PT-2025-40520

Name of the Vulnerable Software and Affected Versions MetInfo CMS version 8.0 Description A stored Cross-Site Scripting XSS flaw exists because of inadequate validation and sanitization of SVG file uploads. The issue is located in the appsystemincludemoduleuploadify.class.php component within the...

CVE-2025-60451

A stored Cross-Site Scripting (XSS) vulnerability exists in MetInfo CMS version 8.0 . The flaw is caused by insufficient validation and sanitization of SVG file uploads within the app ew_system ew_include ew_module ew_uploadify.class.php component, specifically in the website settings module . An...

CVE-2025-60451

A stored Cross-Site Scripting XSS vulnerability has been discovered in MetInfo CMS version 8.0. The vulnerability exists due to insufficient validation and sanitization of SVG file uploads in the app\system\include\module\uploadify.class.php component, specifically in the website settings module...

Reezonly LMS Platform XSS

The vulnerability of the Reezonly LMS platform relates to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

FreeScout support service management system XSS

The vulnerability of the FreeScout support service management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...

NaumenKMS Knowledge Management System Arbitrary JavaScript Execution

The vulnerability of the NaumenKMS knowledge management system is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary JavaScript code remotely...

CVE-2025-7063

Due to client-controlled permission check parameter, PAD CMS's file upload functionality allows an unauthenticated remote attacker to upload files of any type and extension without restriction, which can then be executed leading to Remote Code Execution. This issue affects all 3 templates: www, b...

CVE-2025-8120

CVE-2025-8120 affects PAD CMS: upload photo function is vulnerable because of a client-controlled permission check parameter, allowing unauthenticated remote attackers to upload arbitrary files and execute remote code. Impacts all templates (www, bip, ww+bip). The product is End-Of-Life, and the ...

PT-2025-39966

Name of the Vulnerable Software and Affected Versions PAD CMS affected versions not specified Description The software improperly initializes a parameter used during the password recovery process. This allows an attacker to change the password for any user who has not utilized the password reset...

CVE-2025-11094

A security vulnerability has been detected in code-projects E-Commerce Website 1.0. This affects an unknown part of the file /pages/adminproductdetails.php. Such manipulation of the argument prodid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicl...

GitLab CE/EE XSS

The vulnerability of the Git-based software platform for collaborative code development on GitLab CE/EE is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

CVE-2025-11094

A security vulnerability has been detected in code-projects E-Commerce Website 1.0. This affects an unknown part of the file /pages/adminproductdetails.php. Such manipulation of the argument prodid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicl...

CVE-2025-11094

A security vulnerability has been detected in code-projects E-Commerce Website 1.0. This affects an unknown part of the file /pages/adminproductdetails.php. Such manipulation of the argument prodid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicl...

CVE-2025-11094 code-projects E-Commerce Website admin_product_details.php sql injection

A security vulnerability has been detected in code-projects E-Commerce Website 1.0. This affects an unknown part of the file /pages/adminproductdetails.php. Such manipulation of the argument prodid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicl...

CVE-2025-11094 code-projects E-Commerce Website admin_product_details.php sql injection

A security vulnerability has been detected in code-projects E-Commerce Website 1.0. This affects an unknown part of the file /pages/adminproductdetails.php. Such manipulation of the argument prodid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicl...

CVE-2025-11094: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in code-projects E-Commerce Website 1.0. This affects an unknown part of the file /pages/adminproductdetails.php. Such manipulation of the argument prodid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed publicl...

vulnerable-website

vulnerable-website This repository contains a deliberately vul...

CVE-2025-11037

A security flaw has been discovered in code-projects E-Commerce Website 1.0. This impacts an unknown function of the file /pages/adminindexsearch.php. Performing manipulation of the argument Search results in sql injection. The attack may be initiated remotely. The exploit has been released to th...

CVE-2025-11036

A vulnerability was identified in code-projects E-Commerce Website 1.0. This affects an unknown function of the file /pages/adminaccountupdate.php. Such manipulation of the argument userid leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be...

CVE-2025-11037 code-projects E-Commerce Website admin_index_search.php sql injection

A security flaw has been discovered in code-projects E-Commerce Website 1.0. This impacts an unknown function of the file /pages/adminindexsearch.php. Performing manipulation of the argument Search results in sql injection. The attack may be initiated remotely. The exploit has been released to th...