PT-2025-38779

Name of the Vulnerable Software and Affected Versions AWP Classifieds versions through 4.3.5 Description A flaw exists in Strategy11 Team AWP Classifieds that allows code injection due to improper neutralization of script-related HTML tags on a web page. This is a Basic Cross-Site Scripting XSS...

PT-2025-38936

Name of the Vulnerable Software and Affected Versions Will.I.am Simple Restaurant Menu versions through 1.2 Description The Simple Restaurant Menu software contains a flaw related to improper input handling during web page generation, which allows for Stored Cross-site Scripting XSS. This means...

CVE-2025-57205

iNiLabs School Express SMS Express 6.2 is affected by a Stored Cross-Site Scripting XSS vulnerability in the content-management features available to authenticated admin users. The vulnerability resides in POSTed editor parameters submitted to the /posts/edit/id endpoint and similarly in Notice a...

CVE-2025-0879

The CVE-2025-0879 entry describes an XSS vulnerability in Shopside App caused by improper neutralization of input during web page generation. Affected product: Shopside App (versions before 17.02.2025). Underlying cause: input is not properly sanitized before being embedded into generated pages, ...

webvulnscanner

Web Vulnerability Scanner A Python-based tool designed for ethic...

CVE-2025-10562

A flaw has been found in Campcodes Grocery Sales and Inventory System 1.0. This affects an unknown function of the file /ajax.php?action=saveproduct. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been published and may be...

CVE-2025-10562

CVE-2025-10562 affects Campcodes Grocery Sales and Inventory System v1.0. The flaw is in /ajax.php?action=save_product where manipulation of the ID parameter enables SQL injection, allowing remote exploitation (exploit published). The CVSS indicates high/critical impact across confidentiality, in...

CVE-2025-6575 XSS in Dolusoft's Omaspot

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Dolusoft Omaspot allows Reflected XSS. This issue affects Omaspot: before 12.09.2025...

TYPO3 Form to Database 安全漏洞

TYPO3 Form to Database is an open source database extension for TYPO3. A security vulnerability exists in TYPO3 Form to Database, which is vulnerable to cross-site scripting attacks. The following versions are affected: versions prior to 2.2.5, versions 3.0.0 through 3.2.2, versions 4.0.0 through...

CVE-2025-10427 SourceCodester Pet Grooming Management Software user.php unrestricted upload

A weakness has been identified in SourceCodester Pet Grooming Management Software 1.0. This impacts an unknown function of the file /admin/operation/user.php. Executing manipulation of the argument websiteimage can lead to unrestricted upload. It is possible to launch the attack remotely. The...

CampCodes Grocery Sales and Inventory System SQL注入漏洞

CampCodes Grocery Sales and Inventory System is a grocery sales and inventory system from CampCodes Philippines. A SQL injection vulnerability exists in CampCodes Grocery Sales and Inventory System version 1.0, which stems from incorrect manipulation of the parameter ID in the file...

CVE-2025-10415

CVE-2025-10415 affects Campcodes Grocery Sales and Inventory System version 1.0. The vulnerability is a SQL injection in the file /ajax.php?action=save_supplier caused by manipulation of the ID argument, exploitable remotely. Public exploitation/public disclosure is noted. CVSS details from sourc...

redteam-notebook

It is an offensive tool for network and web exploitation. The repository, redteam-notebook, contains a collection of commands, tips, and tricks for preparation and execution of red teaming activities, specifically for the OSCP exam. The primary vulnerability targeted is not explicitly stated, but...

SCANNER-INURLBR

This is an offensive tool for web application vulnerability scanning. The tool, INURLBR, is designed to perform advanced searches in search engines to exploit GET/POST capturing emails and URLs, with an internal custom validation junction for each target/URL found. It is written in PHP and can ru...

CVE-2025-10402 PHPGurukul Beauty Parlour Management System readenq.php sql injection

A flaw has been found in PHPGurukul Beauty Parlour Management System 1.1. The impacted element is an unknown function of the file /admin/readenq.php. Executing manipulation of the argument delid can lead to sql injection. The attack can be executed remotely. The exploit has been published and may...

CVE-2025-10372

A weakness has been identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /intranet/educarmodulocad.php. This manipulation of the argument nmtipo/descricao causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made...

CVE-2025-10372 Portabilis i-Educar educar_modulo_cad.php cross site scripting

A weakness has been identified in Portabilis i-Educar up to 2.10. Impacted is an unknown function of the file /intranet/educarmodulocad.php. This manipulation of the argument nmtipo/descricao causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been made...

PT-2025-37374

Name of the Vulnerable Software and Affected Versions: MiczFlor RPi-Jukebox-RFID versions up to 2.8.0 Description: A cross site scripting issue exists due to manipulation of an unknown functionality within the /htdocs/manageFilesFolders.php file. Remote exploitation is possible. The exploit has...

Unmark 代码注入漏洞

Unmark is an open source to-do list application for bookmarking. Unmark 1.9.3 and earlier versions suffer from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data by parameter q in the file...

CVE-2025-40692 SQL injection in PHPGurukul Online Fire Reporting System

SQL Injection in Online Fire Reporting System v1.2 by PHPGurukul. This vulnerability allows an attacker to retrieve, create, update and delete database via 'requestid' parameter in the endpoint '/ofrs/details.php'...