CVE-2024-34225

Sistema de Gestión de Laboratorio de Computación usando PHP y MySQL 1.0 Remitente: Kha Do Vulnerabilidad Cross Site Scripting Descripción Vulnerabilidad de Secuencias de comandos entre sitios en php-lms/admin/?page=systeminfo en el Sistema de Gestión de Laboratorio de Computación usando PHP y MyS...

csaf

翻译 翻译：@inVains @songzy12 @cnskis 关于 DAMN VULNERABLE WEB APPLICATION（DVWA） Damn Vulnerable Web Application DVWA译注：可以直译为："该死的"不安全Web应用程序，是一个编码差的、易受攻击的 PHP/MySQL Web应用程序。 它的主要目的是帮助信息安全专业人员在合法的环境中，练习技能和测试工具，帮助 Web 开发人员更好地了解如何加强 Web 应用程序的安全性，并帮助学生和教师在可控的教学环境中了解和学习 Web 安全技术。 DVWA的目的是通过简单明了的界面来练习一些最常见的...

defenselessV1

defenselessV1 Defenseless 是一个用 PHP/MySQL 编写的脆弱 Web 应用程序。这是该应用程序的第一个版本。其目的是在开发者和应用安全新手之间建立安全意识。它将很快更新，增加更多漏洞，同时另一个新的脆弱应用也正在开发中。请告诉我如何改进它。 免责声明 请勿将此应用程序托管在在线或生产环境中。 设置 设置此应用程序很简单。 1. 下载后在 phpmyadmin 中创建一个新数据库。 2. 将数据库命名为 testapp 。然后，将文件 testapp2.sql 导入 testapp 数据库。 3. 刷新即可使用。 !!!使用 XAMPP 以获得最佳效果!!!...

CVE-2026-29861

CVE-2026-29861 🛡️ CVE Disclosure: CVE-2026-29861 — SQL Injection in PHP-MYSQL-User-Login-System Disclosure Date: 10 April 2026 CVE ID: CVE-2026-29861 Severity: CRITICAL CVSS 9.8 🧩 Summary A critical SQL Injection vulnerability exists in PHP-MYSQL-User-Login-System v1.0, specifically within the...

CVE-2026-7028-SQLI

CodeAstro-Online-Job-Portal-SQLi-Delete-All Detalles Proveedor: CodeAstro Producto: Proyecto de Portal de Empleo en Línea en PHP MySQL Versión: 1.0 Tipo de vulnerabilidad: Inyección SQL CWE: CWE-89 Endpoint afectado: /admin/jobs-admins/delete-jobs.php Parámetro: id GET Impacto: Permite la...

CVE-2026-6201-IDOR

Control de Acceso Roto en CodeAstro Online Job Portal Permite la Eliminación Arbitraria de Empleos Detalles Vendedor: CodeAstro Producto: Proyecto de Portal de Empleo en Línea en PHP MySQL Versión: 1.0 Tipo de Vulnerabilidad: Control de Acceso Roto IDOR CWE: CWE-639 Archivo Afectado:...

CentOS Linux 7 [TuxCare] Security Update: php-common / php-enchant / php-fpm / php-intl / php-mysql / etc Multiple Vulnerabilities (CENTOS7:CLSA-2025:1747740986)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2025:1747740986 advisory. Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number...

Zero-Day-Legacy

🎓 Proyecto de Graduación — Universidad Nacional de Ajloun UNA Facultad de TI · Ciberseguridad y Computación en la Nube · Año Académico 2026 🏆 Nota más alta de la universidad: 97% 📖 Descripción General Zero-Day Legacy es una máquina de laboratorio Boot-to-Root CTF Capture The Flag realista e...

CVE-2026-14622 jairiidriss restaurant-website-php-mysql AJAX Endpoint ajax_files missing authentication

A vulnerability was found in jairiidriss restaurant-website-php-mysql up to 521428b5b612449df0cf4a5d15ee40cba67f3d35. This vulnerability affects unknown code of the file /admin/ajaxfiles of the component AJAX Endpoint. Performing a manipulation results in missing authentication. The attack is...

CVE-2026-14622

CVE-2026-14622 affects the restaurant-website-php-mysql project (up to commit 521428b5b612449df0cf4a5d15ee40cba67f3d35). The vulnerability is in the /admin/ajax_files component of the AJAX Endpoint, whereby input manipulation leads to missing authentication. It is exploitable remotely, with a pub...

CVE-2026-14622: Missing Authentication for Critical Function

A vulnerability was found in jairiidriss restaurant-website-php-mysql up to 521428b5b612449df0cf4a5d15ee40cba67f3d35. This vulnerability affects unknown code of the file /admin/ajaxfiles of the component AJAX Endpoint. Performing a manipulation results in missing authentication. The attack is...

emlog 跨站请求伪造漏洞

Emlog is an open-source CMS website building system based on PHP and MySQL. Versions of Emlog prior to 2.6.11 contained a cross-site request forgeing vulnerability. This vulnerability stemmed from the lack of CSRF protection in critical management functions, which could allow attackers to trick...

CVE-2026-29861

PHP-MYSQL-User-Login-System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at login.php...

CVE-2026-29861: Improper Neutralization of Special Elements used in an SQL Command

PHP-MYSQL-User-Login-System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at login.php...

CVE-2026-29861

PHP-MYSQL-User-Login-System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at login.php...

CVE-2025-68614: Improper Neutralization of Input During Web Page Generation

LibreNMS is an auto-discovering PHP/MySQL/SNMP based network monitoring tool. Prior to version 25.12.0, the Alert Rule API is vulnerable to stored cross-site scripting. Alert rules can be created or updated via LibreNMS API. The alert rule name is not properly sanitized, and can be used to inject...

CVE-2025-63442: Improper Neutralization of Input During Web Page Generation

Simple User Management System with PHP-MySQL v1.0 is vulnerable to Cross-Site Scripting XSS via the Profile Section. The system fails to properly sanitize user input, allowing attackers to inject and execute arbitrary JavaScript when the input is displayed in the browser...

PT-2025-44771

Name of the Vulnerable Software and Affected Versions Simple User Management System with PHP-MySQL version 1.0 Description The Simple User Management System with PHP-MySQL fails to properly sanitize user input in the Profile Section, allowing attackers to inject and execute arbitrary JavaScript...

CVE-2025-63442

Simple User Management System with PHP-MySQL v1.0 is vulnerable to Cross-Site Scripting XSS via the Profile Section. The system fails to properly sanitize user input, allowing attackers to inject and execute arbitrary JavaScript when the input is displayed in the browser...

EUVD-2025-36057

A security flaw has been discovered in ajayrandhawa User-Management-PHP-MYSQL web up to fedcf58797bf2791591606f7b61fdad99ad8bff1. This vulnerability affects unknown code. Performing manipulation results in cross-site request forgery. The attack can be initiated remotely. The exploit has been...