CVE-2023-46974

CVE-2023-46974 POC الوصف ثغرة برمجة نصية عبر المواقع في Best Courier Management System النسخة v.1.000 تتيح لمهاجم عن بُعد تنفيذ كود تعسفي عبر حمولة مصممة خصيصًا في معامل الصفحة في عنوان URL. نوع الثغرة برمجة نصية عبر المواقع XSS بائع المنتج...

CVE-2023-31705

CVE-2023-31705 الوصف ثغرة برمجية من نوع Cross-site scripting XSS المنعكسة في نظام تذكير المهام Task Reminder System 1.0 من Sourcecodester تسمح لمستخدم مصادق عليه بحقن جافا سكريبت خبيث في معامل الصفحة page parameter. نوع الثغرة Cross Site Scripting XSS بائع المنتج Sourcecodster قاعدة كود المنتج...

CVE-2023-49544

CVE-2023-49544 Customer Support System 1.0 - تضمين الملفات المحلية الوصف : Customer Support System 1.0 عرضة لثغرة تضمين الملفات المحلية Local File Inclusion. يمكن للمستخدم المُصادَق عليه الوصول إلى ملفات PHP وقراءتها من نظام التشغيل عبر استغلال ثغرة تضمين الملفات المحلية LFI من خلال مرشح الغلاف...

CVE-2021-39408

CVE-2021-39408 Уязвимость отраженного межсайтового скриптинга XSS существует в нескольких версиях 1.0 приложения Online Student Rate System, что позволяет произвольно выполнять команды JavaScript. Уязвимая страница На index.php параметр page уязвим, что позволяет злоумышленнику вставлять любой...

CVE-2024-46878-TikiCMS-XSS

CVE-2024-46878 - Vulnérabilité de Cross-Site Scripting XSS Réfléchie dans Tiki CMS Vulnérabilité de Cross-Site Scripting XSS Réfléchie dans le paramètre 'page' de Tiki CMS Avertissement Destiné uniquement à des fins éducatives, de recherche et défensives. Toute utilisation non autorisée contre de...

CVE-2024-39210

ID CVE CVE-2024-39210 PRODUIT Best house rental management system VERSION =1.0 TYPE DE PROBLÈME Contrôle d'accès incorrect Description Il a été découvert que Best House Rental Management System v1.0 contient une vulnérabilité de lecture arbitraire de fichiers via le paramètre Page dans index.php...

CVE-2026-19056

The ProSolution WP Client WordPress plugin (versions before 2.0.11) fails to sanitise and escape the page parameter before reflecting it into an HTML attribute on an admin page, enabling reflected XSS in an administrator's session via a crafted request. CVSS 7.1 (HIGH). Remediation: update to ver...

CVE-2026-19056 ProSolution WP Client < 2.0.11 - Reflected XSS via 'page' Parameter

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted...

EUVD-2026-54509

A flaw has been found in SourceCodester Photo Share Website 1.0. The affected element is an unknown function of the file /social/index.php?page=home. This manipulation of the argument Comment causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may...

CVE-2026-16229

A flaw has been found in itsourcecode Courier Management System up to 1.0. Affected by this vulnerability is an unknown functionality of the file /index.php. Executing a manipulation of the argument page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit h...

EUVD-2026-43296

A vulnerability was detected in SourceCodester Online Book Store System 1.0. The affected element is an unknown function of the file /admin/index.php of the component Administrative Interface. Performing a manipulation of the argument page results in improper control of filename for include/requi...

CVE-2026-15540

CVE-2026-15540 affects SourceCodester Online Book Store System 1.0. The Administrative Interface file /admin/index.php contains a vulnerability where manipulating the page parameter leads to improper control of the filename used in include/require statements in PHP, i.e., a local file inclusion. ...

CVE-2026-15540

A vulnerability was detected in SourceCodester Online Book Store System 1.0. The affected element is an unknown function of the file /admin/index.php of the component Administrative Interface. Performing a manipulation of the argument page results in improper control of filename for include/requi...

CVE-2026-15297 Newsletter, SMTP, Email marketing and Subscribe forms by Brevo (formely Sendinblue) <= 3.1.77 - Reflected Cross-Site Scripting

The Newsletter, SMTP, Email marketing and Subscribe forms by Brevo formely Sendinblue plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the page parameter in all versions up to, and including, 3.1.77 due to insufficient input sanitization and output escaping. This makes it...

EUVD-2026-42804

The Newsletter, SMTP, Email marketing and Subscribe forms by Brevo formely Sendinblue plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the page parameter in all versions up to, and including, 3.1.77 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-15297

Brevo (formerly Sendinblue) Newsletter, SMTP, Email marketing and Subscribe forms for WordPress is vulnerable to Reflected Cross-Site Scripting via the page parameter in all versions up to and including 3.1.77. The vulnerability arises from insufficient input sanitization and output escaping, all...

CVE-2026-15297

The Newsletter, SMTP, Email marketing and Subscribe forms by Brevo formely Sendinblue plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the page parameter in all versions up to, and including, 3.1.77 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-36803

Shenzhen Tenda Technology Co., Ltd Tenda PW201A v1.0.5 was discovered to contain a buffer overflow in the page parameter of the qossetting function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted HTTP request...

CVE-2026-11557

A weakness has been identified in Tenda F451 1.0.0.7/1.0.0.9. The affected element is the function fromNatlimit of the file /goform/Natlimit of the component Web Management Interface. Executing a manipulation of the argument page can lead to stack-based buffer overflow. The attack can be executed...

PT-2026-48194

Shenzhen Tenda Technology Co., Ltd Tenda PW201A v1.0.5 was discovered to contain a buffer overflow in the page parameter of the SafeMacFilter function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted HTTP request...