DRUPAL-CONTRIB-2025-107

This module integrates Plausible Analytics on a site. The module did not properly filter output in certain cases. This vulnerability is mitigated by the fact that an attacker must have permission to add raw HTML to the website, such as an unfiltered WYSIWYG field on a public-facing comment...

UBUNTU-CVE-2025-58674

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WordPress allows Stored XSS. WordPress core security team is aware of the issue and working on a fix. This is low severity vulnerability that requires an attacker to have Author or higher user...

Cross-site Scripting (XSS)

Overview DotNetNuke.Core is a references provider to the DotNetNuke.dll to develop extensions for the DNN Platform. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the Persona Bar module. An attacker can inject and execute arbitrary scripts by setting crafted HTML ...

DNN Vulnerable to Stored Cross-Site Scripting (XSS) in the Prompt module

Summary The Prompt module allows execution of commands that can return raw HTML. Malicious input, even if sanitized for display elsewhere, can be executed when processed through certain commands, leading to potential script execution XSS. Description The application sanitizes most user-submitted...

CVE-2025-4760

CVE-2025-4760 is an authenticated stored XSS vulnerability in multiple WSO2 products, arising from improper validation of user-supplied input during API document upload in the Publisher portal. A user with publisher privileges can upload a crafted API document containing malicious JavaScript that...

Exploit for Improper Restriction of Operations within the Bounds of a Memory Buffer in Php

sudo docker run -it --rm -p 8080:80 php:8.0.29-apache bash...

CVE-2025-58960

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in brijeshk89 IP Based Login ip-based-login allows Stored XSS.This issue affects IP Based Login: from n/a through = 2.4.3...

CVE-2025-57986

CVE-2025-57986 corresponds to a Stored XSS in the WordPress plugin WP Subtitle. The vulnerability is described as Improper Neutralization of Input During Web Page Generation (XSS) affecting WP Subtitle versions from 0 through 3.4.1. The CVE details provided show a CVSS v3.1 base score of 6.5 with...

Code-Projects Hostel Management System 安全漏洞

Hostel Management System is a hostel management system. Hostel Management System suffers from a SQL injection vulnerability that originates from a lack of validation of externally-entered SQL statements in the parameter email in the file /justines/admin/login.php. An attacker can use this...

PT-2025-39046

Name of the Vulnerable Software and Affected Versions WorkScout-Core versions not specified Description A Cross-Site Request Forgery CSRF issue exists in purethemes WorkScout-Core, allowing attackers to perform actions on behalf of authenticated users. This can be exploited by tricking a user int...

PHPGurukul Park Ticketing Management System 安全漏洞

Park Ticketing Management System is a park ticketing management system. Park Ticketing Management System suffers from a SQL injection vulnerability that stems from a lack of validation of externally-entered SQL statements in the parameter fromdate in the file normal-bwdates-reports-details.php. A...

code-projects Hostel Management System SQL注入漏洞

Hostel Management System is a hostel management system. Hostel Management System suffers from a SQL injection vulnerability that originates from a lack of validation of externally entered SQL statements in parameter ID in file /justines/admin/modreservation/index.php?view=view. An attacker can...

Janusec-Application-Gateway

It is an offensive tool for web application security testing. The repository contains a tool for testing web application security, specifically for identifying vulnerabilities in web applications. The tool is designed to test for various types of vulnerabilities, including SQL injection, cross-si...

Security Analysis of Web Applications Based on Gruyere

With the rapid development of Internet technologies, web systems have become essential infrastructures for modern information exchange and business operations. However, alongside their expansion, numerous security vulnerabilities have emerged, making web security a critical research focus within...

GHSA-QM9P-F9J5-W83W Parcel has an Origin Validation Error vulnerability

parcel versions 1.6.1 and above have an Origin Validation Error vulnerability. Malicious websites can send XMLHTTPRequests to the application's development server and read the response to steal source code when developers visit them. Version 2.16.4 supports a --no-cors option which disables CORS...

Beauty Parlour Management System readenq.php File SQL Injection Vulnerability

Beauty Parlour Management System is an application system. Beauty Parlour Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter delid in the file /admin/readenq.php. An attacker can exploit th...

nettoolbox

NetToolbox - Network Security Toolkit A comprehensive, modern...

CVE-2025-10444

CVE-2025-10444 affects Campcodes Online Job Finder System 1.0. The config/behavior: an SQL injection vulnerability exists in the /advancesearch.php file caused by manipulation of the Username parameter, enabling remote exploitation. The exploit has been publicly released and is consistent across ...

Apple多款产品 安全漏洞

Apple Safari is a web browser that is the default browser that comes with the Mac OS X and iOS operating systems.Apple iOS is an operating system developed for mobile devices.Apple tvOS is a smart TV operating system. An information disclosure vulnerability exists in a number of Apple products,...

fimap

fimap is a Python tool designed to find, prepare, audit, exploit, and even automatically Google for local and remote file inclusion LFI/RFI bugs in web applications. It can identify and exploit file inclusion bugs, including include, includeonce, require, and requireonce functions. The tool has a...