Atomicorp WAF Research Notes
Research Update - 2026-10-09
Atomicorp WAF Research Notes document selected engineering observations, testing results, attack-pattern analysis, and WAF rule interactions.
The entries published in this update represent research notes produced during ongoing analysis activities.
These notes are not intended to represent the full set of vulnerabilities mitigated by Atomicorp products and should not be interpreted as a coverage matrix, certification list, or census of protected CVEs.
Atomicorp WAF protections are primarily designed around attack techniques and exploit behaviors rather than individual vulnerability identifiers. A published research note documents a positive research finding related to that CVE. If a CVE is absent from these notes, no conclusion should be drawn about protection status.
Presence means a positive research finding was published. Absence means no conclusion should be drawn.
CVE Notes Published in This Update
| CVE | Vulnerability Name | Rules Observed |
|---|---|---|
| CVE-2026-12260 | SQL injection in the NetBoard CRM demo platform | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11539 | Arbitrary Code Execution in Grafana Image Renderer Plugin | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-6439 | WooCommerce Designer Pro <= 1.9.26 - Unauthenticated Arbitrary File Deletion | 340748 , 344360 , 347006 , 347009 , 390709 |
| CVE-2020-36851 | Rob–W cors-anywhere Misconfigured CORS Proxy Allows SSRF | 390719 , 398021 , 398022 , 398023 |
| CVE-2025-34292 | BeWelcome/Rox PHP Object Injection RCE | 340014 , 340023 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390614 |
| CVE-2025-61603 | WeGIA: SQL Injection (Blind Time-Based) Vulnerability in API descricao Parameter | 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380122 |
| CVE-2025-61605 | WeGIA: SQL Injection (Blind Time-Based) Vulnerability in /pet/profile_pet.php Endpoint | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-62360 | WeGIA SQL Injection via 'id_dependente' param at endpoint /html/funcionario/dependente_documento.php | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-56397 | SiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-10351 | SQL injection vulnerability in Melis Platform | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-41009 | SQL injection on the virtual campus platform of Diseño de Recursos Educativos | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-41019 | SQL injection vulnerability in Sergestec's Exito | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-41028 | SQL injection in Epsilon RH | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2026-105110 | Iskratel Innbox Unauthenticated Remote Code Execution via login.xgi CLI Parameter | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-107780 | Dromara Skyeye Unauthenticated OS Command Injection via textToSpeech format Parameter | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-9209 | mJobTime 15.7.3.32 Unauthenticated SQL Execution RCE via Login.aspx | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-63306 | stoatchat before 0.13.5 Unauthenticated SSRF via proxy and embed endpoints | 337109 , 337110 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2026-107781 | Dromara Skyeye Unauthenticated SSRF and File Overwrite via editUploadOfficeFileById | 337109 , 337110 , 340162 , 340163 , 340165 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2019-25710 | Dolibarr ERP-CRM 8.0.4 SQL Injection via rowid Parameter | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-10706 | Classified Pro <= 1.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation | 340014 , 340023 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 360029 , 390904 |
| CVE-2025-9561 | AP Background 3.8.1 - 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload via advParallax | 351000 |
| CVE-2026-107639 | ILIAS before 9.24, 10.12, and 11.5 Argument Injection via Image Map Question Upload Filename | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-61461 | Dify < 1.16.0-rc1 SQL Injection via MyScale Vector Store search_by_full_text | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 341250 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-62177 | WeGIA vulnerable to SQL Injection via 'id_funcionario' param at endpoint /html/funcionario/dependente_listar.php | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-62179 | WeGIA SQL Injection via 'cpf' param at endpoint /html/funcionario/cadastro_funcionario_pessoa_existente.php | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-62172 | Home Assistant vulnerable to Stored XSS in Energy dashboard from Energy Entity Name | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-22219 | Chainlit < 2.9.4 SQLAlchemy Data Layer SSRF via /project/element | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2025-13322 | WP AUDIO GALLERY <= 2.0 - Authenticated (Subscriber+) Arbitrary File Deletion via 'audio_upload' Parameter | 340748 , 344360 , 347006 , 390709 |
| CVE-2025-61784 | LLaMA Factory's Chat API has Critical SSRF and LFI Vulnerabilities | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2025-62716 | Plane Vulnerable to Cross-Site Scripting via Open Redirect in ?next_path Parameter | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2025-10635 | Find Me On <= 2.0.9.1 - Subscriber+ SQL Injection | 340016 , 340017 , 340144 , 340156 , 360147 , 360148 , 380122 |
| CVE-2026-107303 | JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-11189 | kiwire Cross-Site Scripting Vulnerability | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2025-34248 | D-Link Nuclias Connect < v1.3.1.4 Directory Traversal to Arbitrary File Deletion | 340007 , 344360 , 390709 |
| CVE-2025-62429 | ClipBucket v5 executes arbitrary PHP code | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-58372 | SeaweedFS < 4.34 - Cross-Bucket Object Deletion via DeleteObjects Request-Body Keys | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-11682 | Stored Cross-Site Scripting in Perx Customer Engagement & Loyalty Platform | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12629 | Broken Link Manager <= 0.6.5 - Reflected XSS | 340087 , 340099 , 341099 , 341266 , 346755 |
| CVE-2026-107362 | Server-Side Request Forgery in Malcolm | 337109 , 337110 , 340813 , 340814 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-11183 | Cross-Site Scripting Vulnerability in QWC2 | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 |
| CVE-2025-11184 | Cross-Site Scripting Vulnerability in QWC2 Registration GUI | 333140 , 333141 |
| CVE-2025-62693 | Stored XSS through system messages in LastModified | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-62695 | Stored XSS through system messages | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-62698 | Stored XSS through system messages in ExternalGuidance | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-62700 | Stored XSS through a system message in MultiBoilerplate | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-71428 | Jivejdon through 5.0 SQL Injection via username in userListAction | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12136 | Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.2.4 - Authenticated (Admin+) Server-Side Request Forgery via sca | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2025-9978 | Jeg Elementor Kit < 2.7.0 - Author+ Stored XSS | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-10144 | Perfect Brands for WooCommerce <= 3.6.2 - Authenticated (Contributor+) SQL Injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-10730 | Wp tabber widget <= 4.0 - Authenticated (Contributor+) SQL Injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11705 | Anti-Malware Security and Brute-Force Firewall <= 4.23.81 - Missing Authorization to Authenticated (Subscriber+) Arbitra | 340748 , 344360 , 347006 , 347009 , 390709 |
| CVE-2025-10139 | WP BookWidgets <= 0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-9130 | Unify <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via unify_checkout Shortcode | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-9206 | Meks Easy Maps <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting | 333140 , 333141 , 340095 , 342259 |
| CVE-2025-7825 | Schema Plugin For Divi, Gutenberg & Shortcodes <= 4.3.2 - Authenticated (Contributor+) Object Instantiation | 340014 , 340023 , 340193 , 344362 , 344363 , 344365 , 344370 , 344380 , 344382 , 344385 , 390613 , 390614 , 390722 |
| CVE-2026-102783 | Joomla Extension - balbooa.com - Path Traversal in image preview Gridbox < 2.20.4.0 | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-35053 | Newforma Info Exchange (NIX) arbitrary file read and delete | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-55757 | Extension - virtuemart.net - XSS in VirtueMart component 1.0.0 - 4.4.10 for Joomla | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-62358 | WeGIA Reflected XSS to Account TakeOver at /html/configuracao/configuracao_geral.php via log parameter | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2025-62595 | Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic | 344365 |
| CVE-2025-9952 | Trinity Audio <= 5.20.2 - Reflected Cross-Site Scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-107393 | FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header | 333140 , 333141 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 342259 , 346755 |
| CVE-2026-1776 | Camaleon CMS AWS Uploader Authenticated Path Traversal Arbitrary File Read | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-62657 | Stored XSS through system messages in PageForms | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2025-10874 | Orbit Fox < 3.0.2 - Author+ Server-Side Request Forgery | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2025-11397 | SourceCodester Hotel and Lodge Management System login.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11415 | PHPGurukul Beauty Parlour Management System customer-list.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11416 | PHPGurukul Beauty Parlour Management System invoices.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11420 | code-projects E-Commerce Website edit_order_details.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11422 | Campcodes Advanced Online Voting Management System login.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11424 | code-projects Web-Based Inventory and POS System login.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11430 | SourceCodester Simple E-Commerce Bookstore cart.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11434 | itsourcecode Student Transcript Processing System login.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11471 | SourceCodester Hotel and Lodge Management System edit_customer.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11472 | SourceCodester Hotel and Lodge Management System edit_room.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11473 | SourceCodester Hotel and Lodge Management System edit_curr.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11477 | SourceCodester Wedding Reservation Management System global.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11479 | SourceCodester Wedding Reservation Management System function.php insertReservation sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11480 | SourceCodester Simple E-Commerce Bookstore register.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11503 | PHPGurukul Beauty Parlour Management System manage-services.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11505 | PHPGurukul Beauty Parlour Management System new-appointment.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11506 | PHPGurukul Beauty Parlour Management System search-appointment.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11507 | PHPGurukul Beauty Parlour Management System search-invoices.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11556 | code-projects Simple Leave Manager user.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11582 | code-projects Online Job Search Engine registration.php sql injection | 340017 , 340156 , 341245 , 380122 |
| CVE-2025-11584 | code-projects Online Job Search Engine searchjob.php sql injection | 340017 , 341245 , 380122 |
| CVE-2025-11585 | code-projects Project Monitoring System useredit.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11596 | code-projects E-Commerce Website delete_order_details.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11599 | Campcodes Online Apartment Visitor Management System forgot-password.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11601 | SourceCodester Online Student Result System login.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11604 | projectworlds Online Ordering Food System all-orders.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11608 | code-projects E-Banking System POST Parameter register.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11614 | SourceCodester Best Salon Management System edit-appointment.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11615 | SourceCodester Best Salon Management System add_invoice.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11656 | ProjectsAndPrograms School Management System editNotes.php unrestricted upload | 351000 |
| CVE-2025-11657 | ProjectsAndPrograms School Management System createNotice.php unrestricted upload | 351000 |
| CVE-2025-11658 | ProjectsAndPrograms School Management System changeSllyabus.php unrestricted upload | 351000 |
| CVE-2025-11659 | ProjectsAndPrograms School Management System uploadNotes.php unrestricted upload | 351000 |
| CVE-2025-11660 | ProjectsAndPrograms School Management System uploadSllyabus.php unrestricted upload | 351000 |
| CVE-2025-11662 | SourceCodester Best Salon Management System booking.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11736 | itsourcecode Online Examination System index.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12208 | SourceCodester Best House Rental Management System admin_class.php login2 sql injection | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 360147 , 360148 , 380122 |
| CVE-2025-12215 | projectworlds Online Shopping System login_submit.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12237 | projectworlds Advanced Library Management System index.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12257 | SourceCodester Online Student Result System view_result.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12292 | SourceCodester Point of Sales index.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12293 | SourceCodester Point of Sales category.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12301 | code-projects Simple Food Ordering System editproduct.php unrestricted upload | 351000 |
| CVE-2025-12306 | code-projects Nero Social Networking Site acceptoffres.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12307 | code-projects Nero Social Networking Site addfriend.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12308 | code-projects Nero Social Networking Site deletemessage.php sql injection | 340145 , 340156 , 380122 |
| CVE-2025-12325 | SourceCodester Best Salon Management System forgot-password.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12326 | shawon100 RUET OJ POST Request process.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12336 | Campcodes Retro Basketball Shoes Online Store admin_index.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12337 | Campcodes Retro Basketball Shoes Online Store admin_feature.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12338 | Campcodes Retro Basketball Shoes Online Store admin_product.ph sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12339 | Campcodes Retro Basketball Shoes Online Store admin_football.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12378 | code-projects Simple Food Ordering System addproduct.php unrestricted upload | 351000 |
| CVE-2025-13561 | SourceCodester Company Website CMS index.php sql injection | 340017 , 340145 , 340156 , 340457 , 360147 , 360148 , 370016 , 380026 , 380122 , 390572 |
| CVE-2025-13572 | projectworlds Advanced Library Management System delete_admin.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13585 | itsourcecode COVID Tracking System login.php sql injection | 340145 , 340156 , 341145 , 380122 , 390572 |
| CVE-2025-14514 | Campcodes Supplier Management System add_distributor.php sql injection | 340017 , 341245 , 380122 |
| CVE-2025-14515 | Campcodes Supplier Management System add_unit.php sql injection | 340017 , 341245 , 380122 |
| CVE-2025-11190 | kiwire Link Following Vulnerability | 344365 |
| CVE-2025-5343 | Stored XSS | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 341099 , 341266 , 342259 , 350147 , 350148 |
| CVE-2025-62430 | ClipBucket v5 stored XSS via video/photo fields | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12972 | fluent bit Path Traversal Vulnerability | 340007 , 344360 , 390709 |
| CVE-2025-35056 | Newforma Info Exchange (NIX) limited file read | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-62359 | WeGIA Cross-Site Scripting (XSS) Reflected endpoint id_pet | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-62800 | FastMCP vulnerable to reflected XSS in client's callback page | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 |
| CVE-2025-67713 | Miniflux 2 has an Open Redirect via protocol-relative redirect_url | 344365 |
| CVE-2026-107797 | Jivejdon through 5.0 Reflected XSS via postThread.jsp to and tag Parameters | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-40643 | Stored Cross-Site Scripting (XSS) in Energy CRM by Status Tracker | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-40649 | Múltiples vulnerabilidades en Negotiator de BBMRI-ERIC | 333140 , 333141 |
| CVE-2025-41021 | Stored Cross-Site Scripting (XSS) vulnerability in Sergestec's Exito | 333141 , 340095 , 340247 , 340248 , 342259 , 346755 , 350148 |
| CVE-2025-59773 | Multiple vulnerabilities in AndSoft's e-TMS | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-59774 | Multiple vulnerabilities in AndSoft's e-TMS | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-107799 | Jivejdon through 5.0 Stored XSS via messageListBody.jsp Forum Message Rendering | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-107800 | Jivejdon through 5.0 Stored XSS via Private Short Messages | 333140 , 333141 |
| CVE-2026-23695 | Cockpit CMS 2.14.0 Stored XSS via Set Field Display Template | 333140 , 342259 |
| CVE-2026-43644 | podinfo 6.11.2 Reflected XSS via /echo Endpoint | 333140 |
| CVE-2026-54386 | marimo < 0.23.9 XSS via file Query Parameter in assets.py | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-60092 | AVideo - Stored Cross-Site Scripting via Unescaped User-Agent in Participants Panel | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2026-61453 | Grav before 2.0.1 XSS via Twig String Concatenation | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-11536 | Element Pack Addons for Elementor <= 8.2.5 - Authenticated (Subscriber+) Blind Server-Side Request Forgery | 337109 , 337110 , 344360 , 347009 , 390722 , 398021 , 398022 |
| CVE-2025-61606 | WeGIA: Open Redirect Vulnerability in control.php endpoint | 340162 , 340163 , 340165 , 344365 |
| CVE-2025-61996 | OPEXUS FOIAXpress stored XSS via annual report template | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-62361 | WeGIA Open Redirect Vulnerability in control.php endpoint nextPage parameter (metodo=listarTodos nomeClasse=Almoxari | 340162 , 340163 , 340165 , 344365 |
| CVE-2026-58657 | Grav - Stored CSS Injection via Markdown Image resize() Action | 333140 , 333141 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12034 | Fast Velocity Minify <= 3.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting | 346755 |
| CVE-2025-62505 | SSRF in lobehub/lobe-chat with native web fetch module | 337109 , 337110 , 340162 , 340163 , 344360 , 398021 , 398022 |
| CVE-2025-10723 | PixelYourSite < 11.1.2 - Admin+ LFI | 344360 , 347009 |
| CVE-2025-11353 | code-projects Online Hotel Reservation System addgalleryexec.php unrestricted upload | 351000 |
| CVE-2025-11354 | code-projects Online Hotel Reservation System addslideexec.php unrestricted upload | 351000 |
| CVE-2025-11357 | code-projects Simple Banking System createuser.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11358 | code-projects Simple Banking System removeuser.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11359 | code-projects Simple Banking System transfermoney.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11398 | SourceCodester Hotel and Lodge Management System Profile profile.php unrestricted upload | 351000 |
| CVE-2025-11399 | SourceCodester Hotel and Lodge Management System save_room.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11401 | SourceCodester Hotel and Lodge Management System save_curr.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11404 | SourceCodester Hotel and Lodge Management System save_tax.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11409 | Campcodes Advanced Online Voting Management System index.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11410 | Campcodes Advanced Online Voting Management System voters_add.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11417 | Campcodes Advanced Online Voting Management System voters_add.php unrestricted upload | 351000 |
| CVE-2025-11426 | projectworlds Advanced Library Management System edit_book.php unrestricted upload | 351000 |
| CVE-2025-11431 | code-projects Web-Based Inventory and POS System transaction.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11469 | SourceCodester Hotel and Lodge Management System save_customer.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11474 | SourceCodester Hotel and Lodge Management System edit_booking.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11478 | SourceCodester Farm Management System myCart.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11481 | varunsardana004 Blood-Bank-And-Donation-Management-System donate_blood.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11487 | SourceCodester Farm Management System uploadProduct.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11490 | wonderwhy-er DesktopCommanderMCP Absolute Path command-manager.ts extractBaseCommand os command injection | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 390904 , 393655 |
| CVE-2025-11509 | code-projects E-Commerce Website product_add.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 , 390572 |
| CVE-2025-11511 | code-projects E-Commerce Website supplier_add.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11512 | code-projects Voting System voters_add.php cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-11514 | code-projects Online Complaint Site index.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11516 | code-projects Online Complaint Site complaint-details.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11530 | code-projects Online Complaint Site state.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11552 | code-projects Online Complaint Site category.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11589 | CodeAstro Gym Management System user-payment.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11590 | CodeAstro Gym Management System equipment-entry.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11591 | CodeAstro Gym Management System delete-member.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11592 | CodeAstro Gym Management System edit-equipmentform.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11593 | CodeAstro Gym Management System delete-equipment.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11600 | code-projects Simple Food Ordering System editcategory.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11603 | code-projects Simple Food Ordering System editproduct.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11607 | harry0703 MoneyPrinterTurbo API Endpoint music.py upload_music path traversal | 340007 , 344360 , 390709 |
| CVE-2025-11610 | SourceCodester Simple Inventory System brand.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11612 | code-projects Simple Food Ordering System addproduct.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11613 | code-projects Simple Food Ordering System addcategory.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11630 | RainyGao DocSys File Upload uploadDoc.do updateRealDoc path traversal | 351000 |
| CVE-2025-11631 | RainyGao DocSys deleteDoc.do path traversal | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-11667 | code-projects Automated Voting System add_candidate_modal.php. sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11908 | Shenzhen Ruiming Technology Streamax Crocus FileDir.do uploadFile unrestricted upload | 351000 |
| CVE-2025-11909 | Shenzhen Ruiming Technology Streamax Crocus RepairRecord.do queryLast sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11910 | Shenzhen Ruiming Technology Streamax Crocus MemoryState.do query sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11911 | Shenzhen Ruiming Technology Streamax Crocus DeviceFault.do Query sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11912 | Shenzhen Ruiming Technology Streamax Crocus DeviceState.do Query sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11913 | Shenzhen Ruiming Technology Streamax Crocus Service.do download path traversal | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-11914 | Shenzhen Ruiming Technology Streamax Crocus DeviceFileReport.do download path traversal | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-11941 | e107 CMS Avatar image.php path traversal | 340007 , 344360 , 347009 , 390709 |
| CVE-2025-12203 | givanz Vvveb Code Editor functions.php sanitizeFileName path traversal | 344360 , 347009 |
| CVE-2025-12238 | code-projects Automated Voting System user.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12242 | CodeAstro Gym Management System check-attendance.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12244 | code-projects Simple E-Banking System register.php cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 , 380106 |
| CVE-2025-12252 | code-projects Online Event Judging System action.php sql injection | 340156 |
| CVE-2025-12254 | code-projects Online Event Judging System add_judge.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12255 | code-projects Online Event Judging System add_contestant.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12262 | code-projects Online Event Judging System edit_criteria.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12263 | code-projects Online Event Judging System edit_judge.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12266 | Zytec Dalian Zhuoyun Technology Central Authentication Service widget _empty code injection | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2025-12289 | Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 1001 cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12290 | Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 359 cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12298 | code-projects Simple Food Ordering System editcategory.php cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12300 | code-projects Simple Food Ordering System addcategory.php cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12302 | code-projects Simple Food Ordering System editproduct.php cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12327 | shawon100 RUET OJ description.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12329 | shawon100 RUET OJ details.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12346 | MaxSite CMS HTTP Header uploads-require-maxsite.php unrestricted upload | 351000 |
| CVE-2025-12347 | MaxSite CMS save-file-ajax.php unrestricted upload | 351000 |
| CVE-2025-13569 | itsourcecode COVID Tracking System page sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13570 | itsourcecode COVID Tracking System page sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13573 | projectworlds can pass malicious payloads add_book.php unrestricted upload | 351000 |
| CVE-2025-13579 | code-projects Library System return.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13580 | code-projects Library System mail.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13581 | itsourcecode Student Information System schedule_edit1.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11421 | code-projects Voting System candidates_edit.php cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-11433 | itsourcecode Leave Management System Query Parameter controller.php redirect cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-11508 | code-projects Voting System voters_add.php unrestricted upload | 351000 |
| CVE-2025-11595 | Campcodes Online Apartment Visitor Management System admin-profile.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11663 | Campcodes Online Beauty Parlor Management System manage-services.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11664 | Campcodes Online Beauty Parlor Management System search-appointment.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11668 | code-projects Automated Voting System update_user.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-11946 | LogicalDOC Community Edition Add Contact frontend.jsp cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12226 | SourceCodester Best House Rental Management System admin_class.php save_house sql injection | 340016 , 340017 , 340144 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380122 |
| CVE-2025-12227 | projectworlds Gate Pass Management System add-pass.php cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12287 | Bdtask Wholesale Inventory Control and Inventory Management System edit_profile sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12294 | SourceCodester Point of Sales delete_category.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341145 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12314 | code-projects Food Ordering System deleteitem.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-12315 | code-projects Food Ordering System menu.php sql injection | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2025-13181 | pojoin h3blog add cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-13586 | SourceCodester Online Student Clearance System changepassword.php sql injection | 340017 , 380122 |
| CVE-2025-32785 | Pi-hole Admin Interface vulnerable to persistent XSS on Subscribed lists group management (Adress Field) | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-62653 | Stored XSS through system messages in PollNY | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-11425 | projectworlds Advanced Library Management System edit_admin.php cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 341256 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-11485 | SourceCodester Student Grades Management System Manage Users admin.php add_user cross site scripting | 340095 , 346755 |
| CVE-2025-12228 | projectworlds Expense Management System Users Page create cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 |
| CVE-2025-12229 | projectworlds Expense Management System Roles Page create cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 |
| CVE-2025-12230 | projectworlds Expense Management System Currency create cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12231 | projectworlds Expense Management System Expense Categories create cross site scripting | 333140 , 333141 , 340095 , 340147 , 340148 , 342259 , 346755 |
| CVE-2025-12311 | PHPGurukul Curfew e-Pass Management System edit-category-detail.php cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12312 | PHPGurukul Curfew e-Pass Management System view-pass-detail.php cross site scripting | 333140 , 333141 , 340087 , 340095 , 340099 , 340147 , 340148 , 341099 , 341256 , 341266 , 342259 , 346755 , 350147 , 350148 |
| CVE-2025-12332 | SourceCodester Student Grades Management System admin.php delete_user cross site scripting | 340095 , 346755 |