Archive
June 2025
Vulnerabilities first published in this month (UTC), newest first.
1,610 results · Clear filters · Feed
-
Medium 6.3
PHPGurukul Zoo Management System manage-foreigners-ticket.php sql injection
A vulnerability classified as critical has been found in PHPGurukul Zoo Management System 2.1. Affected is an unknown function of the file /admin/manage-foreigners-ticket.php. The manipulation of the argument ID leads to sql injection. It is possible to launc…
-
Medium 6.3
PHPGurukul Zoo Management System view-normal-ticket.php sql injection
A vulnerability was found in PHPGurukul Zoo Management System 2.1. It has been rated as critical. This issue affects some unknown processing of the file /admin/view-normal-ticket.php. The manipulation of the argument viewid leads to sql injection. The attack …
-
Medium 5.9
File Browser Insecurely Handles Passwords
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.34.1, a missing password policy and brute-force protection makes the authentication process i…
-
Medium 4.5
File Browser allows sensitive data to be transferred in URL
File Browser provides a file managing interface within a specified directory and it can be used to upload, delete, preview, rename and edit files. Prior to version 2.33.9, access tokens are used as GET parameters. The JSON Web Token (JWT) which is used as a s…
-
Medium 5.3
Dromara RuoYi-Vue-Plus Mail MailController.java path traversal
A vulnerability has been found in Dromara RuoYi-Vue-Plus 5.4.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /src/main/java/org/dromara/demo/controller/MailController.java of the component Mail Handler. The…
-
Medium 5.4
Mattermost Playbooks allows privilege escalation through improper access control in playbook run participant management
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly enforce channel member management permissions when adding participants to playbook runs. This allows authenticated users with member…
-
Medium 4.3
Mattermost Playbooks exposes private channel metadata to unauthorized users via run metadata API
Mattermost versions 10.5.x <= 10.5.5, 9.11.x <= 9.11.15, 10.8.x <= 10.8.0, 10.7.x <= 10.7.2, 10.6.x <= 10.6.5 fail to properly validate channel membership when retrieving playbook run metadata, allowing authenticated users who are playbook members but not cha…
-
Medium 6.3
PHPGurukul Student Record System register.php sql injection
A vulnerability, which was classified as critical, has been found in PHPGurukul Student Record System 3.2. Affected by this issue is some unknown functionality of the file /register.php. The manipulation of the argument session leads to sql injection. The att…
-
Medium 6.3
PHPGurukul Student Record System edit-student.php sql injection
A vulnerability classified as critical was found in PHPGurukul Student Record System 3.2. Affected by this vulnerability is an unknown functionality of the file /edit-student.php. The manipulation of the argument fmarks2 leads to sql injection. The attack can…
-
Medium 4.6
Reflected XSS in Devinim Software's Modified Koha Library Software
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Devinim Software Library Software allows Reflected XSS. This issue affects Library Software: before 24.11.02.
-
Medium 6.3
PHPGurukul Student Record System admin-profile.php sql injection
A vulnerability classified as critical has been found in PHPGurukul Student Record System 3.2. Affected is an unknown function of the file /admin-profile.php. The manipulation of the argument aemailid leads to sql injection. It is possible to launch the attac…
-
Medium 6.3
PHPGurukul Student Record System manage-students.php sql injection
A vulnerability was found in PHPGurukul Student Record System 3.2. It has been rated as critical. This issue affects some unknown processing of the file /manage-students.php. The manipulation of the argument del leads to sql injection. The attack may be initi…
-
Medium 5.4
IBM Cloud Pak System HTML injection
IBM Cloud Pak System 2.3.3.6, 2.3.36 iFix1, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, 2.3.4.1, and 2.3.4.1 iFix1 is vulnerable to HTML injection. A remote attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser withi…
-
Medium 6.3
PHPGurukul Student Record System manage-subjects.php sql injection
A vulnerability was found in PHPGurukul Student Record System 3.2. It has been declared as critical. This vulnerability affects unknown code of the file /manage-subjects.php. The manipulation of the argument del leads to sql injection. The attack can be initi…
-
Medium 6.3
PHPGurukul Student Record System session.php sql injection
A vulnerability was found in PHPGurukul Student Record System 3.2. It has been classified as critical. This affects an unknown part of the file /session.php. The manipulation of the argument session leads to sql injection. It is possible to initiate the attac…
-
Medium 6.3
PHPGurukul Old Age Home Management System add-scdetails.php sql injection
A vulnerability has been found in PHPGurukul Old Age Home Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/add-scdetails.php. The manipulation of the argument emeradd leads to sql …
-
Medium 6.3
PHPGurukul Old Age Home Management System edit-services.php sql injection
A vulnerability, which was classified as critical, was found in PHPGurukul Old Age Home Management System 1.0. Affected is an unknown function of the file /admin/edit-services.php. The manipulation of the argument sertitle leads to sql injection. It is possib…
-
Medium 6.7
Application does not invalidate session after password reset
Insufficient Session Expiration vulnerability in ABB Lite Panel Pro.This issue affects Lite Panel Pro: through 1.0.1.
-
Medium 6.1
A reflected cross-site scripting vulnerability via a specific parameter exists in SLNX Help Documentation of RICOH Stre…
-
Medium 6.3
code-projects Library System add-book.php unrestricted upload
A vulnerability has been found in code-projects Library System 1.0 and classified as critical. This vulnerability affects unknown code of the file /add-book.php. The manipulation of the argument image leads to unrestricted upload. The attack can be initiated …
-
Medium 6.3
D-Link DI-7300G+/DI-8200G msp_info.htm os command injection
A vulnerability, which was classified as critical, was found in D-Link DI-7300G+ and DI-8200G 17.12.20A1/19.12.25A1. This affects an unknown part of the file msp_info.htm. The manipulation of the argument flag/cmd/iface leads to os command injection. It is po…
-
Medium 5.1
Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense Manager
Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to execute JavaScript code by sending a POST request through the password and confirm_password parameters in /register.php.
-
Medium 5.1
Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense Manager
Reflected Cross-Site Scripting (XSS) vulnerability in Daily Expense Manager v1.0. This vulnerability allows an attacker to execute JavaScript code by sending a POST request through the username parameter in /login.php.
-
Medium 6.3CVE-2025-6898 EPSS 18%
D-Link DI-7300G+ in proxy_client.asp os command injection
A vulnerability, which was classified as critical, has been found in D-Link DI-7300G+ 19.12.25A1. Affected by this issue is some unknown functionality of the file in proxy_client.asp. The manipulation of the argument proxy_srv/proxy_lanport/proxy_lanip/proxy_…
-
Medium 5.5
D-Link DI-7300G+ httpd_debug.asp os command injection
A vulnerability classified as critical was found in D-Link DI-7300G+ 19.12.25A1. Affected by this vulnerability is an unknown functionality of the file httpd_debug.asp. The manipulation of the argument Time leads to os command injection. The exploit has been …
-
Medium 6.3
D-Link DI-7300G+ wget_test.asp os command injection
A vulnerability classified as critical has been found in D-Link DI-7300G+ 19.12.25A1. Affected is an unknown function of the file wget_test.asp. The manipulation of the argument url leads to os command injection. It is possible to launch the attack remotely. …
-
Medium 6.3
code-projects Movie Ticketing System ticketConfirmation.php sql injection
A vulnerability was found in code-projects Movie Ticketing System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /ticketConfirmation.php. The manipulation of the argument Date leads to sql injection. The attack may …
-
Medium 6.3
WP Lightbox 2 < 3.0.6.8 - Unauthenticated Stored XSS
The WP Lightbox 2 WordPress plugin before 3.0.6.8 does not correctly sanitize the value of the title attribute of links before using them, which may allow malicious users to conduct XSS attacks.
-
Medium 4.3
Easy Contact Form Lite < 1.1.29 - Contributor+ Stored XSS
The Contact Form Plugin WordPress plugin before 1.1.29 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks.
-
Medium 6.3
code-projects Staff Audit System search_index.php sql injection
A vulnerability, which was classified as critical, has been found in code-projects Staff Audit System 1.0. This issue affects some unknown processing of the file /search_index.php. The manipulation of the argument Search leads to sql injection. The attack may…
-
Medium 6.3
code-projects Staff Audit System update_index.php sql injection
A vulnerability classified as critical was found in code-projects Staff Audit System 1.0. This vulnerability affects unknown code of the file /update_index.php. The manipulation of the argument updateid leads to sql injection. The attack can be initiated remo…
-
Medium 5.1
Out-of-bounds Read vulnerability in Samsung Open Source rLottie allows Overflow Buffers.This issue affects rLottie: V0.…
-
Medium 5.1
Improper Input Validation vulnerability in Samsung Open Source rLottie allows Overread Buffers.This issue affects rLott…
-
Medium 4.6
Improper Input Validation vulnerability in Samsung Open Source rLottie allows Path Traversal.This issue affects rLottie…
-
Medium 5.1
Use After Free vulnerability in Samsung Open Source rLottie allows Remote Code Inclusion.This issue affects rLottie: V0…
-
Medium 6.3
SourceCodester Best Salon Management System edit-tax.php sql injection
A vulnerability classified as critical has been found in SourceCodester Best Salon Management System 1.0. Affected is an unknown function of the file /panel/edit-tax.php. The manipulation of the argument editid leads to sql injection. It is possible to launch…
-
Medium 6.3
SourceCodester Best Salon Management System add-tax.php sql injection
A vulnerability was found in SourceCodester Best Salon Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /panel/add-tax.php. The manipulation of the argument Name leads to sql injection. The attack ma…
-
Medium 6.3
SourceCodester Best Salon Management System search-appointment.php sql injection
A vulnerability was found in SourceCodester Best Salon Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /panel/search-appointment.php. The manipulation of the argument searchdata leads to sql injecti…
-
Medium 6.5
A misconfiguration in the default settings of MikroTik RouterOS 7 and fixed in v7.14 allows incoming IPv6 UDP tracerout…
-
Medium 5.8