CVE-2025-13172

A security flaw has been discovered in CodeAstro Gym Management System 1.0. Affected is an unknown function of the file /admin/view-member-report.php. Performing a manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit has been released to the...

CVE-2025-13170

A vulnerability was detected in code-projects Simple Online Hotel Reservation System 1.0. This issue affects some unknown processing of the file /admin/editaccount.php. Performing a manipulation of the argument adminid results in sql injection. The attack is possible to be carried out remotely. T...

CVE-2025-13118

A vulnerability was detected in macrozheng mall-swarm up to 1.0.3. Affected by this issue is the function paySuccess of the file /order/paySuccess. The manipulation of the argument orderID results in improper authorization. The attack can be launched remotely. The exploit is now public and may be...

CVE-2025-13115

A security flaw has been discovered in macrozheng mall-swarm and mall up to 1.0.3. This impacts the function detail of the file /order/detail/ of the component Order Details Handler. Performing manipulation of the argument orderId results in improper authorization. It is possible to initiate the...

PT-2025-46997

Name of the Vulnerable Software and Affected Versions Bdtask/CodeCanyon SalesERP versions up to 20250728 Description A cross-site request forgery condition exists in Bdtask/CodeCanyon SalesERP. The issue affects an unspecified component and allows for remote manipulation. The exploit is publicly...

PT-2025-46957

Name of the Vulnerable Software and Affected Versions ury-erp ury versions up to 0.2.0 Description A weakness exists in ury-erp ury that allows for SQL injection. This issue is related to the manipulation of the search term argument within the overrided past order list function located in the fil...

PT-2025-46996

Name of the Vulnerable Software and Affected Versions rachelos WeRSS we-mp-rss versions up to 1.4.7 Description A flaw exists in the Webhook Module of rachelos WeRSS we-mp-rss. The do job function within the /rachelos/we-mp-rss/blob/main/jobs/mps.py file is susceptible to server-side request...

PT-2025-46977

Name of the Vulnerable Software and Affected Versions ZZCMS version 2023 Description A flaw exists in ZZCMS 2023 that allows for SQL injection. This occurs through manipulation of the keyword argument in the file '/admin/wangkan list.php'. The attack can be initiated remotely. The exploit is...

PT-2025-47010

Name of the Vulnerable Software and Affected Versions Bdtask/CodeCanyon News365 versions up to 7.0.3 Description A security flaw exists in Bdtask/CodeCanyon News365. The issue involves unrestricted file upload due to manipulation of the profile image/banner image argument within a function in the...

PT-2025-47001

Name of the Vulnerable Software and Affected Versions Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System versions up to 20250320 Description A cross-site request forgery issue exists in Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System. The...

PT-2025-46972

Name of the Vulnerable Software and Affected Versions Simple Online Hotel Reservation System version 1.0 Description A flaw exists in the processing of the /admin/edit account.php file within the software. Manipulation of the admin id argument can lead to SQL injection. This issue is potentially...

PT-2025-47003

Name of the Vulnerable Software and Affected Versions pojoin h3blog version 1.0 Description A flaw exists in pojoin h3blog version 1.0 where manipulation of the Name argument in an unknown function within the file '/admin/cms/material/add' can lead to cross site scripting. This issue is potential...

CVE-2025-13059

A weakness has been identified in SourceCodester Alumni Management System 1.0. The impacted element is an unknown function of the file /managecareer.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available t...

CVE-2025-13057

A vulnerability was identified in Campcodes School Fees Payment Management System 1.0. Impacted is an unknown function of the file /ajax.php?action=savestudent. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and...

CVE-2025-13122

A vulnerability was detected in SourceCodester Patients Waiting Area Queue Management System 1.0. The affected element is the function getPatientAppointment of the file /php/apipatientcheckin.php. Performing manipulation of the argument appointmentID results in sql injection. It is possible to...

EUVD-2025-175322

A weakness has been identified in macrozheng mall-swarm up to 1.0.3. Affected is the function cancelUserOrder of the file /order/cancelUserOrder. Executing manipulation of the argument orderId can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been...

EUVD-2025-169289

A vulnerability was identified in macrozheng mall-swarm up to 1.0.3. This affects the function updateAttr of the file /cart/update/attr. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was...

CVE-2025-13114

A vulnerability was identified in macrozheng mall-swarm up to 1.0.3. This affects the function updateAttr of the file /cart/update/attr. Such manipulation leads to improper authorization. The attack may be performed from remote. The exploit is publicly available and might be used. The vendor was...

CVE-2025-13116

CVE-2025-13116 affects macrozheng mall-swarm and mall up to 1.0.3. The issue is in the function cancelUserOrder in /order/cancelUserOrder, where manipulating the argument orderId can cause improper authorization. Attacks are described as remotely executable and a public exploit exists. Multiple c...

CVE-2025-13116 macrozheng mall-swarm/mall cancelUserOrder improper authorization

A weakness has been identified in macrozheng mall-swarm and mall up to 1.0.3. Affected is the function cancelUserOrder of the file /order/cancelUserOrder. Executing manipulation of the argument orderId can lead to improper authorization. It is possible to launch the attack remotely. The exploit h...