CVE-2024-34225

Computer Laboratory Management System using PHP and MySQL 1.0 Submitter: Kha Do Vulnerability Cross Site Scripting Description Cross Site Scripting vulnerability in php-lms/admin/?page=systeminfo in Computer Laboratory Management System using PHP and MySQL 1.0 allow remote attackers to inject...

defenselessV1

defenselessV1 Defenseless is a vulnerable web application written in PHP/MySQL. This is the first version of this application. The purpose of this application is to create security awareness among developers and new guys in application security. It would soon be updated with with more bugs and a...

csaf

Translation / Traduction Philibert Gentil：@Philibert-Gentil Vous pouvez me contacter en cas d'erreur de traduction / d'interprétation. DAMN VULNERABLE WEB APPLICATION / BORDEL D'APPLICATION WEB VULNÉRABLE Bordel d'application web vulnérable BAWV, traduit DVWA est une application web PHP/MySQL...

CVE-2026-29861

CVE-2026-29861 🛡️ Раскрытие CVE: CVE-2026-29861 — SQL-инъекция в PHP-MYSQL-User-Login-System Дата раскрытия: 10 апреля 2026 г. Идентификатор CVE: CVE-2026-29861 Критичность: КРИТИЧЕСКАЯ CVSS 9.8 🧩 Краткое описание Критическая уязвимость SQL-инъекции существует в PHP-MYSQL-User-Login-System v1.0, а...

CVE-2026-7028-SQLI

CodeAstro-Online-Job-Portal-SQLi-Delete-All Детали Вендор: CodeAstro Продукт: Online Job Portal Project in PHP MySQL Версия: 1.0 Тип уязвимости: SQL-инъекция CWE: CWE-89 Затронутая конечная точка: /admin/jobs-admins/delete-jobs.php Параметр: id GET Воздействие: Позволяет удалить все записи о...

CVE-2026-6201-IDOR

Нарушенный контроль доступа в CodeAstro Online Job Portal позволяет произвольное удаление вакансий Детали Вендор: CodeAstro Продукт: Online Job Portal Project in PHP MySQL Версия: 1.0 Тип уязвимости: Нарушенный контроль доступа IDOR CWE: CWE-639 Затронутый файл: /jobs/job-delete.php Параметр: id...

CentOS Linux 7 [TuxCare] Security Update: php-common / php-enchant / php-fpm / php-intl / php-mysql / etc Multiple Vulnerabilities (CENTOS7:CLSA-2025:1747740986)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2025:1747740986 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number...

Zero-Day-Legacy

🎓 Graduation Project — Ajloun National University ANU Faculty of IT · Cybersecurity and Cloud Computing · Academic Year 2026 🏆 Highest Grade in the University: 97% 📖 Overview Zero-Day Legacy is a realistic, intentionally vulnerable Boot-to-Root CTF Capture The Flag lab machine built as a graduati...

CVE-2026-14622 jairiidriss restaurant-website-php-mysql AJAX Endpoint ajax_files missing authentication

A vulnerability was found in jairiidriss restaurant-website-php-mysql up to 521428b5b612449df0cf4a5d15ee40cba67f3d35. This vulnerability affects unknown code of the file /admin/ajaxfiles of the component AJAX Endpoint. Performing a manipulation results in missing authentication. The attack is...

CVE-2026-14622

CVE-2026-14622 affects the restaurant-website-php-mysql project (up to commit 521428b5b612449df0cf4a5d15ee40cba67f3d35). The vulnerability is in the /admin/ajax_files component of the AJAX Endpoint, whereby input manipulation leads to missing authentication. It is exploitable remotely, with a pub...

CVE-2026-14622: Missing Authentication for Critical Function

A vulnerability was found in jairiidriss restaurant-website-php-mysql up to 521428b5b612449df0cf4a5d15ee40cba67f3d35. This vulnerability affects unknown code of the file /admin/ajaxfiles of the component AJAX Endpoint. Performing a manipulation results in missing authentication. The attack is...

emlog 跨站请求伪造漏洞

Emlog is an open-source CMS website building system based on PHP and MySQL. Versions of Emlog prior to 2.6.11 contained a cross-site request forgeing vulnerability. This vulnerability stemmed from the lack of CSRF protection in critical management functions, which could allow attackers to trick...

CVE-2026-29861

PHP-MYSQL-User-Login-System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at login.php...

CVE-2026-29861: Improper Neutralization of Special Elements used in an SQL Command

PHP-MYSQL-User-Login-System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at login.php...

CVE-2026-29861

PHP-MYSQL-User-Login-System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at login.php...

CVE-2025-68614: Improper Neutralization of Input During Web Page Generation

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.12.0, the Alert Rule API is vulnerable to stored cross-site scripting. Alert rules can be created or updated via LibreNMS API. The alert rule name is not properly sanitized, and can be used to inject...

CVE-2025-63442: Improper Neutralization of Input During Web Page Generation

Simple User Management System with PHP-MySQL v1.0 is vulnerable to Cross-Site Scripting XSS via the Profile Section. The system fails to properly sanitize user input, allowing attackers to inject and execute arbitrary JavaScript when the input is displayed in the browser...

CVE-2025-63442

Simple User Management System with PHP-MySQL v1.0 is vulnerable to Cross-Site Scripting XSS via the Profile Section. The system fails to properly sanitize user input, allowing attackers to inject and execute arbitrary JavaScript when the input is displayed in the browser...

PT-2025-44771

Name of the Vulnerable Software and Affected Versions Simple User Management System with PHP-MySQL version 1.0 Description The Simple User Management System with PHP-MySQL fails to properly sanitize user input in the Profile Section, allowing attackers to inject and execute arbitrary JavaScript...

EUVD-2025-36057

A security flaw has been discovered in ajayrandhawa User-Management-PHP-MYSQL web up to fedcf58797bf2791591606f7b61fdad99ad8bff1. This vulnerability affects unknown code. Performing manipulation results in cross-site request forgery. The attack can be initiated remotely. The exploit has been...