csaf

Фреймворк повышения осведомлённости в области кибербезопасности CSAF — это структурированный подход, направленный на повышение осведомлённости и понимания кибербезопасности среди отдельных лиц, организаций и сообществ. Он предоставляет рекомендации по разработке эффективных программ повышения...

defenselessV1

defenselessV1 Defenseless — это уязвимое веб-приложение, написанное на PHP/MySQL. Это первая версия этого приложения. Цель этого приложения — повысить осведомленность о безопасности среди разработчиков и новичков в области безопасности приложений. Вскоре оно будет обновлено с добавлением новых...

CVE-2026-29861

CVE-2026-29861 🛡️ CVE 공개: CVE-2026-29861 — PHP-MYSQL-User-Login-System의 SQL 인젝션 공개 날짜: 2026년 4월 10일 CVE ID: CVE-2026-29861 심각도: CRITICAL CVSS 9.8 🧩 요약 PHP-MYSQL-User-Login-System v1.0의 login.php 엔드포인트에서 심각한 SQL 인젝션 취약점이 발견되었습니다. 이 애플리케이션은 사용자 입력을 검증 없이 SQL 쿼리에 직접 포함시켜, 인증되지 않은 공격자가 인증을 우회하고 전체 관리자...

CVE-2026-7028-SQLI

CodeAstro-Online-Job-Portal-SQLi-Delete-All 세부 정보 공급업체: CodeAstro 제품: Online Job Portal Project in PHP MySQL 버전: 1.0 취약점 유형: SQL 인젝션 CWE: CWE-89 영향을 받는 엔드포인트: /admin/jobs-admins/delete-jobs.php 파라미터: id GET 영향: 데이터베이스의 모든 채용 공고 레코드 삭제 가능 설명 CodeAstro Online Job Portal의 관리자 채용 공고 삭제 기능에서 SQL 인젝션...

CVE-2026-6201-IDOR

CodeAstro 온라인 구인 포털의 취약한 접근 제어로 인한 임의 채용 공고 삭제 가능 세부 정보 공급업체: CodeAstro 제품: PHP MySQL 기반 온라인 구인 포털 프로젝트 버전: 1.0 취약점 유형: 취약한 접근 제어 IDOR CWE: CWE-639 영향을 받는 파일: /jobs/job-delete.php 매개변수: id GET 영향: 인증된 고용주가 요청의 id 매개변수를 조작하여 다른 고용주의 채용 공고를 삭제할 수 있습니다. 설명 CodeAstro가 개발한 PHP MySQL 기반 온라인 구인 포털 프로젝트는...

CentOS Linux 7 [TuxCare] Security Update: php-common / php-enchant / php-fpm / php-intl / php-mysql / etc Multiple Vulnerabilities (CENTOS7:CLSA-2025:1747740986)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2025:1747740986 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number...

Zero-Day-Legacy

🎓 Дипломный проект — Университет Аджлуна ANU Факультет ИТ · Кибербезопасность и облачные вычисления · Учебный год 2026 🏆 Самая высокая оценка в университете: 97% 📖 Обзор Zero-Day Legacy — это реалистичная, намеренно уязвимая лабораторная машина Boot-to-Root CTF Capture The Flag , созданная в рамк...

CVE-2024-34225

PHP 및 MySQL을 사용한 컴퓨터 실험실 관리 시스템 1.0 제출자: Kha Do 취약점 크로스 사이트 스크립팅 설명 PHP 및 MySQL을 사용한 컴퓨터 실험실 관리 시스템 1.0의 php-lms/admin/?page=systeminfo에 있는 크로스 사이트 스크립팅 취약점으로 인해 원격 공격자가 name, shortname 매개변수를 통해 임의의 웹 스크립트 또는 HTML을 주입할 수 있습니다. 영향을 받는 구성 요소 경로 URL: php-lms/admin/?page=systeminfo 매개변수: 시스템 이름 name,...

CVE-2026-14622 jairiidriss restaurant-website-php-mysql AJAX Endpoint ajax_files missing authentication

A vulnerability was found in jairiidriss restaurant-website-php-mysql up to 521428b5b612449df0cf4a5d15ee40cba67f3d35. This vulnerability affects unknown code of the file /admin/ajaxfiles of the component AJAX Endpoint. Performing a manipulation results in missing authentication. The attack is...

CVE-2026-14622

CVE-2026-14622 affects the restaurant-website-php-mysql project (up to commit 521428b5b612449df0cf4a5d15ee40cba67f3d35). The vulnerability is in the /admin/ajax_files component of the AJAX Endpoint, whereby input manipulation leads to missing authentication. It is exploitable remotely, with a pub...

CVE-2026-14622: Missing Authentication for Critical Function

A vulnerability was found in jairiidriss restaurant-website-php-mysql up to 521428b5b612449df0cf4a5d15ee40cba67f3d35. This vulnerability affects unknown code of the file /admin/ajaxfiles of the component AJAX Endpoint. Performing a manipulation results in missing authentication. The attack is...

emlog 跨站请求伪造漏洞

Emlog is an open-source CMS website building system based on PHP and MySQL. Versions of Emlog prior to 2.6.11 contained a cross-site request forgeing vulnerability. This vulnerability stemmed from the lack of CSRF protection in critical management functions, which could allow attackers to trick...

CVE-2026-29861

PHP-MYSQL-User-Login-System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at login.php...

CVE-2026-29861: Improper Neutralization of Special Elements used in an SQL Command

PHP-MYSQL-User-Login-System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at login.php...

CVE-2026-29861

PHP-MYSQL-User-Login-System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at login.php...

CVE-2025-68614: Improper Neutralization of Input During Web Page Generation

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.12.0, the Alert Rule API is vulnerable to stored cross-site scripting. Alert rules can be created or updated via LibreNMS API. The alert rule name is not properly sanitized, and can be used to inject...

CVE-2025-63442: Improper Neutralization of Input During Web Page Generation

Simple User Management System with PHP-MySQL v1.0 is vulnerable to Cross-Site Scripting XSS via the Profile Section. The system fails to properly sanitize user input, allowing attackers to inject and execute arbitrary JavaScript when the input is displayed in the browser...

CVE-2025-63442

Simple User Management System with PHP-MySQL v1.0 is vulnerable to Cross-Site Scripting XSS via the Profile Section. The system fails to properly sanitize user input, allowing attackers to inject and execute arbitrary JavaScript when the input is displayed in the browser...

PT-2025-44771

Name of the Vulnerable Software and Affected Versions Simple User Management System with PHP-MySQL version 1.0 Description The Simple User Management System with PHP-MySQL fails to properly sanitize user input in the Profile Section, allowing attackers to inject and execute arbitrary JavaScript...

EUVD-2025-36057

A security flaw has been discovered in ajayrandhawa User-Management-PHP-MYSQL web up to fedcf58797bf2791591606f7b61fdad99ad8bff1. This vulnerability affects unknown code. Performing manipulation results in cross-site request forgery. The attack can be initiated remotely. The exploit has been...