deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2025-4906
Published: 2025-05-19
Description: A vulnerability was found in PHPGurukul Notice Board System 1.0. It has been classified as critical. Affected is an unknown function of the file /login.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/6BXK6/cve/issues/3; https://phpgurukul.com/; https://vuldb.com/?ctiid.309462
CVE: CVE-2025-4907
Published: 2025-05-19
Description: A vulnerability was found in PHPGurukul Daily Expense Tracker System 1.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file /forgot-password.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/22; https://phpgurukul.com/; https://vuldb.com/?ctiid.309464
CVE: CVE-2025-4908
Published: 2025-05-19
Description: A vulnerability classified as critical has been found in PHPGurukul Daily Expense Tracker System 1.1. This affects an unknown part of the file /expense-datewise-reports-detailed.php. The manipulation of the argument fromdate/todate leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/23; https://phpgurukul.com/; https://vuldb.com/?ctiid.309465
CVE: CVE-2025-4909
Published: 2025-05-19
Description: A vulnerability classified as critical was found in SourceCodester Client Database Management System 1.0. This vulnerability affects unknown code. The manipulation leads to exposure of information through directory listing. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-548, CWE-552, CWE-552
References: https://github.com/dengxun628/cve/issues/3; https://vuldb.com/?ctiid.309466; https://vuldb.com/?id.309466
CVE: CVE-2025-4910
Published: 2025-05-19
Description: A vulnerability, which was classified as critical, has been found in PHPGurukul Zoo Management System 2.1. This issue affects some unknown processing of the file /admin/edit-animal-details.php. The manipulation of the argument aname leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/xiguala123/myCVE/issues/5; https://phpgurukul.com/; https://vuldb.com/?ctiid.309467
CVE: CVE-2025-2892
Published: 2025-05-19
Description: The All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post Meta Description and Canonical URL parameters in all versions up to, and including, 4.8.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-79
References: https://plugins.trac.wordpress.org/changeset/3289874/; https://www.wordfence.com/threat-intel/vulnerabilities/id/7fd5d31d-a4f3-458a-b457-f20aeaa71749?source=cve
CVE: CVE-2025-4911
Published: 2025-05-19
Description: A vulnerability, which was classified as critical, was found in PHPGurukul Zoo Management System 2.1. Affected is an unknown function of the file /admin/view-foreigner-ticket.php. The manipulation of the argument viewid leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/xiguala123/myCVE/issues/6; https://phpgurukul.com/; https://vuldb.com/?ctiid.309468
CVE: CVE-2025-4912
Published: 2025-05-19
Description: A vulnerability has been found in SourceCodester Student Result Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/core/update_student.php of the component Image File Handler. The manipulation of the argument old_photo leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-22
References: https://magnificent-dill-351.notion.site/Arbitrary-File-Delete-of-update_student-in-SRMS-1-0-1f5c693918ed8047ad31d03c6034b4f6; https://vuldb.com/?ctiid.309469; https://vuldb.com/?id.309469
CVE: CVE-2025-1625
Published: 2025-05-19
Description: The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its Counter block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/288208c4-e9ca-4b79-88e7-fb415a726fce/
CVE: CVE-2025-1626
Published: 2025-05-19
Description: The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its Countdown block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/f00d86f1-7ff9-4001-af16-989358d811a8/
CVE: CVE-2025-1627
Published: 2025-05-19
Description: The Qi Blocks WordPress plugin before 1.4 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/31b2292b-1ea7-4d63-ad65-0366e2c05dd3/
CVE: CVE-2025-2524
Published: 2025-05-19
Description: The Ninja Forms  WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/6e89ad2b-f12e-4b49-b34e-8da7d30629cd/
CVE: CVE-2025-2560
Published: 2025-05-19
Description: The Ninja Forms  WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/2adaa55a-4a6d-40ca-ae19-fcb82420894a/
CVE: CVE-2025-2561
Published: 2025-05-19
Description: The Ninja Forms  WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://wpscan.com/vulnerability/4a2074a3-a479-4473-92fb-04397f20dd86/
CVE: CVE-2025-4477
Published: 2025-05-19
Description: The ThreatSonar Anti-Ransomware from TeamT5 has a Privilege Escalation vulnerability, allowing remote attackers with intermediate privileges to escalate their privileges to highest administrator level through a specific API.
CVSS Score: 7.2 (HIGH)
CWE: CWE-862
References: https://www.twcert.org.tw/en/cp-139-10130-c0959-2.html; https://www.twcert.org.tw/tw/cp-132-10129-18ea3-1.html
CVE: CVE-2025-4913
Published: 2025-05-19
Description: A vulnerability was found in PHPGurukul Auto Taxi Stand Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/index.php. The manipulation of the argument Username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Pjwww13447/pjwww/issues/15; https://phpgurukul.com/; https://vuldb.com/?ctiid.309470
CVE: CVE-2025-4914
Published: 2025-05-19
Description: A vulnerability was found in PHPGurukul Auto Taxi Stand Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/forgot-password.php. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Pjwww13447/pjwww/issues/16; https://phpgurukul.com/; https://vuldb.com/?ctiid.309471
CVE: CVE-2025-4915
Published: 2025-05-19
Description: A vulnerability was found in PHPGurukul Auto Taxi Stand Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/auto-taxi-entry-detail.php. The manipulation of the argument price leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Pjwww13447/pjwww/issues/17; https://phpgurukul.com/; https://vuldb.com/?ctiid.309472
CVE: CVE-2025-4916
Published: 2025-05-19
Description: A vulnerability was found in PHPGurukul Auto Taxi Stand Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/admin-profile.php. The manipulation of the argument mobilenumber leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Pjwww13447/pjwww/issues/18; https://phpgurukul.com/; https://vuldb.com/?ctiid.309473
CVE: CVE-2025-37891
Published: 2025-05-19
Description: In the Linux kernel, the following vulnerability has been resolved:

ALSA: ump: Fix buffer overflow at UMP SysEx message conversion

The conversion function from MIDI 1.0 to UMP packet contains an
internal buffer to keep the incoming MIDI bytes, and its size is 4, as
it was supposed to be the max size for a MIDI1 UMP packet data.
However, the implementation overlooked that SysEx is handled in a
different format, and it can be up to 6 bytes, as found in
do_convert_to_ump().  It leads eventually to a buffer overflow, and
may corrupt the memory when a longer SysEx message is received.

The fix is simply to extend the buffer size to 6 to fit with the SysEx
UMP message.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://git.kernel.org/stable/c/226beac5605afbb33f8782148d188b64396145a4; https://git.kernel.org/stable/c/42ef48dd4ebb082a1a90b5c3feeda2e68a9e32fe; https://git.kernel.org/stable/c/56f1f30e6795b890463d9b20b11e576adf5a2f77
CVE: CVE-2025-46801
Published: 2025-05-19
Description: Pgpool-II provided by PgPool Global Development Group contains an authentication bypass by primary weakness vulnerability. if the vulnerability is exploited, an attacker may be able to log in to the system as an arbitrary user, allowing them to read or tamper with data in the database, and/or disable the database.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-305
References: https://jvn.jp/en/jp/JVN06238225/; https://www.pgpool.net/mediawiki/index.php/Main_Page#News; https://lists.debian.org/debian-lts-announce/2025/10/msg00014.html
CVE: CVE-2025-47749
Published: 2025-05-19
Description: V-SFT v6.2.5.0 and earlier contains an issue with free of pointer not at start of buffer in VS6EditData.dll!CWinFontInf::WinFontMsgCheck function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-761, CWE-763
References: https://jvn.jp/en/vu/JVNVU97228144/; https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php
CVE: CVE-2025-47750
Published: 2025-05-19
Description: V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds write in VS6MemInIF!set_temp_type_default function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://jvn.jp/en/vu/JVNVU97228144/; https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php
CVE: CVE-2025-47751
Published: 2025-05-19
Description: V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds write in VS6EditData!CDataRomErrorCheck::MacroCommandCheck function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://jvn.jp/en/vu/JVNVU97228144/; https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php
CVE: CVE-2025-47752
Published: 2025-05-19
Description: V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds write in VS6ComFile!MakeItemGlidZahyou function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://jvn.jp/en/vu/JVNVU97228144/; https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php
CVE: CVE-2025-47753
Published: 2025-05-19
Description: V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds read in VS6EditData!CDrawSLine::GetRectArea function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://jvn.jp/en/vu/JVNVU97228144/; https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php
CVE: CVE-2025-47754
Published: 2025-05-19
Description: V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds read in VS6EditData!Conv_Macro_Data function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://jvn.jp/en/vu/JVNVU97228144/; https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php
CVE: CVE-2025-47755
Published: 2025-05-19
Description: V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds read in VS6EditData!VS4_SaveEnvFile function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://jvn.jp/en/vu/JVNVU97228144/; https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php
CVE: CVE-2025-47756
Published: 2025-05-19
Description: V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds read in VS6EditData!CGamenDataRom::set_mr400_strc function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://jvn.jp/en/vu/JVNVU97228144/; https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php
CVE: CVE-2025-47757
Published: 2025-05-19
Description: V-SFT v6.2.5.0 and earlier contains an issue with out-of-bounds read in VS6MemInIF.dll!set_plc_type_default function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://jvn.jp/en/vu/JVNVU97228144/; https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php
CVE: CVE-2025-47758
Published: 2025-05-19
Description: V-SFT v6.2.5.0 and earlier contains an issue with stack-based buffer overflow in VS6File!CTxSubFile::get_ProgramFile_name function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://jvn.jp/en/vu/JVNVU97228144/; https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php
CVE: CVE-2025-47759
Published: 2025-05-19
Description: V-SFT v6.2.5.0 and earlier contains an issue with stack-based buffer overflow in VS6ComFile!CV7BaseMap::WriteV7DataToRom function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://jvn.jp/en/vu/JVNVU97228144/; https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php
CVE: CVE-2025-47760
Published: 2025-05-19
Description: V-SFT v6.2.5.0 and earlier contains an issue with stack-based buffer overflow in VS6MemInIF!set_temp_type_default function. Opening specially crafted V7 or V8 files may lead to crash, information disclosure, and arbitrary code execution.
CVSS Score: 7.8 (HIGH)
CWE: CWE-121, CWE-787
References: https://jvn.jp/en/vu/JVNVU97228144/; https://monitouch.fujielectric.com/site/download-e/09vsft6_inf/Search.php
CVE: CVE-2025-4917
Published: 2025-05-19
Description: A vulnerability classified as critical has been found in PHPGurukul Auto Taxi Stand Management System 1.0. Affected is an unknown function of the file /admin/new-autoortaxi-entry-form.php. The manipulation of the argument drivername leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/Pjwww13447/pjwww/issues/19; https://phpgurukul.com/; https://vuldb.com/?ctiid.309474
CVE: CVE-2025-4923
Published: 2025-05-19
Description: A vulnerability, which was classified as critical, has been found in SourceCodester Client Database Management System 1.0. This issue affects some unknown processing of the file /user_delivery_update.php. The manipulation of the argument uploaded_file_cancelled leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/akihi0342/cve/issues/1; https://vuldb.com/?ctiid.309485; https://vuldb.com/?id.309485
CVE: CVE-2025-27566
Published: 2025-05-19
Description: Path traversal vulnerability exists in a-blog cms versions prior to Ver. 3.1.43 and versions prior to Ver. 3.0.47. This is an issue with insufficient path validation in the backup feature, and exploitation requires the administrator privilege. If this vulnerability is exploited, a remote authenticated attacker with the administrator privilege may obtain or delete any file on the server.
CVSS Score: 3.8 (LOW)
CWE: CWE-22
References: https://developer.a-blogcms.jp/blog/news/JVNVU-90760614.html; https://jvn.jp/en/vu/JVNVU90760614/
CVE: CVE-2025-32999
Published: 2025-05-19
Description: Cross-site scripting vulnerability exists in a-blog cms versions prior to Ver. 3.1.43 and prior to Ver. 3.0.47. This issue exists in a specific field in the entry editing screen, and exploitation requires contributor or higher level privileges.  If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in to the product.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://developer.a-blogcms.jp/blog/news/JVNVU-90760614.html; https://jvn.jp/en/vu/JVNVU90760614/
CVE: CVE-2025-36560
Published: 2025-05-19
Description: Server-side request forgery vulnerability exists in a-blog cms multiple versions. If this vulnerability is exploited, a remote unauthenticated attacker may gain access to sensitive information by sending a specially crafted request.
CVSS Score: 8.6 (HIGH)
CWE: CWE-918
References: https://developer.a-blogcms.jp/blog/news/JVNVU-90760614.html; https://jvn.jp/en/vu/JVNVU90760614/
CVE: CVE-2025-41429
Published: 2025-05-19
Description: a-blog cms multiple versions neutralize logs improperly. If this vulnerability is exploited with CVE-2025-36560, a remote unauthenticated attacker may hijack a legitimate user's session.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-117
References: https://developer.a-blogcms.jp/blog/news/JVNVU-90760614.html; https://jvn.jp/en/vu/JVNVU90760614/
CVE: CVE-2025-4924
Published: 2025-05-19
Description: A vulnerability, which was classified as critical, was found in SourceCodester Client Database Management System 1.0. Affected is an unknown function of the file /user_void_transaction.php. The manipulation of the argument order_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/akihi0342/cve/issues/2; https://vuldb.com/?ctiid.309486; https://vuldb.com/?id.309486
CVE: CVE-2025-4925
Published: 2025-05-19
Description: A vulnerability has been found in PHPGurukul Daily Expense Tracker System 1.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /expense-monthwise-reports-detailed.php. The manipulation of the argument fromdate/todate leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/f1rstb100d/myCVE/issues/24; https://phpgurukul.com/; https://vuldb.com/?ctiid.309487
CVE: CVE-2025-4926
Published: 2025-05-19
Description: A vulnerability was found in PHPGurukul Car Rental Project 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/post-avehical.php. The manipulation of the argument img1/img2/img3/img4/img5 leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-284, CWE-434, CWE-434
References: https://github.com/6BXK6/cve/issues/4; https://phpgurukul.com/; https://vuldb.com/?ctiid.309488
CVE: CVE-2025-4927
Published: 2025-05-19
Description: A vulnerability was found in PHPGurukul Online Marriage Registration System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/between-dates-application-report.php. The manipulation of the argument fromdate/todate leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/sknadklasdls/CVE/issues/1; https://phpgurukul.com/; https://vuldb.com/?ctiid.309489
CVE: CVE-2025-4928
Published: 2025-05-19
Description: A vulnerability was found in projectworlds Online Lawyer Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /save_lawyer_edit_profile.php. The manipulation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Multiple parameters might be affected.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/hhhanxx/attack/issues/8; https://vuldb.com/?ctiid.309490; https://vuldb.com/?id.309490
CVE: CVE-2025-4929
Published: 2025-05-19
Description: A vulnerability was found in Campcodes Online Shopping Portal 1.0. It has been rated as critical. This issue affects some unknown processing of the file /my-account.php. The manipulation of the argument Name leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.
CVSS Score: 7.3 (HIGH)
CWE: CWE-74, CWE-89, CWE-89
References: https://github.com/N1sa26/CVE/issues/1; https://vuldb.com/?ctiid.309491; https://vuldb.com/?id.309491