CVE-2025-11630 RainyGao DocSys File Upload uploadDoc.do updateRealDoc path traversal

A vulnerability was found in RainyGao DocSys up to 2.02.36. Affected is the function updateRealDoc of the file /Doc/uploadDoc.do of the component File Upload. Performing manipulation of the argument path results in path traversal. The attack can be initiated remotely. The exploit has been made...

CVE-2025-11630

RainyGao DocSys (versions up to 2.02.36) is affected by a path traversal in the File Upload component. The vulnerability is in the function updateRealDoc within /Doc/uploadDoc.do, triggered by manipulating the path parameter. It is remotely exploitable and the exploit is public. Several sources c...

CVE-2025-11592

A vulnerability was detected in CodeAstro Gym Management System 1.0. This affects an unknown part of the file /admin/edit-equipmentform.php. The manipulation of the argument ID results in sql injection. The attack can be launched remotely. The exploit is now public and may be used...

EUVD-2025-33877

A security flaw has been discovered in SourceCodester Best Salon Management System 1.0. This affects an unknown part of the file /panel/addinvoice.php. Performing manipulation of the argument ServiceId results in sql injection. Remote exploitation of the attack is possible. The exploit has been...

PT-2025-41732

Name of the Vulnerable Software and Affected Versions Tomofun Furbo 360 versions prior to FB0035 FW 036 Tomofun Furbo Mini versions prior to MC0020 FW 074 Description A weakness exists in the UART Interface component of Tomofun Furbo 360 and Furbo Mini. Manipulation of this component can result i...

PT-2025-41733

Name of the Vulnerable Software and Affected Versions Tomofun Furbo Mobile App versions through 7.57.0a Description A security issue has been identified in the Authentication Token Handler component of the Tomofun Furbo Mobile App on Android. The vulnerability involves insecure storage of sensiti...

PT-2025-41734

Name of the Vulnerable Software and Affected Versions Tomofun Furbo 360 versions prior to FB0035 FW 036 Tomofun Furbo Mini versions prior to MC0020 FW 074 Description A flaw exists in Tomofun Furbo 360 and Furbo Mini due to improper access controls within the GATT Service component. This issue ca...

PT-2025-41710

Name of the Vulnerable Software and Affected Versions RainyGao DocSys versions up to 2.02.36 Description A flaw exists in the File Upload component of RainyGao DocSys. The updateRealDoc function within the /Doc/uploadDoc.do file is susceptible to path traversal due to manipulation of the path...

PT-2025-41738

Name of the Vulnerable Software and Affected Versions Tomofun Furbo 360 versions prior to FB0035 FW 036 Tomofun Furbo Mini versions prior to MC0020 FW 074 Description A weakness exists in Tomofun Furbo 360 and Furbo Mini related to password handling. Manipulation of the /etc/shadow file, through ...

CVE-2025-11589

A security flaw has been discovered in CodeAstro Gym Management System 1.0. Affected is an unknown function of the file /admin/user-payment.php. Performing a manipulation of the argument plan results in sql injection. It is possible to initiate the attack remotely. The exploit has been released t...

CVE-2025-11615

The CVE-2025-11615 entries describe a SQL injection flaw in SourceCodester Best Salon Management System 1.0, specifically in /panel/add_invoice.php where manipulating the ServiceId parameter enables remote code execution. The vulnerability is exploitable remotely and exploits have been released p...

EUVD-2025-33874

A vulnerability was found in code-projects Simple Food Ordering System 1.0. Affected is an unknown function of the file /addcategory.php. The manipulation of the argument cname results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used...

CVE-2025-11614 SourceCodester Best Salon Management System edit-appointment.php sql injection

A vulnerability was identified in SourceCodester Best Salon Management System 1.0. Affected by this issue is some unknown functionality of the file /panel/edit-appointment.php. Such manipulation of the argument editid leads to sql injection. The attack may be launched remotely. The exploit is...

CVE-2025-11614

SourceCodester Best Salon Management System 1.0 is affected by an SQL injection in /panel/edit-appointment.php via the editid parameter. The issue is exploitable remotely and is supported by publicly available exploits; multiple sources confirm impact on confidentiality, integrity, and availabili...

CVE-2025-11582

A vulnerability was detected in code-projects Online Job Search Engine 1.0. This issue affects some unknown processing of the file /registration.php. Performing manipulation of the argument txtusername results in sql injection. The attack may be initiated remotely. The exploit is now public and m...

CVE-2025-11611

A weakness has been identified in SourceCodester Simple Inventory System 1.0. Impacted is an unknown function of the file /user.php. This manipulation of the argument uemail causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public...

CVE-2025-11611

CVE-2025-11611 affects SourceCodester Simple Inventory System 1.0, with the vulnerability located in an unknown function of /user.php where manipulation of the uemail parameter yields SQL injection. The flaw is exploitable remotely and exploits have been publicly released. Multiple sources (NVD, ...

CVE-2025-11611 SourceCodester Simple Inventory System user.php sql injection

A weakness has been identified in SourceCodester Simple Inventory System 1.0. Impacted is an unknown function of the file /user.php. This manipulation of the argument uemail causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public...

EUVD-2025-33868

A weakness has been identified in harry0703 MoneyPrinterTurbo up to 1.2.6. The impacted element is the function uploadmusic of the file app/controllers/v1/music.py of the component API Endpoint. Executing manipulation of the argument File can lead to path traversal. The attack may be performed fr...

CVE-2025-11580

A weakness has been identified in PowerJob up to 5.1.2. This affects the function list of the file /user/list. This manipulation causes missing authorization. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks...