PT-2025-33634 · Portabilis · Portabilis I-Diario

Name of the Vulnerable Software and Affected Versions: Portabilis i-Diario versions up to 1.5.0 Description: A vulnerability exists in Portabilis i-Diario that allows for cross site scripting. The issue is located in the Informações Adicionais Page component, specifically within the...

PT-2025-33416 · Sourcecodester · Covid19 Testing Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester COVID 19 Testing Management System version 1.0 Description: A SQL injection issue exists in an unknown functionality of the file /profile.php. Manipulation of the mobilenumber argument can lead to SQL injection, allowing for...

CVE-2025-54418 CodeIgniter4's ImageMagick Handler has Command Injection Vulnerability

CodeIgniter is a PHP full-stack web framework. A command injection vulnerability present in versions prior to 4.6.2 affects applications that use the ImageMagick handler for image processing imagick as the image library and either allow file uploads with user-controlled filenames and process...

PT-2025-31042 · Code Projects · Exam Form Submission

Name of the Vulnerable Software and Affected Versions: code-projects Exam Form Submission version 1.0 Description: A critical issue exists in code-projects Exam Form Submission 1.0. The vulnerability is due to the manipulation of the ID argument in the /admin/delete s6.php file, leading to a SQL...

PT-2025-31003 · Campcodes · Best Courier Management System

Name of the Vulnerable Software and Affected Versions: Campcodes Courier Management System version 1.0 Description: A critical issue exists in Campcodes Courier Management System version 1.0. The vulnerability is a SQL injection that occurs through the manipulation of the s argument in the /parce...

PT-2025-30375 · Unknown · Code-Projects Public Chat Room

Name of the Vulnerable Software and Affected Versions: code-projects Public Chat Room version 1.0 Description: A problematic issue exists in code-projects Public Chat Room 1.0. The issue is related to cross site scripting, triggered by manipulating the chat msg/your name argument within an unknow...

PT-2025-29964 · Code Projects · Online Appointment Booking System

Name of the Vulnerable Software and Affected Versions: code-projects Online Appointment Booking System version 1.0 Description: A critical vulnerability exists in code-projects Online Appointment Booking System. The issue involves a SQL injection vulnerability in an unknown function of the...

PT-2025-29982 · Code Projects · Online Appointment Booking System

Name of the Vulnerable Software and Affected Versions: code-projects Online Appointment Booking System version 1.0 Description: A critical vulnerability exists in code-projects Online Appointment Booking System 1.0. The issue is a SQL injection vulnerability stemming from the manipulation of the...

PT-2025-29405 · Unknown · Phpgurukul Online Fire Reporting System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Fire Reporting System version 1.2 Description: A critical issue exists in PHPGurukul Online Fire Reporting System 1.2. The vulnerability is a SQL injection that can be initiated remotely through manipulation of the...

PT-2025-29496 · Semcms · Semcms

Name of the Vulnerable Software and Affected Versions: SemCms version 5.0 Description: SemCms version 5.0 contains a SQL injection vulnerability through the ID parameter at the SEMCMS Link.php file. Recommendations: As a temporary workaround, consider restricting access to the SEMCMS Link.php fil...

PT-2025-29340 · Phpgurukul · Phpgurukul User Registration & Login/User Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul User Registration & Login and User Management System version 3.3 Description: A critical vulnerability exists in PHPGurukul User Registration & Login and User Management System. The issue is related to a SQL injection vulnerability...

CVE-2025-52477 Octo-STS Vulnerable to Unauthenticated SSRF with HTTP Response Reflection in OIDC Flow

Octo-STS is a GitHub App that acts like a Security Token Service STS for the GitHub API. Octo-STS versions before v0.5.3 are vulnerable to unauthenticated SSRF by abusing fields in OpenID Connect tokens. Malicious tokens were shown to trigger internal network requests which could reflect error lo...

Exploit for Cross-site Scripting in Seeddms

📌 CVE-2025-25461 - Stored Cross-Site Scripting XSS in SeedDM...

CVE-2025-24959

CVE-2025-24959 affects zx (versions prior to 8.3.2) due to an Environment Variable Injection flaw in dotenv.stringify, allowing an attacker controlling environment variable values to inject variables into process.env. Impact can include arbitrary command execution or unexpected behavior in securi...

PT-2024-38656 · Special Minds Design · E-Commerce

Name of the Vulnerable Software and Affected Versions: Special Minds Design and Software e-Commerce versions prior to 22.11.2024 Description: The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL...

GHSA-296Q-RJ83-G9RQ Reflected Cross Site-Scripting (XSS) in Oveleon Cookiebar

usd-2024-0009 | Reflected XSS in Oveleon Cookiebar Details Advisory ID: usd-2024-0009 Product: Cookiebar Affected Version: 2.X Vulnerability Type: CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' Security Risk: HIGH,...

U.S. Dept Of Defense: Cross Site Scripting

The researchers discovered a cross-site scripting XSS vulnerability on the www.███.██████████ website. The vulnerability was found to only work in the Firefox browser. The affected product and version were not specified. No CVE numbers were provided. The vulnerability allowed for the execution of...

CVE-2024-34712

Oceanic (NodeJS) vulnerability CVE-2024-34712 affects versions prior to 1.10.4. Input to functions like Client.rest.channels.removeBan is not URL-encoded, allowing crafted input such as ../../../channels/{id} to be normalized into /api/v10/channels/{id}, potentially causing unintended channel act...

PT-2024-26126 · Oceanic · Oceanic

Name of the Vulnerable Software and Affected Versions: Oceanic versions prior to 1.10.4 Description: The issue arises from the lack of url-encoding for input to certain functions, such as Client.rest.channels.removeBan. This allows specially crafted input, like ../../../channels/id, to be...

PT-2024-22013 · Unknown · Campcodes Online Marriage Registration System

Name of the Vulnerable Software and Affected Versions: Campcodes Online Marriage Registration System version 1.0 Description: A problematic vulnerability has been found in the system, affecting the /user/search.php file. The issue is related to the manipulation of the searchdata argument, leading...