EUVD-2026-92841

A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This issue affects the function mysqliquery of the file locateus.php of the component Doctor Search Endpoint. The manipulation of the argument doctorname leads to sql...

CVE-2026-105470

A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This issue affects the function mysqliquery of the file locateus.php of the component Doctor Search Endpoint. The manipulation of the argument doctorname leads to sql...

CVE-2026-105470 girishsaraf Online-Appointment-Booking-System Doctor Search Endpoint locateus.php mysqli_query sql injection

A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This issue affects the function mysqliquery of the file locateus.php of the component Doctor Search Endpoint. The manipulation of the argument doctorname leads to sql...

CVE-2026-105470

The girishsaraf Online-Appointment-Booking-System (up to commit f427b4757128ca253d33d0cc4e87bbb9c999a4d5 ) is vulnerable to a SQL injection in the Doctor Search Endpoint component. The flaw exists within the mysqli_query function of the locateus.php file, where improper handling of the doctorname...

CVE-2026-105291

A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function GroupController::index of the file App/Feelcrm/Index/Controller/GroupController.class.php of the component Department Search Endpoint. The manipulation of the argument keyword leads to cross...

EUVD-2026-92402

A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function GroupController::index of the file App/Feelcrm/Index/Controller/GroupController.class.php of the component Department Search Endpoint. The manipulation of the argument keyword leads to cross...

CVE-2026-105291 feelec-yishu feelcrm-os Department Search Endpoint GroupController.class.php index cross site scripting

A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function GroupController::index of the file App/Feelcrm/Index/Controller/GroupController.class.php of the component Department Search Endpoint. The manipulation of the argument keyword leads to cross...

CVE-2026-105291

The software feelec-yishu feelcrm-os 1.0.0 contains a cross-site scripting (XSS) vulnerability in the Department Search Endpoint component. The root cause is located in the GroupController::index function within the file App/Feelcrm/Index/Controller/GroupController.class.php, where the manipulati...

CVE-2026-105291 feelec-yishu feelcrm-os Department Search Endpoint GroupController.class.php index cross site scripting

A vulnerability was identified in feelec-yishu feelcrm-os 1.0.0. This vulnerability affects the function GroupController::index of the file App/Feelcrm/Index/Controller/GroupController.class.php of the component Department Search Endpoint. The manipulation of the argument keyword leads to cross...

CVE-2026-33146

CVE-2026-33146 Un recurso compartido público se veía limpio en el árbol de páginas, pero el endpoint de búsqueda contaba una historia diferente. En Docmost, las páginas hijas restringidas ocultas a los visores de recursos compartidos públicos aún podían filtrarse a través de los resultados de...

CVE-2023-51504

CVE-2023-51504 Esta es una reproducción dockerizada de la inyección SQL de MotoCMS cf exploit db Descripción Inyección SQL en MotoCMS Versión 3.4.3 a través del parámetro keyword en el enlace https://template189526.motopreview.com/store/category/search/?keyword=1 La reproducción de la...

CVE-2022-22980

SpEL RCE Exploit - CVE-2022-22980 Exploit para la ejecución remota de código RCE en Spring Data mediante una inyección SpEL Spring Expression Language. Descripciones Vulnerabilidad La máquina expone un endpoint /search que acepta un parámetro trackingid vulnerable a la inyección SpEL. Esta...

CVE-2025-63572

Descripción Se descubrió una vulnerabilidad de inyección SQL en el endpoint responsable de buscar clientes de la plataforma Zentrajuris v.1.0. La entrada del usuario enviada al parámetro de búsqueda se concatena directamente en una consulta SQL sin la debida sanitización/parametrización, lo que...

CVE-2026-103530

A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of the component Search Endpoint. Performing a manipulation of the argument provideroptions.baseUrl results in server-side request forgery. The attack...

CVE-2026-103530: Server-Side Request Forgery (SSRF)

A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of the component Search Endpoint. Performing a manipulation of the argument provideroptions.baseUrl results in server-side request forgery. The attack...

CVE-2026-103530 decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery

A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of the component Search Endpoint. Performing a manipulation of the argument provideroptions.baseUrl results in server-side request forgery. The attack...

CVE-2026-103530

The decolua 9Router software (up to version 0.5.55 ) is vulnerable to a server-side request forgery (SSRF) . The flaw exists within the fetch function of the src/shared/utils/ssrfGuard.js file, specifically located in the Search Endpoint component. An attacker can initiate this attack remotely by...

CVE-2026-103530 decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery

A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of the component Search Endpoint. Performing a manipulation of the argument provideroptions.baseUrl results in server-side request forgery. The attack...

CVE-2026-103530 decolua 9Router Search Endpoint ssrfGuard.js fetch server-side request forgery

A vulnerability was detected in decolua 9Router up to 0.5.55. The affected element is the function fetch of the file src/shared/utils/ssrfGuard.js of the component Search Endpoint. Performing a manipulation of the argument provideroptions.baseUrl results in server-side request forgery. The attack...

CVE-2026-103116

A weakness has been identified in OS4ED openSIS-Classic up to 9.3. This impacts the function DBQuery of the file functions/GetStuListFnc.php of the component Student List Search Endpoint. This manipulation of the argument LOsort causes sql injection. The attack can be initiated remotely. The...