CVEs added in
January 2026

Cross-Site Scripting (XSS) in HotCRP

SQL Injection in Online-Exam-System Feedback Module

SQL Injection in Online-Exam-System Feedback Form

Directory Traversal in OpenCTI static/css File Serving

SQL Injection in e-Learning PHP Script Search Functionality

OS Command Injection in SickBeard Alpha

Unrestricted File Upload in Koken CMS Media Handling

Code Injection / Arbitrary Code Execution in Backstage

Code Injection in Orval JS Client Generator

OS Command Injection in Cybersecurity AI Function Tools via

Command Injection (CWE-77) via Rails Active Storage

SQL Injection in GeoPandas to_postgis() Database Writer

OS Command Injection in DokuWiki runcommand Plugin

SQL Injection in itsourcecode Student Management System

Command Injection in Tenda HG Series Login Interface

Input Validation Error in fast-xml-parser

SQL Injection in ChurchCRM Paddle Number Editor Endpoint

SQL Injection in itsourcecode Directory Management System

Command Injection in Tenda HG10 Boa Webserver formSamba

Improper Input Validation in PolarLearn Forum Vote API

Path Traversal File Write in Runtipi UserConfigController

Command Injection in Bash Completion for gradle-completion

Improper Authorization in Budibase Role Management

Command Injection in Inspektor Gadget Image Builder

SSRF in TrustTunnel TCP Forwarder

Improper Authorization in vCluster Platform

Cryptographic Weakness in N3uron Web UI

Hard-Coded Credentials / Insecure Authentication

Missing Authentication for Critical Function in KiloView

Remote Code Execution via Improper Code Execution Control

Improper Privilege Management in Immich API Key Permission

SQL Injection in itsourcecode Society Management System

Cryptographic Validation Weakness in Parsec

SQL Injection in add_expenses.php of itsourcecode Society

SQL Injection in itsourcecode Society Management System

OS Command Injection in Tea LaTeX tex2png API Endpoint

OS Command Injection in Ajenti 2.1.36

SQL Injection in Elaniin CMS Login

Path Traversal in OSIM Nginx Configuration

Unrestricted File Upload / Path Traversal to Remote Code

SQL Injection in itsourcecode School Management System

Type Conversion and Input Validation Error in iccDEV ICC

Authorization / Authentication Bypass in Podman Desktop

Stored XSS in NocoDB Attachment Handling

Information Exposure in Discourse Access-Controlled

SQL Injection in Online Music Site 1.0 AdminReply.php

SQL Injection in Online Music Site Admin User Editor

Improper Input Validation in OneFlow index_add Leads to

Improper Input Validation in OneFlow flow.arange() Leads to

SSRF in Discourse FinalDestination

Session Management / Session Fixation in 66biolinks

Missing Authorization in Discourse Subscription Endpoints

Unrestricted File Upload / File Handling Abuse

Unrestricted File Upload in Explorance Blue Administrative

SQL Injection in Explorance Blue Web Application Component

SQL Injection in Explorance Blue Web Application Endpoint

SQL Injection in SmartBlog 2.0.1 details Controller

OS Command Injection in OpenProject Repository Diff Download

SQL Injection in EGroupware Nextmatch Filter Processing

HTML / Script Injection in Tactical RMM Agent Management

Prototype Pollution (CWE-1321) in jsonpath value()

Command Injection in browserstack-local Node.js Helper

Unsafe Deserialization in SolarWinds Web Help Desk

Path Traversal in Archive Extraction in node-tar Archive

Command Injection in Dokploy WebSocket Docker Terminal

Hardcoded Credentials in Dokploy Installation Script

Cross-Site Scripting (XSS) in DNN Module Titles

Stored XSS in DNN Persona Bar Module Friendly Names

Cross-Site Scripting (XSS) in DNN PersonaBar Log Notes

XSS in DNN Module Description / Persona Bar

Cryptographic Weakness / Protocol Misuse in Clatter Noise

Sandbox Escape / Code Injection in SandboxJS

Broken Access Control in OpenEMR Profile Edit Endpoint

SSRF in vLLM MediaConnector Host Validation

Cross-Site Scripting (XSS) in Ghost Portal Member Flows

Path Traversal / Zip Slip in RAGFlow MinerU ZIP Extraction

Unsafe Deserialization in PHPUnit PHPT Test Execution

Missing Authorization in Kargo GetConfig and

Unsafe Deserialization in PyTorch weights_only Unpickler

Path Traversal in ConvertX /delete Endpoint

Improper Access Control in Dozzle Agent Shell Endpoints

SSRF in Squidex Webhook Rules Engine

Authorization Bypass / Privilege Escalation in Kyverno

SQL Injection in Mobile Shop Management System 1.0

SQL Injection in Mobile Shop Management System ExLogin

SQL Injection in Mobile Shop Management System

Unrestricted File Upload in code-projects Computer Book

Unrestricted File Upload in Mobile Shop Management System

SQL Injection in Phpscript-sgh Admin Interface

SQL Injection in LibreNMS MAC Accounting Graph Endpoint

Unrestricted File Upload in Victor CMS Profile Image Feature

Directory Traversal in Cassandra Web Arbitrary File Reader

Code Injection / Improper Input Evaluation in n8n Workflow

Memory Corruption / Out-of-Bounds Access in ROOT Builtins

XSS in MobSF Android Manifest Analysis Reports

Path Traversal in Python-Multipart File Handling

Path Traversal in HUSTOF Problem Import Modules

Path Traversal File Write in AnythingLLM DrupalWiki

SQL Injection in Hisense TransTech Smart Bus Management

Server-Side Request Forgery (SSRF) / Internal Service

XML External Entity (XXE) Vulnerability in AssertJ

Path Traversal in BentoML

Code Injection / Sandbox Escape in vm2 for Node.js

SQL Injection in Online Music Site AdminDeleteUser.php

Improper Access Control in SpringBlade importUser Function

Information Exposure in continuous.software aangine Service

SQL Injection in Online Examination System Login Page

Command Injection in Sangfor O&M Security Management System

Unrestricted File Upload in Kalrav AI Agent WordPress Plugin

Path Traversal in C++ HTTP Server Request Handler

Heap Buffer Overflow in iccDEV

Undefined Behavior / Input Validation Error in iccDEV ICC

Input Validation and Memory Safety in iccDEV

Input Validation and Memory Safety Vulnerabilities

Input Validation and Undefined Behavior in iccDEV

Memory Corruption / Heap Buffer Overflow in iccDEV

Heap Buffer Overflow in iccDEV CIccMpeCalculator::Read()

Memory Safety / Undefined Behavior in iccDEV ICC XML Array

Integer Overflow / Improper Input Validation in iccDEV

XSS in ChatterMate Chat Input Handling

Insecure Direct Object Reference (IDOR) in Saleor Order

Unrestricted File Upload in Modern Image Gallery App

Information Disclosure / Cryptographic Weakness

SQL Injection in GetServiceByRestaurantID Endpoint of

Missing Authentication / Access Control in Aptsys POS

OS Command Injection in Doogee Note59 EngineerMode ADB Shell

Improper Access Control in RuoYi selectDept Department Data

Broken Access Control in RuoYi v4.8.2 Update Function

Incorrect Access Control in SpringBlade authRoutes

Unrestricted File Upload in PhreeBooks Image Manager

Authorization Misconfiguration / Access Control

Improper Authorization in free5GC NRF Access Token

Missing Authorization / Access Control in Newgen OmniDocs

OS Command Injection in Framelink Figma MCP Server

Server-Side Request Forgery (SSRF) in FOG getversion.php

Code Injection in Orval Mock Generator

Path Traversal in Container ArchiveReader.extractContents

OS Command Injection in Runtipi BackupManager

Missing Authentication / Authorization Controls

Missing Authentication in Real-Time Application Interfaces

Improper Authentication Rate Limiting in Authentication

Path Traversal / Filesystem Traversal in Incus Container

Improper Access Control in Gitea Repository Ownership Checks

Broken Access Control in Gitea Repositories

Improper Access Control in Gitea

Improper Access Control in Gitea Repositories

Unrestricted File Upload in TMS Management Console Logo

Unsafe Deserialization in Docling Core

Improper Authentication and Session Handling in Atomberg

OS Command Injection in Sangfor Operation and Maintenance

Cross-Site Scripting & Insecure Direct Object Reference

Insufficient Randomness in Authentication Tokens

Path Traversal and Insecure Permission Management

Missing Authorization in Appsmith Public Apps

Authentication Bypass in Horilla HRMS

Improper File Upload / Content Injection in Horilla HRMS

Server-Side Code Injection in Grist

Inadequate Credential Management in DataEase Authentication

Path Traversal / Symlink Attack in Backstage Scaffolder and

Unsafe Deserialization in Seroval fromJSON/fromCrossJSON

Unsafe Deserialization in Laravel Reverb Redis Scaling

Broken Access Control in Fleet Device Management

Improper Authorization in External Secrets Operator

Arbitrary Code Execution via Dynamic Code Evaluation

Code Injection in 5ire ECharts Markdown Plugin

Cross-Context Script Injection / Improper Output Encoding

Insufficient Credential Protection in Claude Code Project

Improper Input Validation in EVerest Manager Modules

Improper Input Validation / Denial of Service

Denial of Service via Malformed Input in Ollama GGUF Decoder

SQL Injection in SEO Panel archive.php order_col Parameter

Arbitrary File Write / External Control of File Name or Path

OS Command Injection in phpPgAdmin 7.13.0

SQL Injection in Blitar Tourism 1.0 Login

Code Injection in GetSimple CMS My SMTP Contact Plugin

Code Injection in OpenPLC v3

OS Command Injection in Hasura GraphQL run_sql Endpoint

Arbitrary File Write / Path Traversal in File Operations

Command Injection in Wrangler pages deploy --commit-hash

Improper Access Control in Oracle WebLogic Server Proxy

Improper Input Validation (CWE-20) in websocket-server

Unsafe Deserialization in PLY yacc()

OS Command Injection in ipTIME Router upnp_relay()

XML External Entity (XXE) in OpenSAGRES XDocReport DOCX

Race Condition and Filesystem Path Handling in node-tar

Path Traversal / Zip Slip in jaraco.context tarball()

Code Injection in Orval OpenAPI Client Generator

Improper Authentication in CRMEB appleLogin API Endpoint

SSRF in Chainlit SQLAlchemy Element Backend

SQL Injection in Yonyou KSOA user_popedom.jsp

Missing Authentication in Arcane Docker Management Interface

SQL Injection in Yonyou KSOA 9.0 HTTP GET Parameter Handler

SQL Injection in Yonyou KSOA save_folder.jsp HTTP GET

Stored XSS in OnboardLite Discord Account Migration

Authorization Bypass in MyTube Role-Based Auth

SQL Injection in itsourcecode School Management System

Cross-Site Scripting (Stored) in SiYuan Dynamic Icons

Path Traversal / Local File Disclosure in SiYuan Markdown

Insecure Direct Object Reference in teklifolustur_app Offer

XSS in Movary categoryCreated Parameter

Cross-Site Scripting (XSS) in Movary

XSS in Movary categoryUpdated Parameter

Improper Input Validation in HotCRP Formula Engine

XSS in OpenProject Roadmap View via Project Names

SQL Injection in Koko Analytics WordPress Plugin

SQL Injection in PHPGurukul Directory Management System

SSRF in WeasyPrint default_url_fetcher

Input Validation Error in Quicly QUIC Implementation

SQL Injection in Online Frozen Foods Ordering System

SQL Injection in Yonyou KSOA folder.jsp

SQL Injection in Yonyou KSOA edit_folder.jsp

SQL Injection in Yonyou KSOA save_catalog.jsp

SQL Injection in Yonyou KSOA 9.0 HTTP GET Parameter Handler

SQL Injection in Yonyou KSOA worksadd.jsp

Path Traversal in esm.sh Tar Archive Handling

Command Injection in D-Link DIR-823X WiFiDog Settings

SQL Injection in Yonyou KSOA work_report.jsp HTTP GET

Dynamic Code Evaluation / Sandbox Escape in n8n Python Task

SQL Injection in Yonyou KSOA work_mod.jsp

SQL Injection in Yonyou KSOA work_info.jsp Parameter

SQL Injection in Yonyou KSOA HTTP GET Parameter Handler

SQL Injection in Yonyou KSOA del_work.jsp HTTP GET Handler

SQL Injection in delete_activity Endpoint of Society

SQL Injection in EasyCMS /UserAction.class.php

SQL Injection in FeMiner wms chkuser.php

SQL Injection in risesoft-y9 REST Authenticate Endpoint

Missing Authentication in MCPJam Inspector

Improper Code Execution / Script Injection in Skipper Lua

SQL Injection in WeGIA Atendido_ocorrenciaControle Endpoint

Cross-Site Scripting (XSS) in WeGIA Memorando Module

Directory Traversal / Path Traversal in Weblate wlc

Cross-Site Scripting (XSS) in StudyMD Markdown Handling

Cross-Site Scripting (XSS) in Marky Markdown Rendering

Cross-Site Scripting (XSS) in Markright Markdown Handling

XSS in Markdownify Markdown Processing

Improper Input Validation / Insecure Resource Resolution

Code Injection in Dive MCP Host Desktop Application

Directory Traversal in SteelSeries Nahimic 3 1.10.7

Unrestricted File Upload in Livewire Filemanager for Laravel

Cleartext Transmission of Sensitive Information

Missing Authorization in Process Optimization Project File

Code Injection in Model Application Server

SQL Injection in Captive Historian Leading to SQL Server

Code Injection in Model Application Server 'taoimr' Service

Stored XSS in Dolibarr ERP-CRM Ticket Creation Module

Command Injection in Deno Process Spawning on Windows

Unsafe Deserialization in Changjetong T+ AjaxPro Endpoint

Improper Input Handling / URI Normalization in Vert.x Web

SQL Injection in PHPGurukul Cyber Cafe Management System

SQL Injection in Phpgurukul Cyber Cafe Management System

CSRF in Easy!Appointments State-Changing GET Endpoints

HTTP Request Smuggling in H3 readRawBody Header Parsing

Command Injection in Arcane Updater Service

Timing Side-Channel / Side-Channel Vulnerability

Path Traversal / ZipSlip in Docmost Zip Import Feature

Server-Side Request Forgery (SSRF) and Availability Weakness

XSS in LaSuite Doc Interlinking Feature

OS Command Injection in Roxy-WI Log Viewing Functionality

SQL Injection in GLPI Inventory Endpoint

Path Traversal / Arbitrary File System Access

OS Command Injection in NOAA PMEL Live Access Server

Improper Access Control in Ludashi Driver Physical Memory

Improper Access Control in GLPI Tickets and Assets

Unrestricted File Upload in Chikitsa Patient Management

Unrestricted File Upload in Chikitsa Patient Management

Code Injection in Shopware map(...) Override

SQL Injection in Pimcore Admin Search Find API

Broken Access Control / Missing Authorization

Improper Control of Environment / Shell Execution by AI

Improper Access Control in Weblate

Code Injection / Sandbox Escape in Enclave JavaScript VM

SQL Injection in WorkOrder CMS Authentication Endpoint

OS Command Injection in Webgrind index.php dataFile

SQL Injection in Social-Share-Buttons project_id Parameter

Unrestricted File Upload in WBCE CMS Droplet Admin Tool

Unrestricted File Upload in ImpressCMS File Upload Handler

Stored XSS in MailHog Email Attachment Handling

Code Injection in NanoCMS 0.4

SQL Injection in Aero CMS Author Parameter

SQL Injection in Senayan Library Management System 'class'

Authentication Bypass / Hard-coded Secrets in Covenant C2

Broken Authentication and Session Management in Cal.com

Path Traversal in GuardDog safe_extract() Enables Arbitrary

Code Injection / CI Pipeline Misconfiguration in Eigent CI

Improper Input Validation in go-ethereum (geth) Network

Improper Input Validation in go-ethereum (geth)

Cryptographic Weakness in Jervis Jenkins Library

Insufficiently Secure Randomness in Jervis Jenkins Pipeline

Cryptographic Weakness in Jervis Encryption Salt Derivation

Cryptographic Weakness in Jervis SHA-256 Hex Padding

Cryptographic Weakness in Jervis Jenkins Library

Use of Weak Cryptography in Jervis Library

Eval Injection / Code Injection in OpenC3 COSMOS JSON-RPC

OS Command Injection in Fortinet FortiSIEM TCP Request

SQL Injection in phpgurukul News Portal Project V4.1

Authentication Bypass in Semantic Machines API Endpoints

Unrestricted File Upload in Hubert Hub uploadFile Component

Unsafe Deserialization in TYPO3 CMS Mailer

Missing Authorization in TYPO3 CMS TCA Data Deletion

Missing Authentication for Critical Functionality

SSRF in Metabase Self-Hosted Deployments

Unsafe Deserialization in LlamaIndex

Unrestricted File Upload in Emlog REST Media Endpoint

Missing Authentication in WebErpMesV2 Sensitive API

Path Traversal File Upload in Gin-vue-admin Breakpoint

SQL Injection in GYM-MANAGEMENT-SYSTEM Search and Payment

SQL Injection in Gym-Management-System-PHP Authentication

Unrestricted File Upload in Covid-19 Contact Tracing System

SQL Injection in kashipara Online Exam System Profile

Insecure Direct Object Reference in xmall orderList API

Command Injection / Code Generation Injection

Path Traversal / Insecure Direct Object Access in File

OS Command Injection in TinyWeb HTTP Server CGI Parameter

Code Injection / Script Abuse in Envoy Gateway

Improper Authorization in LibreChat MCP Stdio Transport

Server-Side Injection in osTicket Ticket PDF Export

Path Traversal in MindsDB File Upload API

Improper Certificate Validation in Automai BotManager

Unrestricted File Upload in Automai Director

Hard-Coded Credentials in Automai Director JavaScript

Improper Certificate Validation in Errands CalDAV

SQL Injection in Admin User Update Endpoint of Online Music

SQL Injection in Online Music Site AdminAddUser

Unrestricted File Upload in Sangfor Operation and

OS Command Injection in Sangfor Operation and Maintenance

Cross-Site Scripting (XSS) in HAX CMS Microsite Management

Input Validation Error in RustCrypto SM2 Public-Key

Improper Input Validation in RustCrypto Elliptic Curves SM2

Path Traversal in DevToys

Command Injection in WeKnora MCP stdio Configuration

SQL Injection in WeKnora Agent Database Query Tool

Insecure Direct Object Reference (IDOR) in Spree Commerce

SQL Injection in XWiki Full Calendar Macro JSON Service

Authorization Bypass in Ghost CMS Staff Endpoints

Authentication Bypass in Email 2FA for Ghost Staff Accounts

XSS in React Router & Remix SPA Navigation

XSS in React Router <ScrollRestoration> Framework Mode SSR

Path Traversal in File-Based Session Storage for React

Cross-Site Scripting (CWE-79) in React Router Packages

Unsafe Deserialization Detection Bypass in Fickling Pickle

Incomplete Input Validation in Deserialization Security

Unsafe Deserialization with Incomplete Security Filtering

Security Validation / Policy Bypass in Fickling Pickle

Security Policy Bypass / Incomplete Input Validation

Command Injection in OpenProject Email Configuration

Information Exposure / Local File Read in OpenProject Work

OS Command Injection in Sangfor Operation and Maintenance

OS Command Injection in Sangfor Operation and Maintenance

OS Command Injection in Sangfor Operation and Maintenance

Path Traversal in Yonyou YonBIP LoginWithV8 Interface

Improper Input Validation in TP-Link Archer AXE75 VPN

SQL Injection in BeeS Software Solutions BET Portal Login

Information Exposure / Insecure Configuration Management

Authentication Bypass in KAYSUS KS-WR3600 Routers

Authentication & Access Control Misconfiguration

Missing Authentication in Panda Wireless PWRU0 Routers

Expression Language Injection in RuoYi-Vue-Plus Snailjob

Code Injection via Database Connection String

Cross-Site Scripting (XSS) in Salvo list_html Directory View

XSS in Salvo list_html Directory Listing View

Unrestricted File Upload in QloApps Hotel Review Feature

Insecure Direct Object Reference in OPEXUS eComplaint

Insecure Direct Object Reference in OPEXUS eCasePortal

Missing Authorization in OPEXUS eCASE Audit Client-Side

SQL Injection in Print Shop Pro WebDesk CartV12

Improper Input Validation in Print Shop Pro WebDesk Cart

SQL Injection in proId Parameter of Online Shopping System

Heap Buffer Overflow in iccDEV ICC Profile Library

SSRF in Mastodon Outbound Request Filtering

Server-Side Template Injection (SSTI) in OpenMetadata

Arbitrary File Upload in Open eClass Theme Import

Authorization and Access Control in RustFS

Authorization and Access Control in RustFS ImportIam Admin

Improper Authentication in ZimaOS Service Account Login

Improper Certificate Validation in NeuVector OpenID Connect

Cross-Site Scripting (XSS) in NiceGUI sub_pages

SQL Injection in Intern Membership Management System

Authentication Bypass in Kanboard

OS Command Injection in Greenshot External Command

Code Injection in n8n Automation Platform

SQL Injection in ClipBucket v5 Channel Comment Handling

Improper Input Validation in n8n Automation Platform

Command Injection in pnpm .npmrc

Memory Corruption / Heap Buffer Overflow in iccDEV ICC

Memory Corruption / Heap Buffer Overflow in iccDEV

Type Confusion in iccDEV Color Profile Library

Type Confusion / Incorrect Type Handling in iccDEV ICC

Type Confusion / Data Type Mismatch in iccDEV ICC Profile

Undefined Behavior / Improper Input Validation

Input Validation and Undefined Behavior in iccDEV ICC

Input Validation and Undefined Behavior in iccDEV

Input Validation and Undefined Behavior in iccDEV

Type Confusion in iccDEV Library

Server-Side Request Forgery (SSRF) in LibreChat Agents

XML External Entity (XXE) in Bio-Formats Leica Metadata

Memory Corruption / Heap Buffer Overflow in iccDEV

Improper Input Validation in iccDEV ICC Profile Processing

Improper Access Control in LibreChat

Path Traversal in RustFS read_file_stream Endpoint

SQL Injection in Tarkov Data Manager Webhook and Scanner

XSS in Tarkov Data Manager Toast Notifications

Authentication Bypass in Tarkov Data Manager Login Endpoint

Memory Corruption / Heap Buffer Overflow in iccDEV

Memory Corruption / Heap Buffer Overflow in iccDEV

Command Injection in terminal-controller-mcp

Path Traversal in @sylphxltd/filesystem-mcp read_content

Improper Input Validation in OpenAirInterface CN5G AMF SBI

Unrestricted File Upload in Projectworlds House Rental

Sensitive Information Exposure in MoneySpace WordPress

Authentication Bypass in wolfSSH

Authentication Bypass in Blue Access Cobalt Web Application

SQL Injection in DwyerOmega Isensix ARMS Login User

Undefined Behavior / Improper Input Handling in iccDEV

Memory Corruption and Resource Exhaustion in iccDEV Color

Use-After-Free Memory Corruption in iccDEV

SQL Injection in Online Music Site Admin Song View

SQL Injection in Albums Listing Endpoint of Online Music

Path Traversal in Frappe Web Requests Enables Arbitrary

Path Traversal / Local File Inclusion in jsPDF Node.js

Cross-Site Scripting (XSS) in vega-functions

XSS in Untrusted Vega Specs with Global View Exposure

SSRF in Spinnaker Artifact Providers

SQL Injection in Login Endpoint of Online Music Site 1.0

Command Injection in Coolify Git Source Configuration

Improper Authentication in Coolify Invitation Link Handling

Broken Access Control / Authorization Logic Error

Insufficient Credential Protection in Coolify Server

Command Injection in Coolify

Command Injection in Passy HTTP Request Handling

Authorization Bypass in OpenCTI GraphQL Mutation

XSS in Coolify Project Creation Workflow

OS Command Injection in Coolify Git Repository Configuration

Command Injection in Coolify Deployment Workflow

Code Injection RCE in Muffon Music Client

SQL Injection in Centreon Infra Monitoring Awie Export

Missing Authentication / Broken Access Control

SQL Injection in Online Product Reservation System User

Improper Authentication in Online Product Reservation

SQL Injection in Online Product Reservation System

SQL Injection in Online Product Reservation System User

OS Command Injection in Centreon Infra Monitoring Backup

Improper Authentication in MiniCMS Article Handler

Improper Authentication in MiniCMS Trash File Restore

Improper Authentication in MiniCMS Publish Page Handler

SQL Injection in Seeyon Zhiyuan OA assetsService.jsp

SQL Injection in Seeyon Zhiyuan OA fixedAssetsList.jsp

SQL Injection in Online Product Reservation System edit.php

SQL Injection in Online Product Reservation System

SQL Injection in Online Product Reservation System prod.php

SQL Injection in Administrator Login of Online Product

Cross-Site Scripting (XSS) in Bagisto CMS Page Editor

Insecure Direct Object Reference in Bagisto Customer Order

Missing Authentication / Authorization in Bagisto eCommerce

Missing Authentication in Sensitive Langflow API Endpoints

Server-Side Request Forgery (SSRF) in Emlog Media Handler

Cross-Site Request Forgery (CSRF) in Emlog Article Creation

SQL Injection in Online Music Site Feedback Endpoint

SQL Injection in AlbumByCategory Endpoint of Online Music

SQL Injection in ViewSongs Endpoint of Online Music Site 1.0

SQL Injection in code-projects CMS /pages.php

Authorization Bypass in Plex Media Server Account API

Directory Traversal in Vatilon File Access Handling

Cleartext Transmission of Sensitive Information

Authentication Bypass in Revotech I6032W-FHW jvsweb.cgi

SQL Injection in Online Movie Booking movie_details.php

SQL Injection in code-projects CMS delete.php

SQL Injection in Code-Projects CMS

SQL Injection in Yonyou KSOA work_edit.jsp

SQL Injection in Yonyou KSOA work_update.jsp

SQL Injection in Yonyou KSOA PrintZPYG.jsp Parameter zpjhid

SQL Injection in Seeyon Zhiyuan OA carUseDetailList.jsp

Unrestricted File Upload in H-ui.admin preview.php Library

SQL Injection in Yonyou KSOA del_user.jsp

SQL Injection in Yonyou KSOA agent_worksdel.jsp

SQL Injection in Yonyou KSOA 9.0 HTTP GET Parameter Handler

SQL Injection in Yonyou KSOA agent_work_report.jsp

Code Injection in Signal K Appstore Interface

SQL Injection in Online Guitar Store /login.php Email

SQL Injection in Online Guitar Store Admin Deletion Endpoint

State Pollution / Insecure State Management in Signal K

SQL Injection in Online Guitar Store Create_product.php

SQL Injection in Online Guitar Store Create_category.php

SQL Injection in itsourcecode School Management System

Unsafe Deserialization in Feast Kubernetes Materializer Job