Online Library Management System Cross-Site Scripting Vulnerability

Online Library Management System is an online library management system. Online Library Management System has a cross-site scripting vulnerability, the vulnerability stems from the lack of effective filtering and escaping of user-supplied data in the parameter stdid in the file...

Chat System addmember.php File SQL Injection Vulnerability

Chat System is a chat system. Chat System suffers from a SQL injection vulnerability that originates from a lack of validation of externally entered SQL statements in the parameter ID of the file /user/addmember.php. An attacker can exploit this vulnerability to execute illegal SQL commands to...

TOTOLINK N200RE Command Injection Vulnerability

TOTOLINK N200RE is a SOHO wireless router with 11N wireless technology, the highest wireless transmission rate of up to 300Mbps, support for MIMO architecture and ATCT free channel auto-detection technology, effectively improve wireless performance and stability. TOTOLINK N200RE has a command...

PHPGurukul Apartment Visitors Management System 代码注入漏洞

Apartment Visitors Management System is an apartment visitor management system. Apartment Visitors Management System suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameter visname in the file...

CVE-2025-33014 IBM Sterling B2B Integrator and IBM Sterling File Gateway link injection

IBM Sterling B2B Integrator and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7 and 6.2.0.0 through 6.2.0.4 uses a web link with untrusted references to an external site. A remote attacker could exploit this vulnerability to expose sensitive information or perform unauthorized actions on the...

PHPGurukul Complaint Management System 代码注入漏洞

Complaint Management System is a complaint management system. Complaint Management System suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameter Search in the file /admin/complaint-search.php, which can...

CVE-2025-54066 DiracX-Web login page has Open Redirect vulnerability

DiracX-Web is a web application that provides an interface to interact with the DiracX services. Prior to version 0.1.0-a8, an attacker can forge a request that they can pass to redirect an authenticated user to another arbitrary website. In the login page, DiracX-Web has a redirect field which i...

Code-Projects Online Appointment Booking System 注入漏洞

Online Appointment Booking System is an online appointment booking system. Online Appointment Booking System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter clinic in the file /admin/deletedoctorclinic.ph...

WeGIA 安全漏洞

WeGIA is a web manager for welfare organizations. WeGIA suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the /html/saude/profilepaciente.php endpoint idfuncionario parameter. An attacker could exploit this vulnerability...

PT-2025-29920 · Unknown · Diracx-Web

Name of the Vulnerable Software and Affected Versions: DiracX-Web versions prior to 0.1.0-a8 Description: DiracX-Web is a web application that provides an interface to interact with the DiracX services. An attacker can forge a request to redirect an authenticated user to an arbitrary website. The...

CVE-2025-53904

CVE-2025-53904 concerns The Scratch Channel (a news site under development) with a potential reflected Cross-Site Scripting (XSS) vulnerability in the file /api/admin.js. The issue arises from code in that file that could allow XSS, as described across multiple sources (NVD/Red Hat/CVE list). The...

CVE-2025-53904 The Scratch Channel Has Potential Reflected Cross-Site Scripting (XSS) Vulnerability

The Scratch Channel is a news website that is under development as of time of this writing. The file /api/admin.js contains code that could make the website vulnerable to cross-site scripting. No known patches exist as of time of publication...

CVE-2025-53925 Emlog has Stored Cross-site Scripting vulnerability in file upload functionality

Emlog is an open source website building system. A cross-site scripting XSS vulnerability in emlog up to and including pro-2.5.17 allows authenticated remote attackers to inject arbitrary web script or HTML via the file upload functionality. As an authenticated user it is possible to upload an .s...

CVE-2025-53840

Icinga DB Web contains an exposure in versions 1.2.0–1.2.1 where users with access to Dependency Views could see hosts and services they should not, due to improper access control on dependency views (filter/hosts and filter/services). The object name is not revealed and access to a host or servi...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Administration Console. An attacker can execute arbitrary scripts in the context of a user's browser by tricking the user into visiting a crafted URL. Details Cross-site scripting or XSS is a code...

PT-2025-29826

Name of the Vulnerable Software and Affected Versions Icinga DB Web versions 1.2.0 through 1.2.1 Description Icinga DB Web, a graphical interface for Icinga monitoring, allows users with access to Icinga Dependency Views to view hosts and services they are not authorized to access on the dependen...

WordPress plugin Traveler SQL注入漏洞

WordPress Traveler plugin is a WordPress plugin designed for the travel industry , mainly used to create travel and trekking websites, support online booking system, itinerary management and other features. WordPress Traveler plugin suffers from a SQL injection vulnerability that stems from the...

WordPress plugin Invico - WordPress Consulting Business Theme 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation, and WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in WordPress Invico-WordPress Consulting Business Theme, which stems from improper handling of inputs during web page generation...

WordPress plugin JetTabs 跨站脚本漏洞

WordPress JetTabs is a plugin for Elementor page builder, mainly used to add stylish tabs and tabs functionality to WordPress websites, supports building rich content and customizing styles through Elementor widgets. WordPress JetTabs suffers from a cross-site scripting vulnerability that stems...

The vulnerability of the DOM component of Adobe Experience Manager (AEM), which allows attackers to perform cross-site scripting attacks

The vulnerability of the DOM component of the Adobe Experience Manager AEM system relates to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks using a specially created web page...