CVE-2026-9004: Exposure of Sensitive Information to an Unauthorized Actor

The WP-CRM System – Manage Clients and Projects plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.6 via the 'contactid' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract...

CVE-2024-12406: Improper Neutralization of Special Elements used in an SQL Command

The Library Management System – Manage e-Digital Books Library plugin for WordPress is vulnerable to SQL Injection via the 'owt7borrowbooksid' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on th...

CVE-2024-8679: Improper Neutralization of Special Elements used in an SQL Command

The Library Management System – Manage e-Digital Books Library plugin for WordPress is vulnerable to SQL Injection via the ‘value' parameter of the owtlibhandler AJAX action in all versions up to, and including, 3.1 due to insufficient escaping on the user supplied parameter and lack of sufficien...

NFine Rapid Development Platform Access Control Vulnerability

NFine Rapid Development Platform is an extremely fast WEB + ORM framework based on C language for NFine individual developers. NFine Rapid Development Platform suffers from an Access Control Error vulnerability that originates from the presence of an unknown function in...

Improper Authentication in liukuo362573/yishaadmin

Description Hi there, there is another improper authorization at /admin/SystemManage/LogOperate/GetFormJson, this will allow anyone to view yishaadmin log without logging in. Proof of Concept 1. Access the link http://106.14.124.170/admin/SystemManage/LogOperate/GetFormJson?id=405689053455847424...

PT-2021-11887

Name of the Vulnerable Software and Affected Versions: YzmCMS version 5.8 Description: A storage XSS issue allows attackers to inject JS code, enabling malicious XSS attacks on the "/admin/system manage/user config edit.html" API endpoint. This can be exploited to execute unauthorized actions...

PT-2019-9280

Name of the Vulnerable Software and Affected Versions YzmCMS version 5.1 Description The issue is related to a Cross-Site Scripting XSS problem. It occurs via the title parameter in the admin/system manage/user config add.html page. Recommendations For YzmCMS version 5.1, avoid using the title...

PT-2019-19785

Name of the Vulnerable Software and Affected Versions YzmCMS version 5.2 Description A stored XSS issue exists, allowing potential exploitation via the value parameter in the "admin/system manage/user config edit.html" API endpoint. Recommendations For YzmCMS version 5.2, consider restricting...

CVE-2019-9570

An issue was discovered in YzmCMS 5.2.0. It has XSS via the bottom text field to the admin/systemmanage/save.html URI, related to the sitecode parameter...

PT-2019-19716

Name of the Vulnerable Software and Affected Versions YzmCMS version 5.2.0 Description An issue was discovered that allows XSS via the bottom text field to the "admin/system manage/save.html" URI, related to the site code parameter. Recommendations For YzmCMS version 5.2.0, as a temporary...

CVE-2018-17044

In YzmCMS 5.1, stored XSS exists via the admin/systemmanage/userconfigadd.html title parameter...

PT-2018-13858

Name of the Vulnerable Software and Affected Versions YzmCMS version 5.1 Description The issue is related to stored XSS that exists via the title parameter in the admin/system manage/user config add.html page. Recommendations For YzmCMS version 5.1, update the software to a version that fixes thi...

Design/Logic Flaw

joyplus-cms 1.6.0 has XSS in adminplayer.php, related to manager/index.php "system manage" and "add" actions...

CVE-2018-12905

joyplus-cms 1.6.0 has XSS in adminplayer.php, related to manager/index.php "system manage" and "add" actions...

CVE-2018-12905

joyplus-cms 1.6.0 has XSS in adminplayer.php, related to manager/index.php "system manage" and "add" actions...

CVE-2018-12905: Improper Neutralization of Input During Web Page Generation

joyplus-cms 1.6.0 has XSS in adminplayer.php, related to manager/index.php "system manage" and "add" actions...