School Registration and Fee System SQL Injection Vulnerability (CNVD-2026-37879)

School Registration and Fee System is a school registration and fee management software developed by the SourceCodester community. The system has a SQL injection vulnerability, which stems from incorrect handling of the period parameter in the file bilal/normal/payreport.php. Attackers can exploi...

CVE-2026-90516 SourceCodester School Registration and Fee System pay_report.php sql injection

A vulnerability was found in SourceCodester School Registration and Fee System 1.0. The affected element is an unknown function of the file /bilal/normal/payreport.php. Performing a manipulation of the argument period results in sql injection. The attack can be initiated remotely. The exploit has...

EUVD-2026-76999

A vulnerability was found in SourceCodester School Registration and Fee System 1.0. The affected element is an unknown function of the file /bilal/normal/payreport.php. Performing a manipulation of the argument period results in sql injection. The attack can be initiated remotely. The exploit has...

CVE-2026-90516

SourceCodester School Registration and Fee System 1.0 is affected by a remote SQL injection vulnerability in the period parameter of /bilal/normal/pay_report.php. No authentication is required, and the attack complexity is low. The CVSS 3.1 score is 7.3 (HIGH) , with low impacts to confidentialit...

PT-2026-90845

Name of the Vulnerable Software and Affected Versions SourceCodester School Registration and Fee System version 1.0 Description A remote SQL injection is possible due to improper handling of the period argument within an unknown function in the /bilal/normal/pay report.php file. SQL injection is ...

EUVD-2026-22845

The Quick Interest Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'loan-amount' and 'loan-period' parameters in all versions up to, and including, 3.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...

CVE-2026-5694

The Quick Interest Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'loan-amount' and 'loan-period' parameters in all versions up to, and including, 3.1.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...

CVE-2026-5694

The CVE concerns the Quick Interest Slider WordPress plugin, affected up to and including version 3.1.5. It is vulnerable to an unauthenticated stored XSS via the loan-amount and loan-period parameters, caused by insufficient input sanitization and output escaping. The vulnerability allows attack...

PT-2026-33012

Name of the Vulnerable Software and Affected Versions Quick Interest Slider versions prior to 3.1.6 Description The Quick Interest Slider plugin for WordPress contains a Stored Cross-Site Scripting issue caused by insufficient input sanitization and output escaping. Unauthenticated attackers can...

WordPress plugin Quick Interest Slider 安全漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

EUVD-2020-27285

Malware in sbrugna...

MyBB plugin Active Threads 跨站脚本漏洞

MyBB MyBulletinBoard is a free and web-based forum software developed by MYBB team using PHP and MySQL. The software is easy to use , support for multi-language , scalable and so on. A security vulnerability exists in MyBB plugin Active Threads version 1.3.0, which originates from the date...

sidekiq 跨站脚本漏洞

Mike Perham sidekiq is a Mike Perham open source application. It uses threads to handle many jobs in the same process at the same time. A cross-site scripting vulnerability exists in sidekiq versions prior to 7.0.8, which can be exploited to cause XSS on Sidekiq via the GET parameter "period" in...

CVE-2021-41679

A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the /opensis/modules/grades/InputFinalGrades.php, period parameter...

CVE-2021-41679: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue the SQL command through the /opensis/modules/grades/InputFinalGrades.php, period parameter...

VestaCP 0.9.8-26 Cross Site Scripting

Document Title: =============== VestaCP v0.9.8-26 - period Cross Site Web Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=2239 Release Date: ============= 2020-11-24 Vulnerability Laboratory ID VL-ID: ====================================...

CVE-2016-10947

The Post Indexer plugin before 3.0.6.2 for WordPress has SQL injection via the period parameter by a super admin...

CVE-2016-10947: Improper Neutralization of Special Elements used in an SQL Command

The Post Indexer plugin before 3.0.6.2 for WordPress has SQL injection via the period parameter by a super admin...

CVE-2018-20824

The WallboardServlet resource in Jira before version 7.13.1 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the cyclePeriod parameter...

CVE-2018-18547: Improper Neutralization of Input During Web Page Generation

Vesta Control Panel through 0.9.8-22 has XSS via the edit/web/ domain parameter, the list/backup/ backup parameter, the list/rrd/ period parameter, the list/directory/ dira parameter, or the filename to the list/directory/ URI...