CVE-2025-9099

The CVE-2025-9099 entry concerns Acrel Environmental Monitoring Cloud Platform up to 20250804. The vulnerability resides in the NewsManage/UploadNewsImg interface, where manipulating the File parameter enables unrestricted file uploads and remote exploitation. Public disclosure of the exploit is ...

GHSA-Q4RG-7CJJ-5R86 ExpressGateway Cross-Site Scripting Vulnerability in lib/rest/routes/users.js

A cross-site scripting XSS issue exists in ExpressGateway up to 1.16.10 in the REST endpoint implemented in lib/rest/routes/users.js. User-controlled input is reflected into the HTTP response without proper sanitization, allowing arbitrary JavaScript execution in the browser of a logged-in user w...

CVE-2025-9046

A vulnerability was identified in Tenda AC20 16.03.08.12. This issue affects the function sub46A2AC of the file /goform/setMacFilterCfg. The manipulation of the argument deviceList leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the...

CVE-2025-9089

A vulnerability was determined in Tenda AC20 16.03.08.12. This issue affects the function sub48E628 of the file /goform/SetIpMacBind. The manipulation of the argument list leads to stack-based buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and...

CVE-2025-8981

A vulnerability was found in itsourcecode Online Tour and Travel Management System 1.0. This affects an unknown part of the file /admin/operations/payment.php. The manipulation of the argument paymenttype leads to sql injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-8953

A vulnerability was determined in SourceCodester COVID 19 Testing Management System 1.0. Affected by this issue is some unknown functionality of the file /checkavailability.php. The manipulation of the argument employeeid leads to sql injection. The attack may be launched remotely. The exploit ha...

CVE-2025-8930

A vulnerability was found in code-projects Medical Store Management System 1.0. This issue affects some unknown processing of the file UpdateCompany.java of the component Update Company Page. The manipulation of the argument companyNameTxt leads to sql injection. The attack may be initiated...

CVE-2025-9051 projectworlds Travel Management System updatecategory.php sql injection

A vulnerability was determined in projectworlds Travel Management System 1.0. Affected by this issue is some unknown functionality of the file /updatecategory.php. The manipulation of the argument t1 leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to th...

CVE-2025-9005 mtons mblog register information exposure

A vulnerability was determined in mtons mblog up to 3.5.0. Affected is an unknown function of the file /register. The manipulation leads to information exposure through error message. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is...

CVE-2025-8992

A vulnerability has been found in mtons mblog up to 3.5.0. Affected by this issue is some unknown functionality. The manipulation leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used...

CVE-2025-8993

The CVE-2025-8993 entry concerns itsourcecode Online Tour and Travel Management System 1.0. The vulnerability resides in the /admin/expense_report.php file, where manipulation of the from_date parameter enables SQL injection. This flaw could be triggered remotely, and multiple sources confirm tha...

PT-2025-33445 · Phpgurukul · Phpgurukul Online Shopping Portal Project

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Shopping Portal Project 2.0 Description: A vulnerability exists in PHPGurukul Online Shopping Portal Project 2.0, affecting unknown code within the /shopping/password-recovery.php file. Manipulation of the emailid argument c...

PT-2025-33450 · Phpgurukul · Phpgurukul Zoo Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Zoo Management System version 2.1 Description: A vulnerability exists in PHPGurukul Zoo Management System 2.1, specifically within the /admin/add-foreigner-ticket.php file. Manipulation of the visitorname argument can lead to...

PT-2025-33484 · Projectworlds · Travel Management System

Name of the Vulnerable Software and Affected Versions: projectworlds Travel Management System version 1.0 Description: A vulnerability exists in projectworlds Travel Management System 1.0. The issue affects an unknown part of the file /updatepackage.php. Manipulation of the argument s1 leads to S...

CVE-2025-8986

A vulnerability was determined in SourceCodester COVID 19 Testing Management System 1.0. Affected by this issue is some unknown functionality of the file /search-report-result.php. The manipulation of the argument serachdata leads to sql injection. The attack may be launched remotely. The exploit...

CVE-2025-8968 itsourcecode Online Tour and Travel Management System disapprove_user.php sql injection

A vulnerability was identified in itsourcecode Online Tour and Travel Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/disapproveuser.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The explo...

CVE-2025-8960

A vulnerability has been found in Campcodes Online Flight Booking Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/saveairlines.php. The manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The exploit has been...

CVE-2025-8953

A vulnerability was determined in SourceCodester COVID 19 Testing Management System 1.0. Affected by this issue is some unknown functionality of the file /checkavailability.php. The manipulation of the argument employeeid leads to sql injection. The attack may be launched remotely. The exploit ha...

CVE-2025-8952 Campcodes Online Flight Booking Management System Login ajax.php sql injection

A vulnerability was found in Campcodes Online Flight Booking Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ajax.php?action=login of the component Login. The manipulation of the argument Username leads to sql injection. The attack can be...

CVE-2025-8950

A vulnerability was identified in Campcodes Online Recruitment Management System 1.0. This issue affects some unknown processing of the file /Recruitment/index.php?page=viewvacancy. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has...