16044 matches found
CVE-2025-40617 SQL injection vulnerability in Bookgy
SQL injection vulnerability in Bookgy. This vulnerability could allow an attacker to retrieve, create, update and delete databases by sending an HTTP request through the "IDTIPO", "IDPISTA" and "IDSOCIO" parameters in /bkgseleccionarhoraajax.php...
CVE-2025-40617 SQL injection vulnerability in Bookgy
SQL injection vulnerability in Bookgy. This vulnerability could allow an attacker to retrieve, create, update and delete databases by sending an HTTP request through the "IDTIPO", "IDPISTA" and "IDSOCIO" parameters in /bkgseleccionarhoraajax.php...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the bazariframe endpoint. An attacker can manipulate the web page content or hijack user sessions by injecting malicious scripts into the URL parameters. This allows stealing cookies from an authenticate...
CVE-2025-4023
A vulnerability was found in itsourcecode Placement Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /addcompany.php. The manipulation of the argument Name leads to sql injection. The attack may be initiated remotely. The exploit has bee...
PT-2025-18072 · Unknown · Itsourcecode Placement Management System
Name of the Vulnerable Software and Affected Versions: iSourcecode Placement Management System version 1.0 Description: A critical issue affects the processing of the file /add company.php. The manipulation of the Name argument leads to SQL injection. The attack may be initiated remotely. Other...
CVE-2025-3972
CVE-2025-3972 affects PHPGurukul COVID19 Testing Management System 1.0. Affected: some unknown functionality in the file /bwdates-report-result.php. The vulnerability arises from manipulating the todate parameter, leading to SQL injection. Reported as remote in nature; exploit disclosed publicly ...
CVE-2025-46617
Quantum StorNext Web GUI API before 7.2.4 grants access to internal StorNext configuration and unauthorized modification of some software configuration parameters via undocumented user credentials. This affects StorNext RYO before 7.2.4, StorNext Xcellis Workflow Director before 7.2.4, and...
CVE-2023-37534
Insufficient URI protocol whitelist in HCL Leap allows script injection through query parameters...
FastCGI fcgi2 (aka fcgi) 2.x through 2.4.4 has an integer overflow (and resultant heap-based buffer overflow) via crafted nameLen or valueLen values in data to the IPC socket. This occurs in ReadParams in fcgiapp.c.
...
CVE-2025-43717
In PEAR HTTPRequest2 before 2.7.0, multiple files in the tests directory, notably tests/network/getparameters.php and tests/network/postparameters.php, reflect any GET or POST parameters, leading to XSS...
Cross-Site Scripting (XSS)
pear/httprequest2 is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the lack of proper sanitization and escaping of user input in the affected files tests/network/getparameters.php and tests/network/postparameters.php, which allows GET and POST parameters to be reflected...
NetScout nGeniusONE 跨站脚本漏洞
NetScout nGeniusONE is a centralized application management and network performance solution from NetScout, Inc. A security vulnerability exists in NetScout nGeniusONE versions prior to 6.4.0 b2350, which stems from a stored cross-site scripting attack that could result from certain POST paramete...
CVE-2025-28076
Multiple SQL injection vulnerabilities in EasyVirt DCScope = 8.6.4 and CO2Scope = 1.3.4 allows remote authenticated attackers to execute arbitrary SQL commands via the 1 timeago, 2 user, 3 filter, 4 target, 5 p1, 6 p2, 7 p3, 8 p4, 9 p5, 10 p6, 11 p7, 12 p8, 13 p9, 14 p10, 15 p11, 16 p12, 17 p13, ...
CVE-2023-37534
Insufficient URI protocol whitelist in HCL Leap allows script injection through query parameters...
CVE-2023-37534
Insufficient URI protocol whitelist in HCL Leap allows script injection through query parameters...
CVE-2023-37534 HCL Leap is affected by a Cross-site scripting (XSS) vulnerability
Insufficient URI protocol whitelist in HCL Leap allows script injection through query parameters...
CVE-2025-43855 tRPC 11 WebSocket DoS Vulnerability
tRPC allows users to build & consume fully typesafe APIs without schemas or code generation. In versions starting from 11.0.0 to before 11.1.1, an unhandled error is thrown when validating invalid connectionParams which crashes a tRPC WebSocket server. This allows any unauthenticated user to cras...
CVE-2025-2558
The-wound WordPress theme through 0.0.1 does not validate some parameters before using them to generate paths passed to include function/s, allowing unauthenticated users to perform LFI attacks and download arbitrary file from the server...
HCL Leap 安全漏洞
HCL Leap is a low-code development platform from HCL India. HCL Leap has a security vulnerability that stems from an insufficient whitelisting of the URI protocol, which allows scripts to be injected via query parameters...