EUVD-2025-28878

Malicious code in bioql PyPI...

EUVD-2025-22806

Malicious code in bioql PyPI...

PT-2025-37357

Name of the Vulnerable Software and Affected Versions: cdevroe unmark versions up to 1.9.3 Description: A flaw has been found in cdevroe unmark. This issue affects unknown code within the application/views/layouts/topbar/searchform.php file. Manipulation of the q parameter can lead to cross-site...

CVE-2025-40725 Reflected Cross-Site Scripting (XSS) in Azon Dominator

Reflected Cross-Site Scripting XSS vulnerability in Azon Dominator. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL using the “q” parameter in /search via GET. This vulnerability can be exploited to steal sensitive user data...

CVE-2025-40725 Reflected Cross-Site Scripting (XSS) in Azon Dominator

Reflected Cross-Site Scripting XSS vulnerability in Azon Dominator. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL using the “q” parameter in /search via GET. This vulnerability can be exploited to steal sensitive user data...

CVE-2025-40725: Improper Neutralization of Input During Web Page Generation

Reflected Cross-Site Scripting XSS vulnerability in Azon Dominator. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL using the “q” parameter in /search via GET. This vulnerability can be exploited to steal sensitive user data...

PT-2025-37012

Name of the Vulnerable Software and Affected Versions: Azon Dominator affected versions not specified Description: A reflected Cross-Site Scripting XSS vulnerability exists in Azon Dominator. An attacker can execute JavaScript code in a victim’s browser by sending a malicious URL containing...

CVE-2025-40642 Reflected Cross-Site Scripting (XSS) in WebWork

Reflected Cross-Site Scripting XSS vulnerability in WebWork, which allows remote attackers to execute arbitrary code through the 'q' and 'engine' request parameters in /search...

CVE-2025-40642: Improper Neutralization of Input During Web Page Generation

Reflected Cross-Site Scripting XSS vulnerability in WebWork, which allows remote attackers to execute arbitrary code through the 'q' and 'engine' request parameters in /search...

Codester WebWork - PHP Search Engine Script 跨站脚本漏洞

Codester WebWork - PHP Search Engine Script is an open source search engine script from Codester. A cross-site scripting vulnerability exists in Codester WebWork - PHP Search Engine Script, which stems from the fact that incorrect manipulation of the parameters q and engine can lead to reflective...

CVE-2025-50985

diskover-web v2.3.0 Community Edition is vulnerable to multiple reflected cross-site scripting XSS flaws in its web interface. Unsanitized GET parameters including maxage, maxindex, index, path, q query, and doctype are directly echoed into the HTML response, allowing attackers to inject and...

CVE-2025-9689

A vulnerability was detected in SourceCodester Advanced School Management System 1.0. The impacted element is an unknown function of the file /index.php/stock/itemselect. The manipulation of the argument q results in sql injection. It is possible to launch the attack remotely. The exploit is now...

CVE-2025-9689 SourceCodester Advanced School Management System item_select sql injection

A vulnerability was detected in SourceCodester Advanced School Management System 1.0. The impacted element is an unknown function of the file /index.php/stock/itemselect. The manipulation of the argument q results in sql injection. It is possible to launch the attack remotely. The exploit is now...

CVE-2025-40730: Improper Neutralization of Input During Web Page Generation

HTML injection in Vox Media's Chorus CMS. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending them a malicious URL using the 'q' parameter in '/search'. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to...

CVE-2025-54597: Improper Neutralization of Input During Web Page Generation

LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter...

CVE-2025-54597

LinuxServer.io Heimdall before 2.7.3 allows XSS via the q parameter...

CVE-2025-54597

CVE-2025-54597 affects LinuxServer.io Heimdall prior to 2.7.3. A cross-site scripting (XSS) vulnerability is triggered via the query parameter q in the web UI, due to an uncleared input. Impact is described as XSS with potential user impact on affected deployments; exploitation details are not pr...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure via the q URL parameter in the /api/v2.0/users endpoint. An attacker can retrieve sensitive password hash and salt values by abusing the filtering capability to extract this information character by character. Note:...

COVID19 Testing Management System Input Validation Error Vulnerability

The COVID19 Testing Management System is a new crown pneumonia testing management system. The COVID19 Testing Management System has an input validation error vulnerability that originates from an open redirect due to the operation of the parameter q in the file /search-report-result.php. No detai...

PHPGurukul COVID19 Testing Management System 输入验证错误漏洞

The COVID19 Testing Management System is a new crown pneumonia testing management system. The COVID19 Testing Management System has an input validation error vulnerability that originates from an open redirect due to the operation of the parameter q in the file /search-report-result.php. No detai...