CVE-2025-63785

A DOM-based Cross-Site Scripting XSS vulnerability exists in the text editor feature of the Onlook web application 0.2.32. This vulnerability occurs because user-supplied input is not properly sanitized before being directly injected into the DOM via innerHTML when editing a text element. An...

CVE-2025-63783

A Broken Object Level Authorization BOLA vulnerability was discovered in the tRPC project mutation APIs update, delete, add/remove tag of the Onlook web application 0.2.32. The vulnerability exists because the API fails to verify the ownership or membership of the currently authenticated user for...

CVE-2025-63784

An Open Redirect vulnerability exists in the OAuth callback handler in file onlook/apps/web/client/src/app/auth/callback/route.ts in Onlook web application 0.2.32. The vulnerability occurs because the application trusts the X-Forwarded-Host header value without proper validation when constructing...

PT-2025-45466

Name of the Vulnerable Software and Affected Versions Onlook web application version 0.2.32 Description A Broken Object Level Authorization BOLA issue exists in the tRPC project mutation APIs update, delete, add/remove tag of the Onlook web application. The API does not properly validate if the...

CVE-2025-63784

The Onlook web application (version 0.2.32) is vulnerable to an Open Redirect in its OAuth callback handler, specifically within the file onlook/apps/web/client/src/app/auth/callback/route.ts. The root cause is the application's failure to properly validate the X-Forwarded-Host header when constr...

CVE-2025-63783

The Onlook web application (version 0.2.32 ) is affected by a Broken Object Level Authorization (BOLA) vulnerability in its tRPC project mutation APIs (specifically the update, delete, and add/remove tag endpoints). The root cause is the API's failure to verify if an authenticated user owns or be...

PT-2025-45470

Name of the Vulnerable Software and Affected Versions Onlook web application version 0.2.32 Description An Open Redirect issue exists in the OAuth callback handler located in the file onlook/apps/web/client/src/app/auth/callback/route.ts. The application improperly validates the X-Forwarded-Host...

Exploit for OS Command Injection in Nestjs Devtools-Integration

PoC exploit for CVE-2025-54782, a vulnerability in an unspecifie...

CVE-2025-63443

School Management System PHP v1.0 is vulnerable to Cross Site Scripting XSS in /login.php via the password parameter...

CVE-2025-63442

Simple User Management System with PHP-MySQL v1.0 is vulnerable to Cross-Site Scripting XSS via the Profile Section. The system fails to properly sanitize user input, allowing attackers to inject and execute arbitrary JavaScript when the input is displayed in the browser...

CVE-2025-48076: Improper Neutralization of Alternate XSS Syntax

Galette is a membership management web application for non profit organizations. Versions 1.1.5.2 and below allow a user to edit a group name and insert an XSS payload. This issue is fixed in version 1.2.0...

EUVD-2025-37497

Car-Booking-System-PHP v.1.0 is vulnerable to Cross Site Scripting XSS in /carlux/booking.php...

EUVD-2025-37471

A flaw has been found in itsourcecode Billing System 1.0. This affects an unknown function of the file /admin/app/logincrud.php. Executing manipulation of the argument Password can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used...

CVE-2025-12612

CVE-2025-12612 affects Campcodes School Fees Payment Management System 1.0. The vulnerability stems from improper handling of the parameter in the /ajax.php?action=delete_course path, where manipulation of the ID enables a SQL injection. The issue is exploitable remotely and, per connected source...

xss_test

It is an offensive tool for web application testing. The tool ta...

CVE-2025-63453

Car-Booking-System-PHP v.1.0 is vulnerable to SQL Injection in /carlux/contact.php...

CVE-2025-63442

Simple User Management System with PHP-MySQL v1.0 is vulnerable to Cross-Site Scripting XSS via the Profile Section. The system fails to properly sanitize user input, allowing attackers to inject and execute arbitrary JavaScript when the input is displayed in the browser...

📄 Casdoor 2.95.0 Cross Site Request Forgery

Casdoor version 2.55.0 suffers from a cross site request forgery vulnerability. Exploit Title: Casdoor 2.95.0 - Cross-Site Request Forgery CSRF Application: Casdoor Version: v2.95.0 2025-10-22 Date: 2025-10-23 Exploit Author: Van Lam Nguyen Vendor Homepage: https://casdoor.org/ Software Link:...

CVE-2025-34284

Nagios XI versions prior to 2024R2 contain a command injection vulnerability in the WinRM plugin. Insufficient validation of user-supplied parameters allows an authenticated administrator to inject shell metacharacters that are incorporated into backend command invocations. Successful exploitatio...

CVE-2025-34134

Nagios XI versions prior to 2024R1.4.2 contain a remote code execution vulnerability in the Business Process Intelligence BPI component. Insufficient validation and sanitization of administrator-controlled BPI configuration parameters notably bpilogfile and bpiconfigfile allow an authenticated...