CVE-2023-51328

PHPJabbers Cleaning Business Software v1.0 is vulnerable to Multiple Stored Cross-Site Scripting XSS in the "cname, name" parameters...

PT-2025-19967 · Linksys · Linksys E5600

Name of the Vulnerable Software and Affected Versions: Linksys E5600 version 1.1.0.26 Description: A command injection issue was discovered in the runtime.ddnsStatus DynDNS function, specifically via the username parameter. This allows for potential exploitation. Recommendations: For Linksys E560...

CVE-2025-4204

CVE-2025-4204: Ultimate Auction Pro for WordPress (

CVE-2025-40615

Reflected Cross-Site Scripting XSS vulnerability in Bookgy. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the "TEXTO" parameter in /api/apiajustes.php...

PT-2025-17256 · WordPress · The Coupon Affiliates – Affiliate Plugin For Woocommerce

Name of the Vulnerable Software and Affected Versions: The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress versions up to, and including, 6.3.0 Description: The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping...

PT-2025-17012 · Wpcafe · Wpcafe

Name of the Vulnerable Software and Affected Versions: WPCafe versions 2.2.32 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion. This is a...

CVE-2024-40068

Sourcecodester Online ID Generator System 1.0 contains a SQL injection in the id parameter of id_generator/admin/?page=templates/manage_template&id=1. Root cause: improper handling of user input leading to SQL injection. Impact per available metrics is Confidentiality/Integrity/Availability Low w...

CVE-2025-3575 Insecure Direct Object Reference en Deporsite de T-INNOVA

Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive information from others users via "idUsuario" parameter in "/helper/Familia/establecerUsuarioSeleccion" endpoint...

CVE-2025-26312

SendQuick Entera devices before 11HF5 are vulnerable to CAPTCHA bypass by removing the Captcha parameter...

CVE-2025-1872

SQL injection vulnerability have been found in 101news affecting version 1.0 through the "sadminusername" parameter in admin/add-subadmins.php...

D-Link DSL-3782 public_type parameter OS Command Injection Vulnerability

The D-Link DSL-3782 is a wireless router from AUO. The D-Link DSL-3782 suffers from an OS command injection vulnerability that stems from the handling of the publictype parameter, which can be exploited by an attacker to submit a special request and execute arbitrary commands...

CVE-2025-25744

D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetDynamicDNSSettings module...

CVE-2024-54909

A vulnerability has been identified in GoldPanKit eva-server v4.1.0. It affects the path parameter of the /api/resource/local/download endpoint, where manipulation of this parameter can lead to arbitrary file download...

CVE-2024-5182

A path traversal vulnerability exists in mudler/localai version 2.14.0, where an attacker can exploit the model parameter during the model deletion process to delete arbitrary files. Specifically, by crafting a request with a manipulated model parameter, an attacker can traverse the directory...

CVE-2024-48761

Reflected XSS vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to inject arbitrary JavaScript code via the "erro" parameter...

CVE-2025-22913

RE11S v1.11 was discovered to contain a stack overflow via the rootAPmac parameter in the formStaDrvSetup function...

CVE-2024-12067

The WP Travel – Ultimate Travel Booking System, Tour Management Engine plugin for WordPress is vulnerable to SQL Injection via the 'bookingitinerary' parameter of the 'wptravelgetbookingdata' function in all versions up to, and including, 10.0.0 due to insufficient escaping on the user supplied...

CVE-2024-11635

CVE-2024-11635 affects WordPress File Upload plugin for WordPress up to version 4.24.12, enabling unauthenticated remote code execution via the wfu_ABSPATH cookie parameter. Public exploit exists (GitHub). Red Hat and Wordfence entries confirm the issue and note it has been patched; upgrade to 4....

CVE-2024-11722 Frontend Admin by DynamiApps <= 3.25.1 - Unauthenticated SQL Injection

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 3.25.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it...

Keygen Protocol Exploitation

The Binance tss-lib is vulnerable to keygen protocol exploitation. The vulnerability is due to inadequate validation of the h1 and h2 parameters within the keygen protocol implementation, allows attackers to craft malicious parameters that can exploit the signing round process...