SQL injection in code-projects School Fees Payment System 1.0 allows remote authenticated attackers to execute arbitrary SQL commands via the name_startsWith parameter in /ajx.php. A public exploit is available, but no active exploitation has been reported. EPSS score is low (0.09%), indicating limited exploitation likelihood.
Cross-site scripting (XSS) in PHPGurukul Rail Pass Management System 1.0 allows remote attackers to inject arbitrary web scripts via the searchdata parameter in /rpms/download-pass.php. The vulnerability is publicly exploited with a disclosed proof-of-concept, though EPSS score is low (0.07%), indicating limited active exploitation.
Stored cross-site scripting in PHPGurukul Rail Pass Management System 1.0 allows an authenticated attacker to inject arbitrary JavaScript via the 'fullname' parameter in /admin/add-pass.php. The exploit has been publicly disclosed, increasing the risk of targeted attacks against administrative users.
Cross-site scripting (XSS) in PHPGurukul Restaurant Table Booking System 1.0 allows an authenticated attacker to inject arbitrary JavaScript via the searchdata parameter in /check-status.php. A public exploit exists, but no active exploitation has been reported; EPSS score is low (0.05%).
Cross-site scripting in PHPGurukul Restaurant Table Booking System 1.0 allows authenticated attackers with high privileges to inject arbitrary web script via the tableno parameter in the admin add-table page, enabling data manipulation or session theft when another administrator views the tainted content. No active exploitation has been confirmed, but a public proof-of-concept is available.
Cross-site scripting (XSS) in PHPGurukul Restaurant Table Booking System 1.0 allows authenticated admin users to inject arbitrary web scripts via the fullname parameter in /admin/manage-subadmins.php. Public exploit code exists, but no active exploitation has been reported and EPSS risk is low (0.05%).
Cross-site scripting (XSS) in PHPGurukul Restaurant Table Booking System 1.0 allows authenticated admin users to inject arbitrary web scripts via the 'fullname' parameter in /admin/add-subadmin.php. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.05%), indicating low exploitation likelihood.
Under certain conditions, SAP Business Objects Business Intelligence Platform allows an unauthenticated attacker to enumerate HTTP endpoints in the internal network by specially crafting HTTP requests. This disclosure of information could further enable the researcher to cause SSRF. It has no impact on integrity and availability of the application.
Adobe Experience Manager versions 6.5.22 and earlier are affected by an Improper Input Validation vulnerability that could result in a security feature bypass, allowing a low impact to the integrity of the component. Exploitation of this issue requires user interaction in that a victim must interact with the malicious content. Low privileges are required.
An incomplete cleanup vulnerability [CWE-459] in FortiOS 7.2 all versions and before & FortiProxy version 7.2.0 through 7.2.2 and before 7.0.8 allows a VDOM privileged attacker to add SSH key files on the system silently via crafted CLI requests.
CVE-2025-0036 is a security vulnerability (CVSS 3.2). Remediation should follow standard vulnerability management procedures.
CVE-2025-22251 is a security vulnerability (CVSS 3.1) that allows an unauthenticated attacker. Remediation should follow standard vulnerability management procedures.
Rejected reason: This CVE ID was issued in error by its CVE Numbering Authority and does not represent a valid vulnerability. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Unprotected SAPUI5 applications allow an attacker with basic privileges to inject malicious HTML code into a webpage, with the goal of redirecting users to the attacker controlled URL. This issue could impact the integrity of the application. Confidentiality or Availability are not impacted.
Dell Wyse Management Suite, versions prior to WMS 5.2, contain a Cross-Site Request Forgery (CSRF) vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery.
Cross-site scripting (XSS) in SourceCodester Online Student Clearance System 1.0 allows an authenticated attacker to inject arbitrary web scripts via the 'txtamt' parameter in /Admin/add-fee.php. The exploit has been publicly disclosed, increasing risk of targeted attacks, though EPSS score is low (0.04%).