Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,871

CVE-2026-10228

raisulislamg4 student_management_system_by_php admission_form_check.php cross site scripting

A vulnerability was found in raisulislamg4 student_management_system_by_php up to 310d950e09013d5133c6b9210aff9444382d16d1. The impacted element is an unknown function of the file admission_form_check.php. The manipulation of the argument Message results in cross site scripting. The attack can be executed remotely. The exploit has been made public and could be used. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Raisulislamg4
Products
Student Management System By Php
CVE-2024-12137

Authentication Bypass in Elfatek Elektronics' ANKA JPD-00028

Authentication Bypass by Capture-replay vulnerability in Elfatek Elektronics ANKA JPD-00028 allows Session Hijacking. This issue affects ANKA JPD-00028: before V.01.01.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-10250

itsourcecode Online Blood Bank Management System campsdetails.php sql injection

A security flaw has been discovered in itsourcecode Online Blood Bank Management System 1.0. The affected element is an unknown function of the file /admin/campsdetails.php. Performing a manipulation of the argument hospital results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Itsourcecode
Products
Online Blood Bank Management System
CVE-2026-10247

SourceCodester Pharmacy Sales and Inventory System main create_generic_name cross site scripting

A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0. This vulnerability affects the function create_generic_name of the file /ShowForm/create_generic_name/main. The manipulation of the argument generic_name results in cross site scripting. The attack may be launched remotely. The exploit has been made public and could be used.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Sourcecodester
Products
Pharmacy Sales And Inventory System
CVE-2024-12143

SQLi in Mobilteg Mobile Informatics' Mikro Hand Terminal - MikroDB

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mobilteg Mobile Informatics Mikro Hand Terminal - MikroDB allows SQL Injection. This issue affects Mikro Hand Terminal - MikroDB.  NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2024-12144

SQLi in Finder Fire Safety's Finder ERP/CRM (Old System)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Finder Fire Safety Finder ERP/CRM (Old System) allows SQL Injection. This issue affects Finder ERP/CRM (Old System): before 18.12.2024.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2024-12146

SQLi in Finder Fire Safety's Finder ERP/CRM (New System)

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Finder Fire Safety Finder ERP/CRM (New System) allows SQL Injection. This issue affects Finder ERP/CRM (New System): before 18.12.2024.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-40543

Missing Authorization in SOPlanning

SOPlanning does not enforce authorization for backup functionalities. An unauthenticated attacker can directly query backup-related endpoints and retrieve backup archives containing user databases with usernames and password hashes, as well as the config.csv file, which includes additional sensitive information. This issue affects SOPlanning version 1.55 and below.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Soplanning
Products
Soplanning
CVE-2024-12150

SQLi in Eron Software's Wowwo CRM

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Eron Software Wowwo CRM allows Blind SQL Injection. This issue affects Wowwo CRM.  NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-40544

Stored XSS in SOPlanning

SOPlanning is vulnerable to Stored Cross-Site Scripting (XSS) via /process/upload_backup endpoint. An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containing a malicious user.csv file with embedded JavaScript. The injected code is executed in the victim’s browser when a user clicks the Edit button for the malicious backup. This issue affects SOPlanning version 1.55 and below.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Soplanning
Products
Soplanning
CVE-2024-12364

SQLi in Mavi Yeşil Software's Guest Tracking Software

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mavi Yeşil Software Guest Tracking Software allows SQL Injection. This issue affects Guest Tracking Software.  NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-40549

Cross-Site Request Forgery in SOPlanning

SOPlanning is vulnerable to Cross‑Site Request Forgery (CSRF) in groupe_save create, modify and delete endpoints. An attacker can craft a malicious website that, when visited by an authenticated user, automatically sends a forged GET or POST request to the application. This issue affects SOPlanning version 1.55 and below.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Soplanning
Products
Soplanning
CVE-2026-40548

Unrestricted Upload of File with Dangerous Type in SOPlanning

SOPlanning does not verify uploaded file extension. An authenticated attacker with access to the backup functionality can upload a crafted ZIP archive containing a legitimate user.csv file alongside a malicious file, which is extracted on the server. When combined with CVE-2026-40547 (Path Traversal), the malicious file (e.g., a PHP script) can be placed in a web-accessible location and executed via the browser. This issue affects SOPlanning version 1.55 and below.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Soplanning
Products
Soplanning
CVE-2024-12367

Information Disclosure in Vegagrup Software's Vega Master

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Vegagrup Software Vega Master allows Directory Indexing. This issue affects Vega Master: from v.1.12.35 through 20250916.  NOTE: The vendor did not inform about the completion of the fixing process within the specified time. The CVE will be updated when new information becomes available.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Vegagrup
Products
Vega Master
CVE-2026-40547

Path Traversal in SOPlanning

SOPlanning is vulnerable to Path Traversal in backup endpoints. Authenticated remote attacker is able to exploit a vulnerable endpoint and construct payloads that allow reading and executing files previously added through the backup functionality. Critically, due to CVE-2026-40543 (Missing Authorization), any backup file can be read by any (unauthorized) user. This issue affects SOPlanning version 1.55 and below.

CVSS 4.0 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Soplanning
Products
Soplanning
CVE-2026-40546

Multiple SQL Injections in SOPlanning

SOPlanning is vulnerable to SQL Injection across multiple endpoints and parameters. Attacker with low privileges can inject arbitrary SQL commands, potentially gaining full control over the database. This issue affects SOPlanning version 1.55 and below.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Soplanning
Products
Soplanning
CVE-2026-40545

Reflected XSS in SOPlanning

SOPlanning is vulnerable to Reflected XSS via the taches parameter. An attacker can craft a malicious URL which, when opened by authenticated victim, results in arbitrary JavaScript execution in the victim’s browser. This issue affects SOPlanning version 1.55 and below.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Soplanning
Products
Soplanning
CVE-2024-12604

Improper Authentication in Tapandsign Technologies Tap and Sign App

Cleartext Storage of Sensitive Information in an Environment Variable, Weak Password Recovery Mechanism for Forgotten Password vulnerability in Tapandsign Technologies Tap&Sign App allows Password Recovery Exploitation, Functionality Misuse. This issue affects Tap&Sign App: before V.1.025.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Tapandsign
Products
Tap\&sign
CVE-2024-12651

Sensitive Data Exposure in PTT Inc.'s HGS Mobile App

Exposed Dangerous Method or Function vulnerability in PTT Inc. HGS Mobile App allows Manipulating User-Controlled Variables. This issue affects HGS Mobile App: before 6.5.0.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2024-12796

Reflected XSS in Holistic IT, Consultancy Coop.'s Workcube ERP

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Holistic IT, Consultancy Coop. Workcube ERP allows Reflected XSS. This issue affects Workcube ERP: from V12 - V14 before Cognitive.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Holistic It
Products
Workcube Erp