PT-2025-26302 · Unknown · Phpgurukul Directory Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Directory Management System version 2.0 Description: A critical issue has been found in the PHPGurukul Directory Management System, affecting some unknown functionality of the file /admin/manage-directory.php. The manipulation of t...

CVE-2025-28964

CVE-2025-28964 describes a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Personal Favicon , which enables a Stored XSS condition. Affected: Personal Favicon, potentially up to version 2.0 (no lower bound provided). The CVSS 3.1 metrics indicate a base score of 7.1 (High)...

PT-2025-23927 · Unknown · Phpgurukul Complaint Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Complaint Management System version 2.0 Description: A critical vulnerability was found in the PHPGurukul Complaint Management System. The issue affects an unknown functionality of the file /user/profile.php. The manipulation of th...

PT-2025-23922 · Unknown · Phpgurukul Complaint Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Complaint Management System version 2.0 Description: A critical issue has been discovered, affecting an unknown function of the file /admin/updatecomplaint.php. The manipulation of the Status argument leads to SQL injection. This...

PT-2025-23913 · Unknown · Phpgurukul Complaint Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Complaint Management System version 2.0 Description: A critical issue has been discovered, affecting an unknown functionality of the file /admin/between-date-userreport.php. The manipulation of the fromdate and todate arguments lea...

PT-2025-23921 · Unknown · Phpgurukul Complaint Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Complaint Management System version 2.0 Description: A critical issue affects the processing of the file /admin/manage-users.php, where the manipulation of the uid argument leads to SQL injection. The attack can be initiated...

CVE-2025-5690 Cursor allows PostgreSQL Anonymizer masked user to gain unauthorized access to authentic data

PostgreSQL Anonymizer v2.0 and v2.1 contain a vulnerability that allows a masked user to bypass the masking rules defined on a table and read the original data using a database cursor or the --insert option of pgdump. This problem occurs only when dynamic masking is enabled, which is not the...

PT-2025-23849 · Unknown · Unifiedtransform

Name of the Vulnerable Software and Affected Versions: Unifiedtransform version 2.0 Description: An issue in Unifiedtransform allows a remote attacker to escalate privileges via the "/course/edit/id" endpoint. Recommendations: For Unifiedtransform version 2.0, as a temporary workaround, consider...

PT-2025-23848 · Unknown · Unifiedtransform

Name of the Vulnerable Software and Affected Versions: Unifiedtransform version 2.0 Description: The issue allows a remote attacker to escalate privileges via the "/students/edit/id" endpoint. Recommendations: For Unifiedtransform version 2.0, as a temporary workaround, consider restricting acces...

PT-2025-23397 · Unknown · Phpgurukul Online Birth Certificate System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Online Birth Certificate System version 2.0 Description: A critical issue affects the processing of the file "/admin/all-applications.php". The manipulation of the argument del leads to SQL injection. The attack may be initiated...

PT-2025-23426 · Ibm · Ibm Planning Analytics

Name of the Vulnerable Software and Affected Versions: IBM Planning Analytics Local versions 2.0 through 2.1 Description: The issue allows an authenticated user to impersonate another user on the system because the session is not invalidated after a logout. Recommendations: For versions 2.0 and...

CVE-2025-22524

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in formafzar فرم ساز فرم افزار formafzar allows Stored XSS.This issue affects فرم ساز فرم افزار: from n/a through = 2.0...

CVE-2024-45299

alf.io is an open source ticket reservation system for conferences, trade shows, workshops, and meetups. Prior to version 2.0-M5, the preloaded data as json is not escaped correctly, the administrator / event admin could break their own install by inserting non correctly escaped text. The...

CVE-2024-35774

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in D’arteweb DImage 360 allows Stored XSS.This issue affects DImage 360: from n/a through 2.0...

CVE-2024-12306

Multiple access control vulnerabilities in Unifiedtransform version 2.0 and potentially earlier versions allow unauthorized access to personal information of students and teachers. The vulnerabilities include both function-level access control issues in list viewing endpoints and object-level...

CVE-2024-3726

The Login Logout Register Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'llrmloginlogout' shortcode in all versions up to, and including, 2.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...

CVE-2024-9520

The UserPlus plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capability check on multiple functions in all versions up to, and including, 2.0. This makes it possible for authenticated attackers with subscriber-level permissions or above, ...

CVE-2024-37223

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Nicdark Restaurant Reservations allows Stored XSS.This issue affects Restaurant Reservations: from n/a through 2.0...

CVE-2024-51924

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in alexandremagno WP Agenda wp-agenda allows Stored XSS.This issue affects WP Agenda: from n/a through = 2.0...

CVE-2024-38698

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in SKT Themes SKT Skill Bar allows Stored XSS.This issue affects SKT Skill Bar: from n/a through 2.0...