GHSA-5JPG-2RJ5-964C lsFusion Platform has a Path Traversal vulnerability

A vulnerability was found in lsfusion platform up to 6.1. Affected is the function DownloadFileRequestHandler of the file web-client/src/main/java/lsfusion/http/controller/file/DownloadFileRequestHandler.java. Performing manipulation of the argument Version results in path traversal. Remote...

lsFusion Platform has a Path Traversal vulnerability

A vulnerability was found in lsfusion platform up to 6.1. Affected is the function DownloadFileRequestHandler of the file web-client/src/main/java/lsfusion/http/controller/file/DownloadFileRequestHandler.java. Performing manipulation of the argument Version results in path traversal. Remote...

CVE-2025-13264

A security flaw has been discovered in SourceCodester Online Magazine Management System 1.0. This affects an unknown part of the file /viewmagazine.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been released to the publ...

EUVD-2025-197754

A security flaw has been discovered in SourceCodester Online Magazine Management System 1.0. This affects an unknown part of the file /viewmagazine.php. The manipulation of the argument ID results in sql injection. The attack may be performed from remote. The exploit has been released to the publ...

CVE-2025-13263 SourceCodester Online Magazine Management System categories.php sql injection

A vulnerability was identified in SourceCodester Online Magazine Management System 1.0. Affected by this issue is some unknown functionality of the file /categories.php. The manipulation of the argument c leads to sql injection. The attack is possible to be carried out remotely. The exploit is...

EUVD-2025-197755

A vulnerability was identified in SourceCodester Online Magazine Management System 1.0. Affected by this issue is some unknown functionality of the file /categories.php. The manipulation of the argument c leads to sql injection. The attack is possible to be carried out remotely. The exploit is...

CVE-2025-13263

SourceCodester Online Magazine Management System 1.0 contains a SQL injection in /categories.php via the c parameter. The issue is remote and publicly exploitable, with PoC-style exploit references present in the CVE metadata. The vulnerability affects unknown functionality in categories.php, and...

CVE-2025-13234

A vulnerability was found in itsourcecode Inventory Management System 1.0. The impacted element is an unknown function of the file /index.php?q=product. Performing manipulation of the argument PROID results in sql injection. It is possible to initiate the attack remotely. The exploit has been mad...

CVE-2025-13236

A vulnerability was identified in itsourcecode Inventory Management System 1.0. This impacts an unknown function of the file /admin/products/index.php?view=edit. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit is publicly available and...

CVE-2025-13262

Summary (CVE-2025-13262): lsFusion Platform up to 6.1 is affected. The vulnerability lies in the UploadFileRequestHandler (file/UploadFileRequestHandler.java), where manipulation of the sid argument can cause path traversal. It is exploitable remotely, and public disclosures of exploits exist. Se...

CVE-2025-13261 lsfusion platform DownloadFileRequestHandler.java DownloadFileRequestHandler path traversal

A vulnerability was found in lsfusion platform up to 6.1. Affected is the function DownloadFileRequestHandler of the file web-client/src/main/java/lsfusion/http/controller/file/DownloadFileRequestHandler.java. Performing manipulation of the argument Version results in path traversal. Remote...

CVE-2025-13261 lsfusion platform DownloadFileRequestHandler.java DownloadFileRequestHandler path traversal

A vulnerability was found in lsfusion platform up to 6.1. Affected is the function DownloadFileRequestHandler of the file web-client/src/main/java/lsfusion/http/controller/file/DownloadFileRequestHandler.java. Performing manipulation of the argument Version results in path traversal. Remote...

EUVD-2025-197758

A vulnerability was found in lsfusion platform up to 6.1. Affected is the function DownloadFileRequestHandler of the file web-client/src/main/java/lsfusion/http/controller/file/DownloadFileRequestHandler.java. Performing manipulation of the argument Version results in path traversal. Remote...

EUVD-2025-197736

A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /borrow.php. Executing manipulation of the argument rollnumber can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made...

EUVD-2025-197738

A vulnerability was identified in projectworlds Advanced Library Management System 1.0. This vulnerability affects unknown code of the file /addmember.php. Such manipulation of the argument rollnumber leads to sql injection. The attack may be performed from remote. The exploit is publicly availab...

CVE-2025-13258

A vulnerability was detected in Tenda AC20 up to 16.03.08.12. The impacted element is an unknown function of the file /goform/WifiExtraSet. The manipulation of the argument wpapskcrypto results in buffer overflow. The attack can be launched remotely. The exploit is now public and may be used...

CVE-2025-13257

CVE-2025-13257 affects itsourcecode Inventory Management System 1.0, with the vulnerable element in /admin/user/index.php?view=edit. The issue is an SQL injection caused by manipulation of the ID parameter, exploitable remotely. Public exploits have been disclosed. Documented impact indicates hig...

CVE-2025-13254

A vulnerability was identified in projectworlds Advanced Library Management System 1.0. This vulnerability affects unknown code of the file /addmember.php. Such manipulation of the argument rollnumber leads to sql injection. The attack may be performed from remote. The exploit is publicly availab...

CVE-2025-13256

CVE-2025-13256 affects projectworlds Advanced Library Management System 1.0. The vulnerability is in an unknown function of /borrow.php where manipulating the argument roll_number can cause SQL injection. The flaw can be exploited remotely, and public exploits are available. The connected documen...

CVE-2025-13256 projectworlds Advanced Library Management System borrow.php sql injection

A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /borrow.php. Executing a manipulation of the argument rollnumber can lead to sql injection. It is possible to launch the attack remotely. The exploit has been made...