CVE-2009-2455

Multiple cross-site scripting XSS vulnerabilities in webadmin/admin.php in @mail 5.6.1 allow remote attackers to inject arbitrary web script or HTML via the 1 type and 2 func parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party...

CVE-2007-5160

Multiple PHP remote file inclusion vulnerabilities in Thierry Leriche Restaurant Management System ReMaSys 0.5 allow remote attackers to execute arbitrary PHP code via a URL in 1 the DIRROOT parameter to a global.php, or the 2 DIRPAGE parameter to b template/fr/page.php or c...

PT-2025-21913 · Unknown · Phpgurukul Auto Taxi Stand Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Auto Taxi Stand Management System version 1.0 Description: A critical issue affects the processing of the file /admin/admin-profile.php, where the manipulation of the mobilenumber argument leads to SQL injection. The attack can be...

CVE-2023-51328

PHPJabbers Cleaning Business Software v1.0 is vulnerable to Multiple Stored Cross-Site Scripting XSS in the "cname, name" parameters...

PT-2025-19967 · Linksys · Linksys E5600

Name of the Vulnerable Software and Affected Versions: Linksys E5600 version 1.1.0.26 Description: A command injection issue was discovered in the runtime.ddnsStatus DynDNS function, specifically via the username parameter. This allows for potential exploitation. Recommendations: For Linksys E560...

CVE-2025-4204

CVE-2025-4204: Ultimate Auction Pro for WordPress (

CVE-2025-40615

Reflected Cross-Site Scripting XSS vulnerability in Bookgy. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending a malicious URL through the "TEXTO" parameter in /api/apiajustes.php...

PT-2025-17256 · WordPress · The Coupon Affiliates – Affiliate Plugin For Woocommerce

Name of the Vulnerable Software and Affected Versions: The Coupon Affiliates – Affiliate Plugin for WooCommerce plugin for WordPress versions up to, and including, 6.3.0 Description: The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping...

PT-2025-17012 · Wpcafe · Wpcafe

Name of the Vulnerable Software and Affected Versions: WPCafe versions 2.2.32 and earlier Description: The issue is related to an Improper Control of Filename for Include/Require Statement in PHP Program, also known as 'PHP Remote File Inclusion', which allows PHP Local File Inclusion. This is a...

CVE-2024-40068

Sourcecodester Online ID Generator System 1.0 contains a SQL injection in the id parameter of id_generator/admin/?page=templates/manage_template&id=1. Root cause: improper handling of user input leading to SQL injection. Impact per available metrics is Confidentiality/Integrity/Availability Low w...

CVE-2025-3575 Insecure Direct Object Reference en Deporsite de T-INNOVA

Insecure Direct Object Reference vulnerability in Deporsite from T-INNOVA allows an attacker to retrieve sensitive information from others users via "idUsuario" parameter in "/helper/Familia/establecerUsuarioSeleccion" endpoint...

CVE-2025-26312

SendQuick Entera devices before 11HF5 are vulnerable to CAPTCHA bypass by removing the Captcha parameter...

CVE-2025-1872

SQL injection vulnerability have been found in 101news affecting version 1.0 through the "sadminusername" parameter in admin/add-subadmins.php...

D-Link DSL-3782 public_type parameter OS Command Injection Vulnerability

The D-Link DSL-3782 is a wireless router from AUO. The D-Link DSL-3782 suffers from an OS command injection vulnerability that stems from the handling of the publictype parameter, which can be exploited by an attacker to submit a special request and execute arbitrary commands...

CVE-2025-25744

D-Link DIR-853 A1 FW1.20B07 was discovered to contain a stack-based buffer overflow vulnerability via the Password parameter in the SetDynamicDNSSettings module...

CVE-2024-54909

A vulnerability has been identified in GoldPanKit eva-server v4.1.0. It affects the path parameter of the /api/resource/local/download endpoint, where manipulation of this parameter can lead to arbitrary file download...

CVE-2024-5182

A path traversal vulnerability exists in mudler/localai version 2.14.0, where an attacker can exploit the model parameter during the model deletion process to delete arbitrary files. Specifically, by crafting a request with a manipulated model parameter, an attacker can traverse the directory...

CVE-2024-48761

Reflected XSS vulnerability in Celk Sistemas Celk Saude v.3.1.252.1 allows a remote attacker to inject arbitrary JavaScript code via the "erro" parameter...

CVE-2025-22913

RE11S v1.11 was discovered to contain a stack overflow via the rootAPmac parameter in the formStaDrvSetup function...

CVE-2024-12067

The WP Travel – Ultimate Travel Booking System, Tour Management Engine plugin for WordPress is vulnerable to SQL Injection via the 'bookingitinerary' parameter of the 'wptravelgetbookingdata' function in all versions up to, and including, 10.0.0 due to insufficient escaping on the user supplied...