CVE-2025-28992

CVE-2025-28992 affects the WordPress theme SNS Anton (versions n/a through 4.1). The vulnerability is an improper control of filename for Include/Require statements, i.e., a PHP Local File Inclusion (LFI) flaw that could enable local file access via include/require. The CVSS3.1 base metrics cited...

CVE-2025-30939 WordPress IFrame Widget plugin <= 4.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Debashish IFrame Widget iframe-widget allows Stored XSS.This issue affects IFrame Widget: from n/a through = 4.1...

PT-2025-23014 · Unknown · Phpgurukul News Portal Project

Name of the Vulnerable Software and Affected Versions: PHPGurukul News Portal Project version 4.1 Description: A critical issue has been found in the PHPGurukul News Portal Project, affecting an unknown functionality of the file /admin/add-category.php. The manipulation of the Category argument...

PT-2025-23017 · Unknown · Phpgurukul News Portal Project

Name of the Vulnerable Software and Affected Versions: PHPGurukul News Portal Project version 4.1 Description: A critical issue was found in the PHPGurukul News Portal Project, affecting some unknown functionality of the file /admin/edit-category.php. The manipulation of the Category argument lea...

PT-2025-23020 · Unknown · Phpgurukul News Portal Project

Name of the Vulnerable Software and Affected Versions: PHPGurukul News Portal Project version 4.1 Description: A critical vulnerability was found in the PHPGurukul News Portal Project. The issue affects the file /admin/edit-subadmin.php, where the manipulation of the emailid argument leads to SQL...

PHPGurukul News Portal Project 注入漏洞

News Portal Project is a news portal project. News Portal Project suffers from a SQL injection vulnerability that originates from the lack of validation of externally-entered SQL statements for the parameter Category in the file /admin/add-category.php. An attacker can exploit this vulnerability ...

CVE-2023-44997

Cross-Site Request Forgery CSRF vulnerability in Nitin Rathod WP Forms Puzzle Captcha plugin = 4.1 versions...

CVE-2023-45605

Cross-Site Request Forgery CSRF vulnerability in Christopher Finke Feed Statistics plugin = 4.1 versions...

CVE-2022-47177

Cross-Site Request Forgery CSRF vulnerability in WP Easy Pay WP EasyPay – Square for WordPress plugin = 4.1 versions...

CVE-2020-28103

cscms v4.1 allows for SQL injection via the "pagedel" function...

CVE-2020-15120

In "I hate money" before version 4.1.5, an authenticated member of one project can modify and delete members of another project, without knowledge of this other project's private code. This can be further exploited to access all bills of another project without knowledge of this other project's...

CVE-2018-1000881

Traccar Traccar Server version 4.0 and earlier contains a CWE-94: Improper Control of Generation of Code 'Code Injection' vulnerability in ComputedAttributesHandler.java that can result in Remote Command Execution. This attack appear to be exploitable via Remote: web application request by a...

CVE-2008-4988

pscal in xcal 4.1 allows local users to overwrite arbitrary files via a symlink attack on a /tmp/pscal temporary file...

PHPGurukul News Portal 注入漏洞

News Portal is a news portal. News Portal suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter pagetitle in the file /admin/aboutus.php. An attacker can exploit this vulnerability to execute illegal SQL comman...

PT-2025-21844 · Unknown · Phpgurukul News Portal

Name of the Vulnerable Software and Affected Versions: PHPGurukul News Portal version 4.1 Description: A critical issue has been found in the Login component of the affected software, specifically in the file /admin/index.php. The manipulation of the Username argument leads to SQL injection. This...

PHPGurukul News Portal 注入漏洞

News Portal is a news portal. News Portal suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter Username in the file /admin/index.php. An attacker can exploit this vulnerability to execute illegal SQL commands ...

CVE-2025-46541

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in elrata WP-reCAPTCHA-bp wp-recaptcha-bp allows Stored XSS.This issue affects WP-reCAPTCHA-bp: from n/a through = 4.1...

PT-2025-16214 · Wuzhicms · Wuzhi Cms

Name of the Vulnerable Software and Affected Versions: WuzhiCMS version 4.1 Description: A critical issue was found in the Setting Handler component, specifically in the function Set of the file /index.php?m=attachment&f=index& su=wuzhicms&v=set&submit=1. The manipulation of the Setting argument...

Moodle 4.1.x < 4.1.13 Multiple Vulnerabilities

According to its self-reported version, the Moodle install hosted on the remote host is 4.1.x prior to 4.1.13, 4.2.x prior to 4.2.10, 4.3.x prior to 4.3.7, or 4.4.x prior to 4.4.3. It is, therefore, affected by multiple vulnerabilities. - A lesson activity password bypass through PHP loose...

Moodle 4.3.x < 4.3.7 Multiple Vulnerabilities

According to its self-reported version, the Moodle install hosted on the remote host is 4.1.x prior to 4.1.13, 4.2.x prior to 4.2.10, 4.3.x prior to 4.3.7, or 4.4.x prior to 4.4.3. It is, therefore, affected by multiple vulnerabilities. - A lesson activity password bypass through PHP loose...