588 matches found
defenselessV1
defenselessV1 Defenseless es una aplicaciΓ³n web vulnerable escrita en PHP/MySQL. Esta es la primera versiΓ³n de esta aplicaciΓ³n. El propΓ³sito de esta aplicaciΓ³n es crear conciencia de seguridad entre los desarrolladores y los nuevos en seguridad de aplicaciones. Pronto se actualizarΓ‘ con mΓ‘s error...
csaf
DAMN VULNERABLE WEB APPLICATION Damn Vulnerable Web Application DVWA es una aplicaciΓ³n web hecha en PHP/MySQL que es extremadamente vulnerable. Su principal objetivo es ayudar a profesionales de seguridad a poner a prueba sus habilidades y herramientas en un entorno legal, ayudar a desarrolladore...
CVE-2024-34225
Computer Laboratory Management System using PHP and MySQL 1.0 Submitter: Kha Do Vulnerability Cross Site Scripting Description Cross Site Scripting vulnerability in php-lms/admin/?page=systeminfo in Computer Laboratory Management System using PHP and MySQL 1.0 allow remote attackers to inject...
CVE-2026-29861
CVE-2026-29861 π‘οΈ CVE Disclosure: CVE-2026-29861 β SQL Injection in PHP-MYSQL-User-Login-System Disclosure Date: 10 April 2026 CVE ID: CVE-2026-29861 Severity: CRITICAL CVSS 9.8 𧩠Summary A critical SQL Injection vulnerability exists in PHP-MYSQL-User-Login-System v1.0, specifically within the...
CVE-2026-7028-SQLI
CodeAstro-Online-Job-Portal-SQLi-Delete-All Details Vendor: CodeAstro Product: Online Job Portal Project in PHP MySQL Version: 1.0 Vulnerability Type: SQL Injection CWE: CWE-89 Affected Endpoint: /admin/jobs-admins/delete-jobs.php Parameter: id GET Impact: Allows deletion of all job records in th...
CVE-2026-6201-IDOR
Broken Access Control in CodeAstro Online Job Portal Allows Arbitrary Job Deletion Details Vendor: CodeAstro Product: Online Job Portal Project in PHP MySQL Version: 1.0 Vulnerability Type: Broken Access Control IDOR CWE: CWE-639 Affected File: /jobs/job-delete.php Parameter: id GET Impact: An...
Zero-Day-Legacy
π Graduation Project β Ajloun National University ANU Faculty of IT Β· Cybersecurity and Cloud Computing Β· Academic Year 2026 π Highest Grade in the University: 97% π Overview Zero-Day Legacy is a realistic, intentionally vulnerable Boot-to-Root CTF Capture The Flag lab machine built as a graduati...
CVE-2026-14622 jairiidriss restaurant-website-php-mysql AJAX Endpoint ajax_files missing authentication
A vulnerability was found in jairiidriss restaurant-website-php-mysql up to 521428b5b612449df0cf4a5d15ee40cba67f3d35. This vulnerability affects unknown code of the file /admin/ajaxfiles of the component AJAX Endpoint. Performing a manipulation results in missing authentication. The attack is...
CVE-2026-14622
CVE-2026-14622 affects the restaurant-website-php-mysql project (up to commit 521428b5b612449df0cf4a5d15ee40cba67f3d35). The vulnerability is in the /admin/ajax_files component of the AJAX Endpoint, whereby input manipulation leads to missing authentication. It is exploitable remotely, with a pub...
CVE-2026-14622: Missing Authentication for Critical Function
A vulnerability was found in jairiidriss restaurant-website-php-mysql up to 521428b5b612449df0cf4a5d15ee40cba67f3d35. This vulnerability affects unknown code of the file /admin/ajaxfiles of the component AJAX Endpoint. Performing a manipulation results in missing authentication. The attack is...
emlog θ·¨η«θ―·ζ±δΌͺι ζΌζ΄
Emlog is an open-source CMS website building system based on PHP and MySQL. Versions of Emlog prior to 2.6.11 contained a cross-site request forgeing vulnerability. This vulnerability stemmed from the lack of CSRF protection in critical management functions, which could allow attackers to trick...
CVE-2026-29861
PHP-MYSQL-User-Login-System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at login.php...
CVE-2026-29861: Improper Neutralization of Special Elements used in an SQL Command
PHP-MYSQL-User-Login-System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at login.php...
CVE-2026-29861
PHP-MYSQL-User-Login-System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at login.php...
CVE-2025-68614: Improper Neutralization of Input During Web Page Generation
LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.12.0, the Alert Rule API is vulnerable to stored cross-site scripting. Alert rules can be created or updated via LibreNMS API. The alert rule name is not properly sanitized, and can be used to inject...
CVE-2025-63442: Improper Neutralization of Input During Web Page Generation
Simple User Management System with PHP-MySQL v1.0 is vulnerable to Cross-Site Scripting XSS via the Profile Section. The system fails to properly sanitize user input, allowing attackers to inject and execute arbitrary JavaScript when the input is displayed in the browser...
CVE-2025-63442
Simple User Management System with PHP-MySQL v1.0 is vulnerable to Cross-Site Scripting XSS via the Profile Section. The system fails to properly sanitize user input, allowing attackers to inject and execute arbitrary JavaScript when the input is displayed in the browser...
PT-2025-44771
Name of the Vulnerable Software and Affected Versions Simple User Management System with PHP-MySQL version 1.0 Description The Simple User Management System with PHP-MySQL fails to properly sanitize user input in the Profile Section, allowing attackers to inject and execute arbitrary JavaScript...
EUVD-2025-36057
A security flaw has been discovered in ajayrandhawa User-Management-PHP-MYSQL web up to fedcf58797bf2791591606f7b61fdad99ad8bff1. This vulnerability affects unknown code. Performing manipulation results in cross-site request forgery. The attack can be initiated remotely. The exploit has been...
CVE-2025-12202 ajayrandhawa User-Management-PHP-MYSQL web cross-site request forgery
A security flaw has been discovered in ajayrandhawa User-Management-PHP-MYSQL web up to fedcf58797bf2791591606f7b61fdad99ad8bff1. This vulnerability affects unknown code. Performing manipulation results in cross-site request forgery. The attack can be initiated remotely. The exploit has been...