PT-2025-39817

Name of the Vulnerable Software and Affected Versions Perfex CRM version 3.2.1 Description An HTML injection issue exists in Perfex CRM version 3.2.1. This is due to insufficient validation of user-supplied data. An attacker can inject HTML code by sending a POST request to the /projects/project/...

CVE-2025-11119

A security flaw has been discovered in itsourcecode Hostel Management System 1.0. Impacted is an unknown function of the file /justines/index.php of the component POST Request Handler. Performing manipulation of the argument from results in cross site scripting. It is possible to initiate the...

CVE-2025-11119 itsourcecode Hostel Management System POST Request index.php cross site scripting

A security flaw has been discovered in itsourcecode Hostel Management System 1.0. Impacted is an unknown function of the file /justines/index.php of the component POST Request Handler. Performing manipulation of the argument from results in cross site scripting. It is possible to initiate the...

CVE-2025-11119

CVE-2025-11119 affects itsourcecode Hostel Management System 1.0. The POST Request Handler’s /justines/index.php handling exposes a cross-site scripting flaw due to improper parameter handling (e.g., the from/argument) in the POST path. Exploitation is remote, and public proof-of-concept exploits...

CVE-2025-11119 itsourcecode Hostel Management System POST Request index.php cross site scripting

A security flaw has been discovered in itsourcecode Hostel Management System 1.0. Impacted is an unknown function of the file /justines/index.php of the component POST Request Handler. Performing manipulation of the argument from results in cross site scripting. It is possible to initiate the...

CVE-2025-11073

CVE-2025-11073 affects Keyfactor RG-EW5100BE EW_3.0B11P280_EW5100BE-PRO_12183019: the HTTP POST Request Handler in /cgi-bin/luci/api/cmd has an argument url that can be manipulated to trigger command injection. The vulnerability is remote and the exploit is public. Connected records consistently ...

CVE-2025-11073 Keyfactor RG-EW5100BE HTTP POST Request cmd command injection

A vulnerability was detected in Keyfactor RG-EW5100BE EW3.0B11P280EW5100BE-PRO12183019. The affected element is an unknown function of the file /cgi-bin/luci/api/cmd of the component HTTP POST Request Handler. The manipulation of the argument url results in command injection. The attack can be...

CVE-2025-45994

An issue in Aranda PassRecovery v1.0 allows attackers to enumerate valid user accounts in Active Directory via sending a crafted POST request to /user/existdirectory/1...

CVE-2025-45994

CVE-2025-45994 affects Aranda PassRecovery v1.0. The vulnerability is an unauthenticated POST to /user/existdirectory/1 that enables enumeration of valid Active Directory user accounts. This is documented across multiple sources as an information-disclosure issue with potential impact on account ...

CVE-2025-45994

An issue in Aranda PassRecovery v1.0 allows attackers to enumerate valid user accounts in Active Directory via sending a crafted POST request to /user/existdirectory/1...

CVE-2025-40698

SQL injection vulnerability in Prevengos v2.44 by Nedatec Consulting. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a POST request using the parameters “mpsCentroin”, “mpsEmpresa”, “mpsProyecto”, and “mpsContrata” in...

CVE-2025-40698 SQL injection vulnerability in Prevengos

SQL injection vulnerability in Prevengos v2.44 by Nedatec Consulting. This vulnerability allows an attacker to retrieve, create, update, and delete databases by sending a POST request using the parameters “mpsCentroin”, “mpsEmpresa”, “mpsProyecto”, and “mpsContrata” in...

CVE-2025-56241

Aztech DSL5005EN firmware 1.00.AZ2013-05-10 and possibly other versions allows unauthenticated attackers to change the administrator password via a crafted POST request to sysAccess.asp. This allows full administrative control of the router without authentication...

PT-2025-39362

Name of the Vulnerable Software and Affected Versions Prevengos version 2.44 Description A SQL injection issue exists in Prevengos version 2.44 by Nedatec Consulting. This allows an attacker to retrieve, create, update, and delete databases. The issue is triggered by sending a POST request to the...

Park Ticketing Management System foreigner-bwdates-reports-details.php file SQL injection vulnerability

Park Ticketing Management System is a park ticketing management system. Park Ticketing Management System suffers from a SQL injection vulnerability that stems from a lack of validation of the fromdate parameter in the file foreigner-bwdates-reports-details.php against an externally entered SQL...

CVE-2025-10815

A vulnerability was identified in Tenda AC20 up to 16.03.08.12. Affected by this issue is the function strcpy of the file /goform/SetPptpServerCfg of the component HTTP POST Request Handler. Such manipulation of the argument startIp leads to buffer overflow. The attack can be launched remotely. T...

CVE-2025-56241

Aztech DSL5005EN firmware 1.00.AZ2013-05-10 and possibly other versions allows unauthenticated attackers to change the administrator password via a crafted POST request to sysAccess.asp. This allows full administrative control of the router without authentication...

CVE-2025-56074

A SQL Injection vulnerability was discovered in the foreigner-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows remote attackers to execute arbitrary SQL code via the fromdate parameter in a POST request...

CVE-2025-56075

A SQL Injection vulnerability was discovered in the normal-bwdates-reports-details.php file of PHPGurukul Park Ticketing Management System v2.0. This vulnerability allows remote attackers to execute arbitrary SQL code via the fromdate parameter in a POST request...

Aztech DSL5005EN 安全漏洞

The Aztech DSL5005EN is a wireless router from Aztech. A security vulnerability exists in the Aztech DSL5005EN version 1.00.AZ2013-05-10, which originates from an unauthenticated attacker being able to change the administrator password via a specially crafted POST request, which could result in...