PT-2025-38720

Name of the Vulnerable Software and Affected Versions PHPGurukul Park Ticketing Management System version 2.0 Description A SQL Injection issue exists in the normal-bwdates-reports-details.php file. This allows remote attackers to execute arbitrary SQL code by manipulating the fromdate parameter...

PT-2025-38719

Name of the Vulnerable Software and Affected Versions PHPGurukul Park Ticketing Management System version 2.0 Description A SQL Injection issue exists in the foreigner-bwdates-reports-details.php file. This allows remote attackers to execute arbitrary SQL code through the fromdate parameter in a...

PT-2025-39077

Name of the Vulnerable Software and Affected Versions Stocky POS with Inventory Management & HRM ui-lib version 5.0 Description Stocky POS with Inventory Management & HRM ui-lib version 5.0 is affected by a Stored Cross-Site Scripting XSS issue within the Products module, accessible to...

The vulnerability of the strcpy() function in D-Link DCS-935L wireless HD cameras’ microprogramming software allows a intruder to execute arbitrary code.

The vulnerability of the strcpy function in D-Link DCS-935L wireless HD cameras’ microprogramming software lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending a specially crafted POST...

CVE-2025-56075

A SQL Injection vulnerability was discovered in the normal-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows remote attackers to execute arbitrary SQL code via the fromdate parameter in a POST request...

PHPGurukul Park Ticketing Management System 安全漏洞

Park Ticketing Management System is a park ticketing management system. Park Ticketing Management System suffers from a SQL injection vulnerability that stems from a lack of validation of the fromdate parameter in the file foreigner-bwdates-reports-details.php against an externally entered SQL...

CVE-2025-57296

Tenda AC6 router firmware 15.03.05.19 contains a command injection vulnerability in the formSetIptv function, which processes requests to the /goform/SetIPTVCfg web interface. When handling the list and vlanId parameters, the subADBC0 helper function concatenates these user-supplied values into...

CVE-2025-40677

SQL injection vulnerability in Summar Software´s Portal del Empleado. This vulnerability allows an attacker to retrieve, create, update, and delete the database by sending a POST request using the parameter “ctl00$ContentPlaceHolder1$filtroNombre” in “/MemberPages/quienesquien.aspx”...

CVE-2025-57293

A command injection vulnerability in COMFAST CF-XR11 firmware V2.7.2 exists in the multipppoe API, processed by the sub423930 function in /usr/bin/webmgnt. The phyinterface parameter is not sanitized, allowing attackers to inject arbitrary commands via a POST request to...

CVE-2025-40678

CVE-2025-40678 affects Summar Software’s Portal del Empleado. Connected sources provide concrete details: an unrestricted upload vulnerability allows uploading dangerous file types via a POST to /MemberPages/ntf_absentismo.aspx using the parameter cctl00$ContentPlaceHolder1$fuAdjunto. This is a f...

CVE-2025-40677 SQL injection vulnerability in Summar Software´s Portal del Empleado

SQL injection vulnerability in Summar Software´s Portal del Empleado. This vulnerability allows an attacker to retrieve, create, update, and delete the database by sending a POST request using the parameter “ctl00$ContentPlaceHolder1$filtroNombre” in “/MemberPages/quienesquien.aspx”...

CVE-2025-40677

CVE-2025-40677 describes an SQL injection in Summar Software’s Portal del Empleado. The vulnerability is triggered by a POST request to /MemberPages/quienesquien.aspx that supplies the parameter ctl00$ContentPlaceHolder1$filtroNombre, allowing an attacker to retrieve, create, update, and delete d...

PT-2025-38314

Name of the Vulnerable Software and Affected Versions Summar Software Portal del Empleado affected versions not specified Description A file upload issue exists in Summar Software’s Portal del Empleado, allowing the upload of dangerous file types. An attacker can exploit this by sending a POST...

CVE-2025-59416 The Scratch Channel forks can publish articles

The Scratch Channel is a news website. If the user makes a fork, they can change the admins and make an article. Since the API uses a POST request, it will make an article. This issue is fixed in v1.2...

CVE-2025-59416

CVE-2025-59416 affects The Scratch Channel web application. The vulnerability arises from the API’s POST handling, which can be abused by a user with fork privileges to alter administrators and publish articles without proper permission checks. This could allow arbitrary article creation and admi...

CVE-2025-59416 The Scratch Channel forks can publish articles

The Scratch Channel is a news website. If the user makes a fork, they can change the admins and make an article. Since the API uses a POST request, it will make an article. This issue is fixed in v1.2...

The Scratch Channel 安全漏洞

The Scratch Channel is a project site of The Scratch Channel open source. A security vulnerability exists in versions of The Scratch Channel prior to 1.2, which stems from the API's failure to validate user permissions when using a POST request, which could lead to arbitrary article creation and...

CVE-2025-10411

A vulnerability was detected in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0. This issue affects some unknown processing of the file /stc-log-keeper/checkprofile.php of the component POST Request Handler. The manipulation of the argument profileid results in cross site...

CVE-2025-10411

A vulnerability was detected in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0. This issue affects some unknown processing of the file /stc-log-keeper/checkprofile.php of the component POST Request Handler. The manipulation of the argument profileid results in cross site...

CVE-2025-10386 Yida ECMS Consulting Enterprise Management System POST Request login.do cross site scripting

A vulnerability was found in Yida ECMS Consulting Enterprise Management System 1.0. This affects an unknown part of the file /login.do of the component POST Request Handler. The manipulation of the argument requestUrl results in cross site scripting. It is possible to launch the attack remotely...