CVE Vulnerability Catalog

A flaw has been found in Iqbolshoh php-business-website up to commit 10677743a8dfc281f85291a27cf63a0bce043c24. The vulnerability affects unknown code in admin/contact.php. Manipulation of the argument twitter causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The product uses a rolling release model, so specific version information is not available. The vendor was contacted but did not respond.

A vulnerability was detected in Bdtask Flight Booking Software up to 3.1 in the Package Information Module, file /b2c/package-information. Manipulation leads to unrestricted file upload. The attack can be launched remotely and the exploit is publicly available.

A security vulnerability has been detected in Bdtask Flight Booking Software up to 3.1. It affects an unknown functionality in the Deposit Handler component, allowing unrestricted file upload. The attack can be initiated remotely, and the exploit has been publicly disclosed.

W systemie zakupów online projectworlds w wersji 1.0 znaleziono lukę, która dotyczy nieznanej funkcji w pliku /login_submit.php. Manipulacja argumentem keywords może prowadzić do wstrzyknięcia SQL.

Wykryto podatność w Tenda O3 w wersji 1.0.0.10(2478), która dotyczy funkcji SetValue/GetValue w pliku /goform/sysAutoReboot. Manipulacja argumentem enable prowadzi do przepełnienia bufora na stosie.

A stack-based buffer overflow vulnerability was detected in Tenda O3 in the SetValue/GetValue function of /goform/setVlanConfig, caused by manipulation of the lan argument. The attack can be launched remotely, and the exploit has been publicly disclosed.

Zidentyfikowano słabość w Tenda O3 w wersji 1.0.0.10(2478), która dotyczy funkcji SetValue/GetValue w pliku /goform/setNetworkService. Manipulacja argumentem upnpEn prowadzi do przepełnienia bufora na stosie.

W urządzeniu Tenda O3 w wersji 1.0.0.10(2478) odkryto lukę bezpieczeństwa. Problem dotyczy funkcji SetValue/GetValue w pliku /goform/setDmzInfo, gdzie manipulacja argumentem dmzIP prowadzi do przepełnienia bufora na stosie.

The Entrada theme by Waituk contains a Cross-Site Request Forgery vulnerability in versions from n/a through 5.7.7. This vulnerability allows an attacker to leverage CSRF to perform unauthorized actions in the context of a logged-in administrator.

Stored Cross-site Scripting (XSS) vulnerability in Ultimate Addons for WPBakery Page Builder (ultimate_vc_addons) by Brainstorm_Force. The issue is due to improper neutralization of input during web page generation. This affects versions from n/a through 3.21.1 (excluding 3.21.1).

A vulnerability was identified in Tenda O3 1.0.0.10(2478). Affected by this vulnerability is the function SetValue/GetValue of the file /goform/AdvSetLanip. The manipulation of the argument lanIp leads to stack-based buffer overflow. It is possible to initiate the attack remotely. The exploit is publicly available and might be used.

W podatności CVE-2025-12209 zidentyfikowano problem w urządzeniu Tenda O3 w wersji 1.0.0.10(2478). Manipulacja argumentem dhcpEn w funkcji SetValue/GetValue w pliku /goform/setDhcpConfig może prowadzić do przepełnienia bufora na stosie.

W systemie zarządzania wynajmem nieruchomości SourceCodester Best House Rental Management System w wersji 1.0 odkryto podatność. Dotyczy ona funkcji login2 w pliku /admin_class.php, gdzie manipulacja argumentem Username prowadzi do wstrzyknięcia SQL.

A path traversal vulnerability was identified in givanz Vvveb up to 1.0.7.3 in the sanitizeFileName function of system/functions.php in the Code Editor component. Manipulation of the File argument allows access to files outside the intended directory. The attack can be launched remotely and the exploit is publicly available.

The Slider Templates plugin for WordPress (versions up to 1.0.3) contains a Server-Side Request Forgery (SSRF) vulnerability. It allows an attacker to force the server to make requests to arbitrary network resources.

The Builderall Builder for WordPress plugin (builderall-cheetah-for-wp) is vulnerable to Stored XSS due to improper neutralization of input during web page generation. This issue affects versions from n/a through <= 3.0.1.

Podatność typu Cross-Site Request Forgery (CSRF) w FanBridge pozwala na przeprowadzenie ataku Stored XSS. Problem ten dotyczy wersji FanBridge signup od n/a do 0.6 włącznie.

Stored Cross-site Scripting (XSS) vulnerability in Simple Pull Quote (simple-pull-quote) by llamaman. The issue is due to improper neutralization of input during web page generation. This affects versions from n/a through 1.6.3 inclusive.

Stored Cross-site Scripting (XSS) vulnerability in WP AdCenter (wpadcenter) by WPeka. The issue is due to improper neutralization of input during web page generation. This affects versions from n/a through 2.6.1 inclusive.

Stored Cross-site Scripting (XSS) vulnerability in Posts By Tag (posts-by-tag) by Sudar Muthu. The issue is due to improper neutralization of input during web page generation. This affects versions from n/a through 3.2.1 inclusive.