CVE-2025-61167

SIGB PMB version v8.0.1.14 contains multiple SQL injection vulnerabilities within the /opac_css/ajax_selector.php component. These flaws are triggered via the id and datas parameters, where improper handling of crafted input may allow for unauthorized database access or modification. Remediation ...

WordPress plugin Iframe 跨站脚本漏洞

The WordPress iframe plugin is a tool for embedding iFrame content in WordPress websites, allowing users to embed external web pages, videos, forms, etc. into their pages. WordPress iframe plugin suffers from a cross-site scripting vulnerability that stems from the application's lack of effective...

EUVD-2025-198618

A flaw has been found in SourceCodester Online Student Clearance System 1.0. Impacted is an unknown function of the file /Admin/changepassword.php. This manipulation of the argument txtconfirmpassword causes sql injection. It is possible to initiate the attack remotely. The exploit has been...

CVE-2025-13556

A flaw has been found in Campcodes Online Polling System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/checklogin.php. Executing a manipulation of the argument myusername can lead to sql injection. The attack can be launched remotely. The exploit has been...

ruby-web-vulnerability-tester

ruby-web-vulnerability-tester 🔎 Ruby Web Application Vulnera...

CVE-2025-66098

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Camille V Travelers' Map travelers-map allows Stored XSS.This issue affects Travelers' Map: from n/a through = 2.3.2...

Project_4

Project4 AutoWebVulnScanner is a Python-based web vulner...

EUVD-2025-198428

Cross-site request forgery vulnerability exists in LogStare Collector. If a user views a crafted page while logged, unintended operations may be performed...

EUVD-2025-198222

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in opentext uCMDB allows Stored XSS. The vulnerability could allow an attacker has high level access to UCMDB to create or update data with malicious scripts This issue affects uCMDB: 24.4...

School Fees Payment Management System /ajax.php?action=save_student file SQL injection vulnerability

School Fees Payment Management System is a tuition payment management system. The School Fees Payment Management System suffers from a SQL injection vulnerability that originates from the lack of validation of externally entered SQL statements in the parameter ID of the file...

Small CRM manage-tickets.php file cross-site scripting vulnerability

Small CRM a customer relationship management system. Small CRM suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the aremark parameter of manage-tickets.php, which can be exploited to execute arbitrary Web scrip...

CVE-2025-58412

Fortinet FortiADC products are affected by a vulnerability described as improper neutralization of script-related HTML tags (basic XSS). Affected are FortiADC 8.0.0, 7.6.0–7.6.3, all 7.4 versions, and all 7.2 versions. The issue could let an attacker craft a URL to execute unauthorized code or co...

CVE-2025-13323

A security flaw has been discovered in code-projects Simple Pizza Ordering System 1.0. Affected is an unknown function of the file /listorder.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated remotely. The exploit has been released to the public...

CVE-2025-12761

The Drupal Simple multi step form module is vulnerable to a Cross-Site Scripting (XSS) flaw in versions prior to 2.0.0 . The root cause is the improper neutralization of input during web page generation, which could allow an attacker to inject malicious scripts into web pages viewed by other user...

CVE-2025-13345

CVE-2025-13345 affects SourceCodester Train Station Ticketing System 1.0. The vulnerability resides in the web application file /ajax.php?action=save_ticket, where manipulation of the action parameter leads to a SQL injection. It is exploitable remotely and has publicly disclosed exploits. Connec...

CVE-2024-44655

PHPGurukul Complaint Management System 2.0 is vulnerable to Cross Site Scripting XSS via the search parameter in user-search.php...

Inventory Management System ID Parameter SQL Injection Vulnerability

Inventory Management System is an inventory management system. Inventory Management System suffers from a SQL injection vulnerability that stems from improper handling of the ID parameter in the /admin/products/index.php?view=edit file. No details of the vulnerability are available at this time...

The vulnerability of the “Apply Configuration” module of the Nagios XI IT infrastructure monitoring tool allows attackers to perform cross-site scripting (XSS) attacks.

The vulnerability of the “Apply Configuration” module of the Nagios XI IT-infrastructure monitoring tool is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

The vulnerability of the Business Process Intelligence (BPI) module of the Nagios XI monitoring tool allows a hacker to perform cross-site scripting attacks.

The vulnerability of the Business Process Intelligence BPI module of the Nagios XI monitoring tool is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

CVE-2025-13181

A vulnerability was determined in pojoin h3blog 1.0. The affected element is an unknown function of the file /admin/cms/material/add. Executing a manipulation of the argument Name can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclos...