CVE-2025-9440 1000projects Online Project Report Submission and Evaluation System add_title.php cross site scripting

A security vulnerability has been detected in 1000projects Online Project Report Submission and Evaluation System 1.0. Affected by this issue is some unknown functionality of the file /admin/addtitle.php. Such manipulation of the argument Title leads to cross site scripting. The attack may be...

CVE-2025-52130

File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller. This flaw allows an authenticated attacker to upload arbitrary files, including PHP scripts, which can be accessed via direct GET requests, potentially resulting in remote code execution RC...

CVE-2025-56216

CVE-2025-56216 affects phpgurukul Hospital Management System 4.0. The vulnerability is a SQL Injection in about-us.php via the pagetitle parameter, due to lack of input validation in that file. Reported impact includes potential data exposure (high severity per CVSS 3.1), with no exploitation det...

Linux Distros Unpatched Vulnerability : CVE-2009-3581

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Multiple cross-site scripting XSS vulnerabilities in SQL-Ledger 2.8.24 allow remote authenticated users to inject arbitrary web script or HTML via 1 the DCN...

CVE-2025-54017

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows PHP Local File Inclusion.This issue affects Paid Member Subscriptions: from n/a through = 2.15.4...

Hospital Management System SQL Injection Vulnerability

Hospital Management System is a PHP and MySQL based hospital management system. Hospital Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally-entered SQL statements in the parameter doctorspecilization in the file...

Online Shopping Portal Project signup.php File SQL Injection Vulnerability

Online Shopping Portal Project is an online shopping portal project. A SQL injection vulnerability exists in Online Shopping Portal Project, which originates from the lack of validation of externally entered SQL statements in the parameter emailid in the file /shopping/signup.php. An attacker can...

CVE-2025-51543

An issue was discovered in Cicool builder 3.4.4 allowing attackers to reset the administrator's password via the /administrator/auth/resetpassword endpoint...

CVE-2025-55287

CVE-2025-55287 affects Genealogy (PHP) versions prior to 4.4.0. The vulnerability is an authenticated stored XSS in the Person firstname/lastname, allowing an attacker (Editor+ or higher) to inject JavaScript that executes in other users’ sessions, potentially leading to session hijacking, data t...

CVE-2025-52620

HCL BigFix SaaS Authentication Service is affected by a Cross-Site Scripting XSS vulnerability. The image upload functionality inadequately validated the submitted image format...

CVE-2025-54729

CVE-2025-54729 refers to a stored Cross‑Site Scripting (XSS) vulnerability in the WordPress plugin Webba Booking (Lite) up to version 6.0.5 . The issue arises from improper input neutralization during web page generation, enabling stored XSS when data is rendered. Public records from NVD, CVE‑Lis...

CVE-2025-28975

CVE-2025-28975 corresponds to a WordPress plugin vulnerability in the Alike – WordPress Custom Post Comparison extension. The issue is a reflected Cross‑Site Scripting (XSS) flaw caused by improper neutralization of user input during web page generation, affecting versions up to and including 3.0...

CVE-2025-8908 Shanghai Lingdang Information Technology Lingdang CRM event.php sql injection

A vulnerability was determined in Shanghai Lingdang Information Technology Lingdang CRM up to 8.6.5.4. Affected by this issue is some unknown functionality of the file crm/WeiXinApp/yunzhijia/event.php. The manipulation of the argument openid leads to sql injection. The attack may be launched...

Exploit for Code Injection in Xwiki

CVE-2025-24893 – Unauthenticated Remote Code Execution in XWik...

CVE-2025-8516

CVE-2025-8516 affects Kingdee Cloud-Starry-Sky Enterprise Edition up to 8.2. The vulnerability is in BaseServiceFactory.getFileUploadService.deleteFileAction within K3Cloud\BBCMallSite\WEB-INF\lib\Kingdee.K3.O2O.Base.WebApp.jar!kingdee\k3\o2o\base\webapp\action\FileUploadAction.class of the IIS-K...

CVE-2025-45778

A stored cross-site scripting XSS vulnerability in The Language Sloth Web Application v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Description text field...

CVE-2025-45778

A stored cross-site scripting XSS vulnerability in The Language Sloth Web Application v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Description text field...

Language Sloth Web Application 安全漏洞

Language Sloth Web Application is a web page application from Language Sloth, Inc. A security vulnerability exists in Language Sloth Web Application version 1.0, which originates from stored cross-site scripting and allows an attacker to execute arbitrary web script or HTML by injecting a special...

CVE-2025-54765

An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to import the appliance configuration, allowing an attacker to control the configuration of the appliance, to include...

CVE-2025-54765 KL-001-2025-013: Xorux XorMon-NG Web Application Privilege Escalation to Administrator

An API endpoint that should be limited to web application administrators is hidden from, but accessible by, lower-level read only web application users. The endpoint can be used to import the appliance configuration, allowing an attacker to control the configuration of the appliance, to include...