CVE-2025-8972 itsourcecode Online Tour and Travel Management System page-login.php sql injection

A vulnerability was identified in itsourcecode Online Tour and Travel Management System 1.0. This issue affects some unknown processing of the file /admin/page-login.php. The manipulation of the argument email leads to sql injection. The attack may be initiated remotely. The exploit has been...

CVE-2025-8948 projectworlds Visitor Management System front.php sql injection

A vulnerability was determined in projectworlds Visitor Management System 1.0. Affected is an unknown function of the file /front.php. The manipulation of the argument rid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be...

CVE-2012-10040

Openfiler v2.x contains a command injection vulnerability in the system.html page. The device parameter is used to instantiate a NetworkCard object, whose constructor in network.inc calls exec with unsanitized input. An authenticated attacker can exploit this to execute arbitrary commands as the...

CVE-2025-29866

: External Control of File Name or Path vulnerability in TAGFREE X-Free Uploader XFU allows : Parameter Injection.This issue affects X-Free Uploader: from 1.0.1.0084 before 1.0.1.0085, from 2.0.1.0034 before 2.0.1.0035...

CVE-2025-29866

: External Control of File Name or Path vulnerability in TAGFREE X-Free Uploader XFU allows : Parameter Injection.This issue affects X-Free Uploader: from 1.0.1.0084 before 1.0.1.0085, from 2.0.1.0034 before 2.0.1.0035...

CVE-2025-29866

: External Control of File Name or Path vulnerability in TAGFREE X-Free Uploader XFU allows : Parameter Injection.This issue affects X-Free Uploader: from 1.0.1.0084 before 1.0.1.0085, from 2.0.1.0034 before 2.0.1.0035...

CVE-2025-29866

CVE-2025-29866 affects TAGFREE X-Free Uploader XFU with an External Control of File Name or Path vulnerability (Parameter Injection). From the available details, the affected versions are 1.0.1.0084 before 1.0.1.0085 and 2.0.1.0034 before 2.0.1.0035. The CVSS vector indicates high impact with net...

CVE-2025-29866

: External Control of File Name or Path vulnerability in TAGFREE X-Free Uploader XFU allows : Parameter Injection.This issue affects X-Free Uploader: from 1.0.1.0084 before 1.0.1.0085, from 2.0.1.0034 before 2.0.1.0035...

TAGFREE X‑Free Uploader 安全漏洞

TAGFREE X-Free Uploader is a file upload/download component for HTML5 from TAGFREE Korea. A security vulnerability exists in TAGFREE X-Free Uploader versions prior to 1.0.1.0084 to 1.0.1.0085 and 2.0.1.0034 to 2.0.1.0035, which stems from vulnerability to parameter injection attacks...

PT-2025-32257 · Tagfree · Tagfree X-Free Uploader Xfu

Name of the Vulnerable Software and Affected Versions: TAGFREE X-Free Uploader XFU versions 1.0.1.0084 through 1.0.1.0084 TAGFREE X-Free Uploader XFU versions 2.0.1.0034 through 2.0.1.0034 Description: An External Control of File Name or Path vulnerability exists in TAGFREE X-Free Uploader XFU,...

CLSA-2025-1753729385 git: Fix of CVE-2025-48385

CVE-2025-48385: bundle-uri: fix arbitrary file writes via parameter injection...

Advantech iView NetworkServlet.backupDatabase Function Parameter Injection Vulnerability

Advantech iView is a Simple Network Protocol SNMP based software from Advantech, China to manage B + B SmartWorx devices. The Advantech iView NetworkServlet.backupDatabase function parameter injection vulnerability can be exploited by an attacker to cause information disclosure, including sensiti...

CLSA-2025-1752576917 git: Fix of CVE-2025-48385

CVE-2025-48385: bundle-uri: fix arbitrary file writes via parameter injection...

Advantech iView Parameter Injection Vulnerability

Advantech iView is a Simple Network Protocol SNMP based software from Advantech, China to manage B + B SmartWorx devices. A parameter injection vulnerability exists in Advantech iView, which originates from parameter injection in the NetworkServlet.restoreDatabase function and can be exploited by...

Advantech iView 参数注入漏洞

Advantech iView is a Simple Network Protocol SNMP based software from Advantech, China to manage B + B SmartWorx devices. The Advantech iView NetworkServlet.backupDatabase function parameter injection vulnerability can be exploited by an attacker to cause information disclosure, including sensiti...

CVE-2025-27889

Wing FTP Server before 7.4.4 does not properly validate and sanitize the url parameter of the downloadpass.html endpoint, allowing injection of an arbitrary link. If a user clicks a crafted link, this discloses a cleartext password to the attacker...

Headlamp 参数注入漏洞

Headlamp is an open source UI program for Kubernetes SIGs. A parameter injection vulnerability exists in versions of Headlamp prior to 0.31.1, which stems from command injection in the codeSign.js script and could lead to the execution of arbitrary commands...

Advantech iView 参数注入漏洞

Advantech iView is a Simple Network Protocol SNMP based software from Advantech, China to manage B + B SmartWorx devices. A parameter injection vulnerability exists in Advantech iView, which originates from parameter injection in the NetworkServlet.restoreDatabase function and can be exploited by...

CVE-2025-53652

Jenkins Git Parameter Plugin 439.vb0e46ca14534 and earlier does not validate that the Git parameter value submitted to the build matches one of the offered choices, allowing attackers with Item/Build permission to inject arbitrary values into Git parameters...

Jenkins plugin Git Parameter 安全漏洞

Jenkins and Jenkins plugin are both Jenkins open source products.Jenkins is an application software. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins plugin is an application software plugin. A security...