Archive
23 September 2025
Vulnerabilities first published on this day (UTC), newest first.
60 results · Clear filters · Feed
-
Medium 6.3
SourceCodester Pet Grooming Management Software print-payment.php sql injection
A weakness has been identified in SourceCodester Pet Grooming Management Software 1.0. This affects an unknown function of the file /admin/print-payment.php. This manipulation of the argument sql111 causes sql injection. The attack can be initiated remotely. …
-
Medium 6.3
SourceCodester Pet Grooming Management Software inv-print.php sql injection
A security flaw has been discovered in SourceCodester Pet Grooming Management Software 1.0. The impacted element is an unknown function of the file /admin/inv-print.php. The manipulation of the argument ID results in sql injection. It is possible to launch th…
-
Medium 6.4
Widget Options - Extended <= 5.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
The Widget Options - Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'do_sidebar' shortcode in all versions up to, and including, 5.2.1 due to insufficient input sanitization and output escaping on user supplied att…
-
Medium 6.3
SourceCodester Pet Grooming Management Software view_payorder.php sql injection
A security flaw has been discovered in SourceCodester Pet Grooming Management Software 1.0. This impacts an unknown function of the file /admin/view_payorder.php. Performing manipulation of the argument ID results in sql injection. The attack can be initiated…
-
Medium 6.5
WordPress Request a Quote plugin <= 2.5.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in emarket-design Request a Quote request-a-quote allows Stored XSS.This issue affects Request a Quote: from n/a through <= 2.5.0.
-
Medium 4.3
Server-Side Request Forgery in SAP BI Platform
SAP BI Platform allows an attacker to modify the IP address of the LogonToken for the OpenDoc. On accessing the modified link in the browser a different server could get the ping request. This has low impact on integrity with no impact on confidentiality and …
-
Medium 6.3
SourceCodester Pet Grooming Management Software edit.php sql injection
A security vulnerability has been detected in SourceCodester Pet Grooming Management Software 1.0. This affects an unknown part of the file /admin/edit.php. Such manipulation of the argument ID leads to sql injection. The attack may be launched remotely. The …
-
Medium 4.3
PHPJabbers Restaurant Menu Maker preview.php cross site scripting
A weakness has been identified in PHPJabbers Restaurant Menu Maker up to 1.1. Affected by this issue is some unknown functionality of the file /preview.php. This manipulation of the argument theme causes cross site scripting. The attack may be initiated remot…
-
Medium 6.3
Campcodes Online Beauty Parlor Management System sales-reports-detail.php sql injection
A security flaw has been discovered in Campcodes Online Beauty Parlor Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/sales-reports-detail.php. The manipulation of the argument fromdate/todate results in sq…
-
Medium 6.3
Campcodes Online Beauty Parlor Management System view-appointment.php sql injection
A vulnerability was identified in Campcodes Online Beauty Parlor Management System 1.0. Affected is an unknown function of the file /admin/view-appointment.php. The manipulation of the argument viewid leads to sql injection. The attack can be initiated remote…
-
Medium 5.3
axboe fio init.c __parse_jobs_ini use after free
A vulnerability was determined in axboe fio up to 3.41. This impacts the function __parse_jobs_ini of the file init.c. Executing manipulation can lead to use after free. The attack needs to be launched locally. The exploit has been publicly disclosed and may …
-
Medium 6.5
SQL Injection vulnerability in CSZ-CMS v.1.3.0 allows a remote attacker to execute arbitrary code via the execSqlFile f…
-
Medium 6.5
SQL Injection vulnerability in CSZ-CMS v.1.3.0 allows a remote attacker to execute arbitrary code via the execSqlFile f…
-
Medium 6.5
An issue in PocketVJ CP PocketVJ-CP-v3 pvj 3.9.1 allows remote attackers to execute arbitrary code via the submit_size.…
-
Medium 6.5
OS Command injection vulnerability in D-Link C1 2020-02-21. The sub_47F028 function in jhttpd contains a command inject…
-
Medium 6.5
OS Command injection vulnerability in Tenda AC9 1.0 was discovered to contain a command injection vulnerability via the…
-
Medium 5.4
GP247 and S-Cart have a stored cross-site scripting (XSS) vulnerability
A stored cross-site scripting (XSS) vulnerability in the Admin Log Viewer of S-Cart <=10.0.3 allows a remote authenticated attacker to inject arbitrary web script or HTML via a crafted User-Agent header. The script is executed in an administrator's browser wh…
-
Medium 6.5CVE-2025-56311 Public exploit
In Shenzhen C-Data Technology Co. FD602GW-DX-R410 (firmware v2.2.14), the web management interface contains an authenti…
-
Medium 5.3
Indian Bank IndSMART Android App 3.8.1 is vulnerable to Missing SSL Certificate Validation in NuWebViewActivity.
-
Medium 6.1
Cross-site scripting (XSS) vulnerability in YzmCMS thru 7.3 via the referer header in the register page.