CVE-2026-7590

A vulnerability was identified in eyal-gor p69branchmonkeymcp up to 69bc71874ce40050ef45fde5a435855f18af3373. The affected element is an unknown function of the file branchmonkeymcp/bridgeandlocalactions/routes/advanced.py of the component Preview Endpoint. Such manipulation of the argument...

Endian Firewall 跨站脚本漏洞

Endian Firewall is a network security firewall system from Endian. A cross-site scripting vulnerability exists in the Endian Firewall remark parameter, which originates from improperly cleaning up the input of the remark parameter in /cgi-bin/routing.cgi, and can be exploited by an attacker to...

CVE-2026-3746

Consolidated details across multiple sources identify CVE-2026-3746 as a SQL injection in SourceCodester Simple Responsive Tourism Website 1.0, affecting the Login component’s file /tourism/classes/Login.php?f=login. The bug arises from manipulating the Username argument, enabling remote exploita...

CVE-2018-25165 Galaxy Forces MMORPG 0.5.8 SQL Injection via ads.php

Galaxy Forces MMORPG 0.5.8 contains an SQL injection vulnerability that allows authenticated attackers to execute arbitrary SQL queries by injecting malicious code through the 'type' parameter. Attackers can send POST requests to ads.php with crafted SQL payloads in the type parameter to extract...

CVE-2026-27613

CVE-2026-27613 affects TinyWeb (Delphi, Win32) versions prior to 2.01. An unauthenticated remote attacker can bypass CGI parameter security controls, with impact depending on configuration and CGI executable: possible source code disclosure or remote code execution. The issue is fixed in version ...

📄 RPi-Jukebox-RFID 2.8.0 Cross Site Scripting

RPi-Jukebox-RFID version 2.8.0 suffers from a persistent cross site scripting vulnerability. Exploit Title: RPi-Jukebox-RFID 2.8.0 - Stored XSS CVE-2025-10370 Date: 2025-09-25 Exploit Author: Beatriz Fresno Naumova Vendor Homepage: https://github.com/MiczFlor/RPi-Jukebox-RFID Software Link:...

RPi-Jukebox-RFID 2.8.0 - Stored Cross-Site Scripting (XSS)

Exploit Title: RPi-Jukebox-RFID 2.8.0 - Stored XSS CVE-2025-10370 Date: 2025-09-25 Exploit Author: Beatriz Fresno Naumova Vendor Homepage: https://github.com/MiczFlor/RPi-Jukebox-RFID Software Link: https://github.com/MiczFlor/RPi-Jukebox-RFID/releases/tag/v2.8.0 Version: 2.8.0 Tested on: Raspber...

CVE-2025-12065

The WP Carticon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'carticonjsscript' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-lev...

CVE-2025-12065

The WP Carticon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'carticonjsscript' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-lev...

PT-2025-44942

The WP Carticon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'carticon js script' parameter in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Command Injection

Hoverfly is vulnerable to Command Injection. The vulnerability is due to improper input validation in the middleware endpoint due to the binary and script parameters being passed directly into a system without sanitization. This allows an attacker to supply crafted values for those parameters to...

CVE-2025-10626

CVE-2025-10626 affects SourceCodester Online Exam Form Submission 1.0. A flaw in the file /admin/update_s3.php allows manipulation of the credits parameter, causing a SQL injection. Remote exploitation is possible, and the exploit has been published. Connected sources corroborate the SQL injectio...

CVE-2025-10370

A vulnerability was identified in MiczFlor RPi-Jukebox-RFID up to 2.8.0. This vulnerability affects unknown code of the file /htdocs/userScripts.php. The manipulation of the argument Custom script leads to cross site scripting. The attack is possible to be carried out remotely. The exploit is...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the /api/v2/hoverfly/middleware endpoint. An attacker can execute arbitrary system commands by supplying crafted input to the binary and script parameters, which are passed directly to command execution without...

RemoteClinic 安全漏洞

RemoteClinic is a clinic management system from RemoteClinic open source. A security vulnerability exists in RemoteClinic version 2.0, which stems from a SQL injection due to incorrect manipulation of the parameter ID in the file /staff/profile.php...

CVE-2025-9719 O2OA Personal Profile script cross site scripting

A weakness has been identified in O2OA up to 10.0-410. This vulnerability affects unknown code of the file /xprocessplatformassembledesigner/jaxrs/script of the component Personal Profile Page. Executing manipulation of the argument name/alias/description/applicationName can lead to cross site...

PT-2024-39064

Name of the Vulnerable Software and Affected Versions: W3SPEEDSTER plugin for WordPress versions up to, and including, 7.26 Description: The issue allows for Remote Code Execution due to the plugin passing user-supplied input to eval. This is possible via the script parameter of the...

CVE-2021-36720

PineApp - Mail Secure - Attacker sending a request to :/blocking.php?url=alert1 and stealing cookies...

PT-2021-5359 · Vim +6 · Vim +6

Name of the Vulnerable Software and Affected Versions: Vim affected versions not specified Description: The issue is related to a buffer overflow in memory due to an operation exceeding buffer boundaries. This can be exploited by a remote attacker using a specially crafted file with the -s script...

All Vulnerabilities for audr.franklincountyohio.gov Patched via Open Bug Bounty

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Affected Website:| audr.franklincountyohio.gov ---|--- Ope...