PT-2026-21433

Inventory Webapp contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through GET parameters. Attackers can supply malicious SQL payloads in the name, description, quantity, or cat id parameters to add-item.php to execu...

Web Wiz Forums SQL注入漏洞

Web Wiz Forums is a community forum system developed by the British company Web Wiz. Version 12.01 of Web Wiz Forums contains a SQL injection vulnerability. This vulnerability stems from SQL injection in the PF parameters, which could allow unverified attackers to manipulate database queries...

Inventory Webapp SQL注入漏洞

Inventory Webapp is a browser-based inventory management system developed by Inventory Company. The Inventory Webapp has a SQL injection vulnerability, which stems from SQL injections in GET parameters. This vulnerability could allow unverified attackers to manipulate database queries...

Cross-site Request Forgery (CSRF)

alextselegidis/easyappointments is vulnerable to Cross-Site Request Forgery CSRF. The vulnerability is due to CSRF protection being enforced only for POST requests while state-changing actions accept GET parameters, which allows an attacker to perform unauthorized administrative actions through...

Feathers 输入验证错误漏洞

Feathers is a lightweight web framework developed by Feathers OpenSource. It is used to create APIs and real-time applications using TypeScript or JavaScript. Feathers versions 5.0.39 and earlier contain a vulnerability related to input validation errors. This vulnerability arises from redirectin...

WordPress Ultimate Member plugin <= 2.11.1 - Reflected Cross-Site Scripting via Filter Parameters vulnerability

Reflected Cross-Site Scripting via Filter Parameters vulnerability discovered by Dmitrii Ignatyev - CleanTalk Inc in WordPress Plugin Ultimate Member versions = 2.11.1...

CVE-2026-0926

The Prodigy Commerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.3.0 via the 'parameterstemplatename' parameter. This makes it possible for unauthenticated attackers to include and read arbitrary files or execute arbitrary files on the server...

ADB Explorer 安全漏洞

ADB Explorer is a ADB user interface developed by Alex B as an individual developer. Versions of ADB Explorer prior to 0.9.26020 contain security vulnerabilities, which stem from unvalidated command-line parameters and could lead to recursive deletion of directories...

Zenitel AlphaCom 安全漏洞

Zenitel AlphaCom is a critical communication server owned by the Norwegian company Zenitel. There is a security vulnerability in Zenitel AlphaCom, which allows attackers to read arbitrary files by modifying file path parameters to internal system paths...

ProLink PRC2402M 操作系统命令注入漏洞

The ProLink PRC2402M is a router produced by ProLink Company in Singapore. Versions prior to 20190909/2021-06-13 of the PROLiNK PRC2402M had a vulnerability related to operating system command injection. This vulnerability stemmed from ip parameters that allowed for OS command injection,...

PT-2026-21193

Name of the Vulnerable Software and Affected Versions Smanga version 3.2.7 Description An authentication bypass exists in Smanga version 3.2.7. An unauthenticated attacker can reset the password of any user, including the administrator, and fully compromise the account. This is achieved by...

LabCollector SQL注入漏洞

LabCollector is a multi-functional laboratory management platform developed by LabCollector Inc. Version 5.423 of LabCollector contains a SQL injection vulnerability. This vulnerability stems from multiple SQL injections in POST parameters, which may allow unverified attackers to execute arbitrar...

SvelteKit 访问控制错误漏洞

SvelteKit is an open-source web development framework developed in Svelte. Versions of SvelteKit prior to 6.3.2 contained a access control vulnerability; this vulnerability stemmed from the ability for internal query parameters to be accessed, which could lead to cache poisoning...

CVE-2025-13672

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in OpenText™ Web Site Management Server allows Reflected XSS. The vulnerability could allow injecting malicious JavaScript inside URL parameters that was then rendered with the preview of the...

CVE-2025-13672

The CVE-2025-13672 entry describes a Reflected XSS in OpenText Web Site Management Server, affecting versions 16.7.0 and 16.7.1 . The issue arises from improper neutralization of input during web page generation, allowing malicious JavaScript to be injected via URL parameters and rendered in the ...

CVE-2026-1404

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the filter parameters e.g., 'filterfirstname' in all versions up to, and including, 2.11.1 due to insufficien...

CVE-2026-23616

GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting vulnerability in the Anti-Spoofing configuration page. An authenticated user can supply HTML/JavaScript in the ctl00$ContentPlaceHolder1$AntiSpoofingGeneral1$TxtSmtpDesc parameter to...

CVE-2019-25428

Comodo Dome Firewall 2.7.0 contains multiple reflected cross-site scripting vulnerabilities in the openvpnusers endpoint that allow attackers to inject malicious scripts through POST parameters. Attackers can submit crafted POST requests with script payloads in the username, remotenets,...

CVE-2019-25426

Comodo Dome Firewall 2.7.0 contains a reflected cross-site scripting vulnerability that allows attackers to inject malicious scripts by submitting crafted input to the dnsmasq endpoint. Attackers can send POST requests with script payloads in the TRANSPARENTSOURCEBYPASS or...

CVE-2019-25428

Comodo Dome Firewall 2.7.0 contains multiple reflected cross-site scripting vulnerabilities in the openvpnusers endpoint that allow attackers to inject malicious scripts through POST parameters. Attackers can submit crafted POST requests with script payloads in the username, remotenets,...