CVE-2026-22913

Improper handling of a URL parameter may allow attackers to execute code in a user's browser after login. This can lead to the extraction of sensitive data...

SICK TDC-X401GL has security vulnerabilities

The SICK TDC-X401GL is a edge computing gateway developed by the German company SICK. The SICK TDC-X401GL has a security vulnerability, which stems from improper handling of URL parameters. This vulnerability could allow attackers to execute code in the browser after users log in...

WordPress plugin List Site Contributors 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, with the ability to host personal blog sites on PHP and MySQL based servers.WordPress...

WordPress plugin News and Blog Designer Bundle 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...

phpgurukul News Portal Project 安全漏洞

PHPGurukul News Portal Project is a news portal project by PHPGurukul Inc. A security vulnerability exists in version V4.1 of phpgurukul News Portal Project, which stems from improper manipulation of the parameter file in the removefile.php file, which could lead to the removal of arbitrary files...

CVE-2025-14719 Relevanssi (Free < 4.26.0, Premium < 2.29.0) - Contributor+ SQLi

The Relevanssi WordPress plugin before 4.26.0, Relevanssi Premium WordPress plugin before 2.29.0 do not sanitize and escape a parameter before using it in a SQL statement, allowing contributor and above roles to perform SQL injection attacks...

daptin SQL注入漏洞

daptin is a content management system from Daptin open source. A SQL injection vulnerability exists in daptin version 0.10.3, which stems from incorrect manipulation of the parameters column/group/order within the file server/resource/resourceaggregate.go in the component Aggregate API, which can...

EyouCMS 跨站脚本漏洞

EyouCMS is an open source content management system CMS based on ThinkPHP by China Eyou Eyou Company. A cross-site scripting vulnerability exists in EyouCMS 1.7.7 and earlier versions, which stems from incorrect manipulation of the parameter content in the file application/home/model/Ask.php, whi...

product-review 代码注入漏洞

product-review is a product review system by sunhailin12315 individual developer. A code injection vulnerability exists in product-review, which stems from the incorrect manipulation of the parameter content in the component Write a Review, which could lead to a cross-site scripting attack...

Tenda WH450 安全漏洞

Tenda WH450 is a wireless access point from Tenda China. A security vulnerability exists in Tenda WH450 version 1.0.0.18, which originates from an incorrect manipulation of the parameter page of the file /goform/VirtualSer in the component HTTP Request Handler, which could result in a stack buffe...

yudao-cloud 代码问题漏洞

yudao-cloud is a backend management system for YunaiV individual developers. A code issue vulnerability exists in yudao-cloud version 2025.11 and earlier, which stems from the incorrect manipulation of the url/header/body parameters by the BpmHttpCallbackTrigger/BpmSyncHttpRequestTrigger function...

loganSite SQL注入漏洞

loganSite is a personal blog project by loganhong individual developer. loganSite has a SQL injection vulnerability that originates from the incorrect manipulation of the parameter ID in the file /includes/articledetail.php in the component Article Handler, which could lead to a SQL injection...

EUVD-2025-203916

Reflected cross-site scripting XSS in SLiMS slims9bulian before 9.6.0 via improper handling of $SERVER'PHPSELF' in index.php/sysconfig.inc.php, which allows remote attackers to execute arbitrary JavaScript in a victim's browser by supplying a crafted URL path...

SGWBox N3 命令注入漏洞

SGWBox N3 is a network storage device from China's Pickup Dock SGWBox. A command injection vulnerability exists in SGWBox N3 version 2.0.25, which stems from incorrect manipulation of the parameter params in the component SHARESERVER Feature, which could lead to command injection...

Code-Projects Prison Management System SQL注入漏洞

Prison Management System is a prison management system. Prison Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter keyname in the file /admin/search.php. An attacker can exploit this...

IceWarp gmaps Cross-Site Scripting Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of IceWarp. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of a parameter...

EUVD-2025-201882

The Custom Admin Menu WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

Ilevia EVE X1 Server 命令注入漏洞

Ilevia EVE X1 Server is a smart home and building automation from Ilevia, Italy. A command injection vulnerability exists in Ilevia EVE X1 Server version 4.6.5.0.eden and prior versions, which stems from incorrect manipulation of the parameter line in the file /ajax/php/leafsearch.php, which coul...

CVE-2025-13793

A weakness has been identified in winston-dsouza Ecommerce-Website up to 87734c043269baac0b4cfe9664784462138b1b2e. Affected by this issue is some unknown functionality of the file /includes/headermenu.php of the component GET Parameter Handler. Executing manipulation of the argument Error can lea...

wtcms 代码注入漏洞

wtcms is a ThinkPHP-based content management system CMS by Taosir Individual Developer. A code injection vulnerability exists in wtcms, which stems from incorrect manipulation of the parameter content in the file /index.php, which could lead to code injection...