CVE-2023-51295

PHPJabbers Event Booking Calendar v4.0 is vulnerable to Multiple HTML Injection in the "name, pluginsmsapikey, pluginsmscountrycode, title, pluginsmsapikey, title" parameters...

CVE-2025-4191

A vulnerability has been found in PHPGurukul Employee Record Management System 1.3 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /editmyeducation.php. The manipulation of the argument coursepg/yophsc leads to sql injection. The attack can be...

CVE-2025-4023

A vulnerability was found in itsourcecode Placement Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /addcompany.php. The manipulation of the argument Name leads to sql injection. The attack may be initiated remotely. The exploit has bee...

CVE-2025-3489

A vulnerability was found in Nababur Simple-User-Management-System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /register.php. The manipulation of the argument name/username leads to cross site scripting. The attack may be launched...

CVE-2025-1871

The CVE-2025-1871 entry concerns a SQL injection vulnerability in 101news v1.0, exploitable via the category and subcategory parameters in admin/add-subcategory.php. The affected component is the admin module handling subcategory creation; the root cause is unsafely interpolated input in SQL quer...

CVE-2023-51317

PHPJabbers Restaurant Booking System v3.0 is vulnerable to Multiple HTML Injection in the "name, pluginsmsapikey, pluginsmscountrycode, title, pluginsmsapikey, title" parameters...

CVE-2023-51300

PHPJabbers Hotel Booking System v4.0 is vulnerable to Cross-Site Scripting XSS vulnerabilities in the "name, pluginsmsapikey, pluginsmscountrycode, title, pluginsmsapikey" parameters...

CVE-2023-51300

PHPJabbers Hotel Booking System v4.0 is vulnerable to Cross-Site Scripting XSS vulnerabilities in the "name, pluginsmsapikey, pluginsmscountrycode, title, pluginsmsapikey" parameters...

CVE-2024-57033

WeGIA 3.2.0 is vulnerable to Cross Site Scripting XSS via the dadosaddInfo parameter of documentosfuncionario.php...

CVE-2023-43323

mooSocial 3.1.8 is vulnerable to external service interaction on post function. When executed, the server sends a HTTP and DNS request to external server. The Parameters effected are multiple - messageText, datawallphoto, datauserShareVideo and datauserShareLink...

CVE-2023-43323

mooSocial 3.1.8 is vulnerable to external service interaction on post function. When executed, the server sends a HTTP and DNS request to external server. The Parameters effected are multiple - messageText, datawallphoto, datauserShareVideo and datauserShareLink...

CVE-2023-34754

bloofox v0.5.2.1 was discovered to contain a SQL injection vulnerability via the pid parameter at admin/index.php?mode=settings&page=plugins&action=edit...

CVE-2023-29849

Bang Resto 1.0 was discovered to contain multiple SQL injection vulnerabilities via the btnMenuItemID, itemID, itemPrice, menuID, staffID, or itemqty parameter...

CVE-2004-1413

Multiple SQL injection vulnerabilities in Kayako eSupport 2.x allow remote attackers to execute arbitrary SQL commands via the 1 subcat, 2 rate, 3 questiondetails, 4 ticketkey22, 5 email22 parameters to index.php, or 6 the e-mail field of the Forgot Key feature...

CVE-2004-2756

Cross-site scripting XSS vulnerability in viewtopic.php in Xoops 2.x, possibly 2 through 2.0.5, allows remote attackers to inject arbitrary web script or HTML via the 1 forum and 2 topicid parameters...

CVE-2004-2566

Multiple cross-site scripting XSS vulnerabilities in LiveWorld products, possibly including 1 LiveForum, 2 LiveQ&A, 3 LiveChat, and 4 LiveFocusGroup, allow remote attackers to inject arbitrary web script or HTML via the q parameter in a search.jsp, b findclub!execute.jspa, and c search!execute.js...

CVE-2004-0300

SQL injection vulnerability in Online Store Kit 3.0 allows remote attackers to inject arbitrary SQL and gain unauthorized access via 1 the cat parameter in shop.php, 2 the id parameter in more.php, 3 the catmanufacturer parameter in shopbybrand.php, or 4 the id parameter in listing.php...

CVE-2003-0488

Multiple cross-site scripting XSS vulnerabilities in Kerio MailServer 5.6.3 allow remote attackers to insert arbitrary web script via 1 the addname parameter in the addacl module, or 2 the alias parameter in the domap module...

CVE-2003-0416

Cross-site scripting XSS vulnerability in index.cgi for Bandmin 1.4 allows remote attackers to insert arbitrary HTML or script via 1 the year parameter in a showmonth action, 2 the month parameter in a showmonth action, or 3 the host parameter in a showhost action...

CVE-2002-0010

Bugzilla before 2.14.1 allows remote attackers to inject arbitrary SQL code and create files or gain privileges via 1 the sql parameter in buglist.cgi, 2 invalid field names from the "boolean chart" query in buglist.cgi, 3 the mybugslink parameter in userprefs.cgi, 4 a malformed bug ID in the...