CVE-2025-15077

CVE-2025-15077 affects itsourcecode Student Management System 1.0. The vulnerable element is the file /form137.php; manipulating the argument ID leads to a SQL injection. Exploitation can occur remotely (no authentication required) and public exploits have been disclosed. Multiple feeds (NVD, Red...

CVE-2025-15074

A vulnerability was identified in itsourcecode Online Frozen Foods Ordering System 1.0. This vulnerability affects unknown code of the file /customerdetails.php. Such manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be...

[SECURITY] Fedora 42 Update: roundcubemail-1.6.12-1.fc42

RoundCube Webmail is a browser-based multilingual IMAP client with an application-like user interface. It provides full functionality you expect from an e-mail client, including MIME support, address book, folder manipulation, message searching and spell checking. RoundCube Webmail is written in...

itsourcecode Student Management System SQL注入漏洞

itsourcecode Student Management System is an open source student management system from itsourcecode. A SQL injection vulnerability exists in version 1.0 of itsourcecode Student Management System, which stems from incorrect manipulation of the parameter ID in the file /form137.php, which could le...

Student File Management System /save_student.php File SQL Injection Vulnerability

Student File Management System is a student file management system. Student File Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter studentno in the file /admin/savestudent.php. An attacker...

Student File Management System stud_no Parameter SQL Injection Vulnerability

Student File Management System is a student file management system. Student File Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter studentno in the file loginquery.php. An attacker can...

CVE-2025-68563

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in WP Shuffle Subscribe to Unlock Lite subscribe-to-unlock-lite allows PHP Local File Inclusion.This issue affects Subscribe to Unlock Lite: from n/a through = 1.3.0...

CVE-2025-68038 WordPress Icegram Express Pro plugin < 5.9.14 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Icegram Icegram Express Pro email-subscribers-premium allows Object Injection.This issue affects Icegram Express Pro: from n/a through 5.9.14...

CVE-2025-68537 WordPress Zota theme <= 1.3.14 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in thembay Zota zota allows PHP Local File Inclusion.This issue affects Zota: from n/a through = 1.3.14...

CVE-2025-68537

CVE-2025-68537 is a WordPress theme vulnerability in Zota (Them ebeez theme family) where an authenticated attacker (Contributor+) can trigger Local File Inclusion via the Include/Require handling in PHP. Affected versions: Zota up to 1.3.14. The issue has a high impact profile (CVE‑2015‑68537, C...

Poultry-Farm-Management-System-v1.0-RCE-POC

Poultry Farm Management System v1.0 - RCE Exploit Vulnera...

CVE-2025-15034

A security flaw has been discovered in itsourcecode Student Management System 1.0. This affects an unknown part of the file /record.php. The manipulation of the argument ID results in sql injection. The attack can be executed remotely. The exploit has been released to the public and may be...

PT-2025-52866

Name of the Vulnerable Software and Affected Versions code-projects Student Information System version 1.0 Description A security issue exists in code-projects Student Information System 1.0. The issue involves cross site scripting, potentially allowing remote execution of malicious code...

PT-2025-53101

Name of the Vulnerable Software and Affected Versions WP Shuffle Subscribe to Unlock Lite versions through 1.3.0 Description The software contains a flaw related to improper control of filename for include/require statements, specifically a PHP Local File Inclusion issue. This allows for the...

PT-2025-53319

AVE DOMINAplus 1.10.x contains cross-site request forgery and cross-site scripting vulnerabilities that allow attackers to perform administrative actions without user consent. Attackers can craft malicious web pages to exploit login.php parameters and execute arbitrary scripts in user browser...

PT-2025-52867

Name of the Vulnerable Software and Affected Versions code-projects Student Information System version 1.0 Description A flaw exists in the processing of the /searchresults.php file within the software. Manipulation of the searchbox argument can lead to SQL injection. The attack can be performed...

📄 HP ProCurve SNAC Domain Controller Shell Upload

This proof of concept exploits a PHP code injection vulnerability in the HP ProCurve SNAC Domain Controller. ============================================================================================================================================= | Title : HP ProCurve SNAC Domain Controller P...

Linux Distros Unpatched Vulnerability : CVE-2025-67436

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Authenticated Remote Code Execution RCE in PluXml CMS 5.8.22 allows an attacker with administrator panel access to inject a malicious PHP webshell into a theme...

CVE-2023-53971

WebTareas 2.4 contains a file upload vulnerability that allows authenticated users to upload malicious PHP files through the chat photo upload functionality. Attackers can upload a PHP file with arbitrary code to the /files/Messages/ directory and execute it directly through the generated file pa...

CVE-2025-15049

A vulnerability was identified in code-projects Online Farm System 1.0. Affected is an unknown function of the file /addProduct.php. The manipulation of the argument Username leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used...