7137 matches found
📄 Campcodes Online Loan Management System 1.0 SQL Injection
Campcodes Online Loan Management System versions 1.0 and below suffer from a remote SQL injection vulnerability. -- coding: utf-8 -- Exploit Loan Management System v1.0 - SQL Injection Google Dork: N/A Date: 20/10/2025 Exploit Author: CodeB0ss Vendor: Loan Management System Software Link:...
PHP Education Management 安全漏洞
PHP Education Management is an education manager from the individual developer Iqbolshoh Ilhomjonov. A security vulnerability exists in PHP Education Management version 1.0, which stems from an unvalidated parameter participantname in the worksheet.php file and could lead to a cross-site scriptin...
E-commerce 安全漏洞
E-commerce is a dynamic e-commerce website by the individual developer Bhabishya Ghimire. A security vulnerability exists in E-commerce version 1.0, which stems from the /search parameter not clearing the input to be reflected directly back to the response HTML, which could lead to a cross-site...
CVE-2025-10135
The WP ViewSTL plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'viewstl' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attacker...
CVE-2025-11365
The WP Google Map Plugin plugin for WordPress is vulnerable to blind SQL Injection via the 'id' parameter of the 'googlemap' shortcode in all versions up to, and including, 1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...
EUVD-2025-34548
The WP Google Map Plugin plugin for WordPress is vulnerable to blind SQL Injection via the 'id' parameter of the 'googlemap' shortcode in all versions up to, and including, 1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...
CVE-2025-10135
CVE-2025-10135 (WP ViewSTL <= 1.0) stores cross-site scripting via the WordPress plugin’s viewstl shortcode. Authenticated attackers with contributor-level access or higher can inject scripts that execute for page visitors who load the injected page. The issue arises from insufficient input sa...
CVE-2025-11722 Category and Products Accordion Panel <= 1.0 - Authenticated (Contributor+) Local File Inclusion
The Woocommerce Category and Products Accordion Panel plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0 via the 'categoryaccordionpanel' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to...
WordPress Category and Products Accordion Panel plugin <= 1.0 - Authenticated (Contributor+) Local File Inclusion vulnerability
Authenticated Contributor+ Local File Inclusion vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin Woocommerce Category and Products Accordion Panel versions = 1.0...
WordPress Theme Importer plugin <= 1.0 - Cross-Site Request Forgery vulnerability
Cross-Site Request Forgery vulnerability discovered by Nabil Irawan in WordPress Plugin Theme Importer versions = 1.0...
WordPress plugin WP ViewSTL 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A cross-site...
itsourcecode Online Examination System SQL注入漏洞
itsourcecode Online Examination System is a itsourcecode open source online examination system. A SQL injection vulnerability exists in version 1.0 of itsourcecode Online Examination System, which stems from an incorrect manipulation of the parameter Username in the file /index.php, which could...
EUVD-2025-34090
yt-grabber-tui is a terminal user interface application for downloading videos. In versions before 1.0-rc, the application allows users to configure the path to the yt-dlp executable via the pathtoytdlp configuration setting. An attacker with write access to the configuration file or the filesyst...
CVE-2025-62363 yt-grabber-tui allows arbitrary code execution via configurable yt-dlp path
yt-grabber-tui is a terminal user interface application for downloading videos. In versions before 1.0-rc, the application allows users to configure the path to the yt-dlp executable via the pathtoytdlp configuration setting. An attacker with write access to the configuration file or the filesyst...
CodeAstro Gym Management System SQL注入漏洞
CodeAstro Gym Management System is a gym management system from CodeAstro. A SQL injection vulnerability exists in CodeAstro Gym Management System version 1.0, which stems from incorrect manipulation of the parameter ID in the file /admin/edit-equipmentform.php, which could lead to a SQL injectio...
CampCodes Online Apartment Visitor Management SQL注入漏洞
CampCodes Online Apartment Visitor Management is an online apartment visitor management system from CampCodes Philippines. A SQL injection vulnerability exists in CampCodes Online Apartment Visitor Management version 1.0, which stems from an incorrect manipulation of the parameter mobilenumber in...
SourceCodester Simple Inventory System SQL注入漏洞
SourceCodester Simple Inventory System is a SourceCodester open source simple inventory system. A SQL injection vulnerability exists in SourceCodester Simple Inventory System version 1.0, which stems from an incorrect manipulation of the parameter uemail in the file /user.php, which could lead to...
Projectworlds Online Ordering Food System SQL注入漏洞
Projectworlds Online Ordering Food System is an online ordering food system from Projectworlds. A SQL injection vulnerability exists in Projectworlds Online Ordering Food System version 1.0, which stems from an incorrect manipulation of the parameter Status in the file /all-orders.php, which coul...
CodeAstro Gym Management System SQL注入漏洞
CodeAstro Gym Management System is a gym management system from CodeAstro. A SQL injection vulnerability exists in CodeAstro Gym Management System version 1.0, which stems from incorrect manipulation of the parameter ID in the file /admin/actions/delete-equipment.php, which could lead to a SQL...