PT-2025-35925

Name of the Vulnerable Software and Affected Versions: appRain CMF version 4.0.5 Description: A stored authenticated cross-site scripting XSS issue exists due to insufficient validation of user-supplied input. The vulnerability is present in the /apprain/developer/addons/update/cycle endpoint,...

PT-2025-34817 · Unknown · Campcodes Online Water Billing System

Name of the Vulnerable Software and Affected Versions: Campcodes Online Water Billing System version 1.0 Description: A vulnerability exists in Campcodes Online Water Billing System that allows for SQL injection. The issue affects an unknown function within the /addclient1.php file. Manipulation ...

PT-2025-33070 · Itsourcecode · Sports Club Management System

Name of the Vulnerable Software and Affected Versions: itsourcecode Sports Management System version 1.0 Description: A SQL injection issue exists in itsourcecode Sports Management System 1.0. The vulnerability is located in the /Admin/match.php file, specifically through the manipulation of the...

PT-2025-32385 · Ehcp · Ehcp

Name of the Vulnerable Software and Affected Versions: EHCP version 20.04.1.b Description: A reflected cross-site scripting XSS vulnerability exists in the List All FTP User Function. Authenticated attackers can execute arbitrary JavaScript by injecting a crafted payload into the ftpusername...

EUVD-2025-23917

A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit through 6.4 SP4, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit could allow an...

PT-2025-31767 · Unknown · Projectworlds Online Admission System

Name of the Vulnerable Software and Affected Versions: projectworlds Online Admission System version 1.0 Description: A critical vulnerability exists in projectworlds Online Admission System version 1.0 due to a SQL injection issue. The vulnerability is located in an unknown functionality of the...

PT-2025-31607 · Unknown · Projectworlds Online Admission System

Name of the Vulnerable Software and Affected Versions: projectworlds Online Admission System version 1.0 Description: A vulnerability exists in projectworlds Online Admission System version 1.0 related to SQL injection. The issue is located in an unknown functionality of the file /viewdoc.php...

VulnCheck KEV: CVE-2025-47188

A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 R6.4.0.4006, and the 6970 Conference Unit through 6.4 SP4 R6.4.0.4006 or version V1 R0.1.0, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient paramete...

PT-2025-29968 · Unknown · Online Appointment Booking System

Name of the Vulnerable Software and Affected Versions: Online Appointment Booking System version 1.0 Description: A critical issue exists in the Online Appointment Booking System. The vulnerability is due to SQL injection in the /admin/adddoctor.php file. The Username parameter is susceptible to...

PT-2025-29581 · Opensips · Opensis

Name of the Vulnerable Software and Affected Versions: openSIS version 9.1 Description: A SQL Injection issue exists in openSIS version 9.1. A remote attacker can execute arbitrary code by manipulating the id parameter in the Ajax.php file. Recommendations: Apply input validation and sanitization...

CVE-2025-52577

A vulnerability exists in Advantech iView that could allow SQL injection and remote code execution through NetworkServlet.archiveTrapRange. This issue requires an authenticated attacker with at least user-level privileges. Certain input parameters are not properly sanitized, allowing an attacker ...

PT-2025-29386 · Code Projects · Online Appointment Booking System

Name of the Vulnerable Software and Affected Versions: code-projects Online Appointment Booking System version 1.0 Description: A critical issue exists in code-projects Online Appointment Booking System. The vulnerability is located in the /get town.php file and involves SQL injection through...

CVE-2025-46704

A vulnerability exists in Advantech iView in NetworkServlet.processImportRequest that could allow for a directory traversal attack. This issue requires an authenticated attacker with at least user-level privileges. A specific parameter is not properly sanitized or normalized, potentially allowing...

PT-2025-26531 · Unknown · Code-Projects Client Details System

Name of the Vulnerable Software and Affected Versions: code-projects Client Details System version 1.0 Description: A critical vulnerability exists in code-projects Client Details System 1.0, affecting the processing of the file /clientdetails/admin/index.php. Manipulation of the Username argumen...

CVE-2025-4840

The inprosysmedia-likes-dislikes-post WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2025-4840 Likes and Dislikes Plugin <= 1.0.0 - Unauthenticated SQL Injection

The inprosysmedia-likes-dislikes-post WordPress plugin through 1.0.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2025-4840

The CVE concerns the WordPress plugin inprosysmedia-likes-dislikes-post (versions up to 1.0.0). The root cause is failure to properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action that unauthenticated users can access. This leads to an unauthenticated SQL i...

CVE-2025-4652

The Broadstreet WordPress plugin before 1.51.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2025-4652

CVE-2025-4652 concerns the Broadstreet WordPress plugin (prior to 1.51.8). The issue is a reflected XSS caused by not sanitising/escaping a parameter before outputting it on the page, which could be exploited against high privilege users (e.g., admins). The evidence consistently notes the vulnera...

CVE-2023-2921 Short URL <= 1.6.8 - Subscriber+ SQLi

The Short URL WordPress plugin through 1.6.8 does not properly sanitise and escape a parameter before using it in SQL statement, leading to a SQL injection exploitable by users with relatively low privilege on the site, like subscribers...