CVE-2026-10289-XSS

Hotel and Tourism Reservation System - Stored Cross-Site Scripting XSS Vulnerability Details Field| Details ---|--- Title| Hotel and Tourism Reservation System - Stored Cross-Site Scripting XSS CVE ID| Pending Assignment Vendor| code-projects.org Vendor URL|...

CVE-2026-55684 WeGIA: SQL Injection in html/socio/sistema/cadastro_cobrancas_geracao.php

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the unauthenticated web/html/socio/sistema/cadastrocobrancasgeracao.php endpoint accepts form-encoded POST data through extract$REQUEST and interpolates codigo, descricao, dataemissao, datavencimento, datapagamento, valor,...

CVE-2026-33991

WeGIA is a web manager for charitable institutions. Prior to version 3.6.7, the file "html/socio/sistema/deletartag.php" uses "extract$REQUEST" on line 14 and directly concatenates the "$idtag" variable into SQL queries on lines 16-17 without prepared statements or sanitization. Version 3.6.7...

CVE-2026-33991: Improper Neutralization of Special Elements used in an SQL Command

WeGIA is a web manager for charitable institutions. Prior to version 3.6.7, the file html/socio/sistema/deletartag.php uses extract$REQUEST on line 14 and directly concatenates the $idtag variable into SQL queries on lines 16-17 without prepared statements or sanitization. Version 3.6.7 patches t...

Quatuor Evaluation of Performance SQL Injection Vulnerability

Quatuor Evaluación de Desempeño is a performance evaluation system developed by the Spanish company Quatuor. Quatuor Evaluación de Desempeño has a SQL injection vulnerability. This vulnerability stems from external SQL injections in the parameters Idusuario and Idevaluacion within the...

GTT Tax Information System security vulnerabilities

GTT Sistema de Información Tributario is an e-government platform from GTT USA. A security vulnerability exists in GTT Sistema de Información Tributario that stems from an authentication method bypass that could allow an attacker to impersonate any domain user...

CVE-2025-60314: Improper Neutralization of Input During Web Page Generation

Configuroweb Sistema Web de Inventario 1.0 is vulnerable to a Stored Cross-Site Scripting XSS due to the lack of input sanitization on the product name parameter Nombre:Producto allowing an authenticated attacker to inject malicious payloads and execute arbitrary JavaScript...

EUVD-2024-20166

Malicious code in bioql PyPI...

CVE-2025-9724

A vulnerability was determined in Portabilis i-Educar up to 2.10. This impacts an unknown function of the file /intranet/educarnivelensinocad.php. Executing manipulation of the argument nmnivel/descricao can lead to cross site scripting. The attack can be launched remotely. The exploit has been...

VulkAnalyzer

VulkAnalyzer apenas um teste, inciante Autor Hygark Func...

CVE-2025-55169

WeGIA is an open source web manager with a focus on the Portuguese language and charitable institutions. Prior to version 3.4.8, a path traversal vulnerability was discovered in the WeGIA application, html/socio/sistema/downloadremessa.php endpoint. This vulnerability could allow an attacker to...

Malicious Package

Overview secmeasure is a malicious package. This package contains malicious code, and its content was removed from the official package manager. The sisaws package leverages "typosquatting" for the legitimate sisa package, targeting Sistema Integrado de Información Sanitaria Argentino SISA API...

CVE-2025-48938 vulnerabilities

Vulnerabilities for packages: wolfictl...

CVE-2025-1810: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in Pixsoft Vivaz 6.0.11. It has been classified as problematic. Affected is an unknown function of the file /servlet?act=login&submit=1&evento=0&pixrnd=0125021817031859360231 of the component Login Endpoint. The manipulation of the argument sistema leads to cross site...

PT-2025-9203

Name of the Vulnerable Software and Affected Versions Pixsoft Vivaz version 6.0.11 Description A vulnerability was found in the Login Endpoint component of Pixsoft Vivaz. The manipulation of the sistema argument in the "/servlet?act=login&submit=1&evento=0&pixrnd=0125021817031859360231" endpoint...

Ataque de puerta trasera

¿Qué es una puerta trasera? Un "Acceso Secreto" es una técnica que se utiliza para saltarse la autenticación usual en un sistema, producto o dispositivo. Muchas veces, los creadores de software hacen uso de estos accesos para entrar a programas o sistemas y llevar a cabo ajustes o actualizaciones...

CVE-2024-22633

Setor Informatica Sistema Inteligente para Laboratorios S.I.L. 388 was discovered to contain a remote code execution RCE vulnerability via the hprinter parameter. This vulnerability is triggered via a crafted POST request...

CVE-2024-22633: Improper Control of Generation of Code

Setor Informatica Sistema Inteligente para Laboratorios S.I.L. 388 was discovered to contain a remote code execution RCE vulnerability via the hprinter parameter. This vulnerability is triggered via a crafted POST request...

PT-2024-19509 · Setor Informatica · Setor Informatica Sistema Inteligente Para Laboratorios

Name of the Vulnerable Software and Affected Versions: Setor Informatica Sistema Inteligente para Laboratorios S.I.L. version 388 Description: The issue is related to a remote code execution RCE vulnerability. It can be triggered via a crafted POST request using the hmsg parameter. Recommendation...

CVE-2024-22632: Improper Control of Generation of Code

Setor Informatica Sistema Inteligente para Laboratorios S.I.L. 388 was discovered to contain a remote code execution RCE vulnerability via the hmsg parameter. This vulnerability is triggered via a crafted POST request...