CVE-2025-10423

Affected: newbee-mall 1.0. Vulnerable component: mallKaptcha in /common/mall/kaptcha where the CAPTCHA generation is prone to being guessable. Impact: remote attacker can exploit to bypass CAPTCHA; attack complexity is high and authentication is not required. Exploitability: publicly disclosed Po...

CVE-2025-10340

A vulnerability was determined in WhatCD Gazelle up to 63b337026d49b5cf63ce4be20fdabdc880112fa3. The affected element is an unknown function of the file /sections/tools/managers/changelog.php of the component Commit Message Handler. Executing manipulation of the argument Message can lead to cross...

CVE-2025-10420

A vulnerability was detected in SourceCodester Student Grading System 1.0. This affects an unknown part of the file /form137.php. Performing manipulation of the argument ID results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used...

CVE-2025-10418

A weakness has been identified in SourceCodester Student Grading System 1.0. Affected by this vulnerability is an unknown functionality of the file /viewstudents.php. This manipulation of the argument ID causes sql injection. The attack can be initiated remotely. The exploit has been made availab...

CVE-2025-10416

A vulnerability was identified in Campcodes Grocery Sales and Inventory System 1.0. This impacts an unknown function of the file /ajax.php?action=deletesupplier. The manipulation of the argument ID leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly...

PT-2025-37460

Name of the Vulnerable Software and Affected Versions: IbuyuCMS versions up to 2.6.3 Description: A vulnerability exists in IbuyuCMS that allows for cross site scripting. The issue is located in the Add Article Page component, specifically within the file /admin/article.php?a=mod. Manipulation of...

PT-2025-37472

Name of the Vulnerable Software and Affected Versions: Tenda AC9 version 15.03.05.14 Tenda AC9 version 15.03.05.18 Tenda AC15 version 15.03.05.14 Tenda AC15 version 15.03.05.18 Description: A vulnerability exists in Tenda AC9 and AC15 devices. The vulnerability affects the formexeCommand function...

PT-2025-37759

Name of the Vulnerable Software and Affected Versions: kidaze CourseSelectionSystem affected versions not specified Description: A vulnerability exists in kidaze CourseSelectionSystem related to SQL injection. Manipulation of the Branch argument in an unknown function within the...

PT-2025-37443

Name of the Vulnerable Software and Affected Versions: newbee-mall versions prior to 613a662adf1da7623ec34459bc83e3c1b12d8ce7 Description: A vulnerability exists in newbee-mall related to improper authorization. The issue affects the paySuccess function within the /paySuccess file of the Order...

PT-2025-37458

Name of the Vulnerable Software and Affected Versions: 1Panel-dev MaxKB versions up to 2.0.2 and 2.1.0 Description: A vulnerability exists in 1Panel-dev MaxKB due to improper processing of files. Specifically, the file /admin/api/workspace/default/tool/debug is susceptible to manipulation of the...

PT-2025-37438

Name of the Vulnerable Software and Affected Versions: SourceCodester Student Grading System version 1.0 Description: A SQL injection weakness exists in the /view students.php file of the application. Manipulation of the ID argument can trigger the injection. This issue can be exploited remotely...

PT-2025-37446

Name of the Vulnerable Software and Affected Versions: newbee-mall version 1.0 Description: A flaw exists within the mallKaptcha function located in the /common/mall/kaptcha file, leading to the generation of guessable CAPTCHAs. This issue can be exploited remotely and is considered difficult to...

PT-2025-37765

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Student File Management System version 1.0 Description: A weakness exists in SourceCodester Online Student File Management System 1.0 related to unrestricted file upload through manipulation of the /save file.php file an...

PT-2025-37478

Name of the Vulnerable Software and Affected Versions: Campcodes Computer Sales and Inventory System version 1.0 Description: A weakness has been identified in Campcodes Computer Sales and Inventory System 1.0. Manipulation of the Username argument in the file /pages/us transac.php?action=add can...

PT-2025-37776

Name of the Vulnerable Software and Affected Versions: pojoin h3blog versions prior to 5bf704425ebc11f4c24da51f32f36bb17ae20489 Description: A vulnerability exists due to cross site scripting. Manipulation of the X-Forwarded-For argument in the /login file, specifically within the ppt log functio...

PT-2025-37441

Name of the Vulnerable Software and Affected Versions: SourceCodester Student Grading System version 1.0 Description: A SQL injection issue exists in SourceCodester Student Grading System 1.0. The issue affects an unknown part of the file /form137.php. Manipulation of the ID parameter can lead to...

PT-2025-37462

Name of the Vulnerable Software and Affected Versions: Campcodes Computer Sales and Inventory System version 1.0 Description: A weakness exists in Campcodes Computer Sales and Inventory System that allows for SQL injection. The issue is located in an unknown function of the file /pages/sup...

PT-2025-37463

Name of the Vulnerable Software and Affected Versions: D-Link DI-8100 versions 16.07.26A1, 17.12.20A1, and 19.12.10A1 D-Link DI-8100G versions 16.07.26A1, 17.12.20A1, and 19.12.10A1 D-Link DI-8200 versions 16.07.26A1, 17.12.20A1, and 19.12.10A1 D-Link DI-8200G versions 16.07.26A1, 17.12.20A1, and...

PT-2025-37773

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Student File Management System version 1.0 Description: A SQL injection issue exists in SourceCodester Online Student File Management System version 1.0. The issue is located in the /admin/index.php file, within an unkno...

CVE-2025-10414

A vulnerability was found in Campcodes Grocery Sales and Inventory System 1.0. The impacted element is an unknown function of the file /ajax.php?action=savecustomer. Performing manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit...