

A flaw has been found in itsourcecode Courier Management System up to 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php. Executing a manipulation of the argument page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit h...

EUVD-2026-43296

A vulnerability was detected in SourceCodester Online Book Store System 1.0. The affected element is an unknown function of the file /admin/index.php of the component Administrative Interface. Performing a manipulation of the argument page results in improper control of filename for include/requi...

CVE-2026-15540

CVE-2026-15540 affects SourceCodester Online Book Store System 1.0. The Administrative Interface file /admin/index.php contains a vulnerability where manipulating the page parameter leads to improper control of the filename used in include/require statements in PHP, i.e., a local file inclusion. ...

CVE-2026-15540

A vulnerability was detected in SourceCodester Online Book Store System 1.0. The affected element is an unknown function of the file /admin/index.php of the component Administrative Interface. Performing a manipulation of the argument page results in improper control of filename for include/requi...

EUVD-2026-42804

The Newsletter, SMTP, Email marketing and Subscribe forms by Brevo formely Sendinblue plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the page parameter in all versions up to, and including, 3.1.77 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-15297 Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) <= 3.1.77 - Reflected Cross-Site Scripting

The Newsletter, SMTP, Email marketing and Subscribe forms by Brevo formely Sendinblue plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the page parameter in all versions up to, and including, 3.1.77 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-15297

The Newsletter, SMTP, Email marketing and Subscribe forms by Brevo formely Sendinblue plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the page parameter in all versions up to, and including, 3.1.77 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-15297

Brevo (formerly Sendinblue) Newsletter, SMTP, Email marketing and Subscribe forms for WordPress is vulnerable to Reflected Cross-Site Scripting via the page parameter in all versions up to and including 3.1.77. The vulnerability arises from insufficient input sanitization and output escaping, all...

CVE-2026-36803

Shenzhen Tenda Technology Co., Ltd Tenda PW201A v1.0.5 was discovered to contain a buffer overflow in the page parameter of the qossetting function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted HTTP request...

CVE-2026-11557

A weakness has been identified in Tenda F451 1.0.0.7/1.0.0.9. The affected element is the function fromNatlimit of the file /goform/Natlimit of the component Web Management Interface. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack can be executed...