Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High7.1i-doit CMDB 1.12 contains an arbitrary file download vulnerability that allows authenticated attackers to download sensitive files by manipulating the file parameter in index.php.EPSS 0.4%Mar 21, 2026
- High7.5SimpleJWT is a simple JSON web token library written in PHP.Mar 20, 2026
- High7.2An issue in the component /Controllers/RestController.php of DreamFactory Core v1.0.3 allows attackers to execute a directory traversal via an unsanitized URI path.EPSS 0.9%Mar 20, 2026
- Medium5.1XinLiangCoder php_api_doc through commit 1ce5bbf contains a reflected cross-site scripting vulnerability in list_method.php that allows remote attackers to execute arb…Mar 20, 2026
- High8.2phpseclib is a PHP secure communications library.Mar 20, 2026
- High8.8Open Source Point of Sale is a web based point-of-sale application written in PHP using CodeIgniter framework.Mar 20, 2026
- Critical9.3FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.Mar 19, 2026
- High8.5FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.Mar 19, 2026
- High8.1FreeScout is a free help desk and shared inbox built with PHP's Laravel framework.Mar 19, 2026
- High8.8Devome GRR v4.5.0 was discovered to contain multiple authenticated SQL injection vulnerabilities in the include/session.inc.php file via the referer and user-agent.Mar 19, 2026
- High8.8The script in Use It Flow administration website before 10.0.0 is vulnerable to Remote Code Execution.EPSS 0.6%Mar 16, 2026
- High7.5SQL Injection vulnerability in Chyrp v.2.5.2 and before allows a remote attacker to obtain sensitive information via the Admin.php componentEPSS 0.4%Mar 16, 2026
- High8.2xmlseclibs is a library written in PHP for working with XML Encryption and Signatures.Mar 16, 2026
- Medium5.1RealtyScript 4.0.2 Stored Cross-Site Scripting via text Parameter in pages.phpEPSS 0.2%Mar 15, 2026
- Medium5.1Next Click Ventures RealtyScript 4.0.2 fails to properly sanitize file uploads, allowing attackers to store malicious scripts through the file POST parameter in admin/tools.php.EPSS 0.3%Mar 15, 2026
- High8.8Netartmedia PHP Mall 4.1 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries through unvalidated parameters.EPSS 0.4%Mar 12, 2026
- High8.8Netartmedia PHP Mall 4.1 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to manipulate database queries by injecting SQL code thro…EPSS 0.4%Mar 12, 2026
- High8.8Netartmedia Deals Portal contains an SQL injection vulnerability in the Email parameter of loginaction.php that allows unauthenticated attackers to manipulate database queries.EPSS 0.3%Mar 12, 2026
- High8.8Jettweb PHP Hazir Haber Sitesi Scripti V1 contains an authentication bypass vulnerability in the administration panel that allows unauthenticated attackers to gain adm…EPSS 0.4%Mar 12, 2026
- High8.8Jettweb PHP Hazir Haber Sitesi Scripti V1 contains an SQL injection vulnerability that allows attackers to manipulate database queries by injecting malicious SQL code…EPSS 0.3%Mar 12, 2026
- High8.8Jettweb PHP Hazir Haber Sitesi Scripti V1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL…EPSS 0.4%Mar 12, 2026
- High8.8Jettweb PHP Hazir Haber Sitesi Scripti V1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL…EPSS 0.5%Mar 12, 2026
- High8.8Jettweb PHP Hazir Haber Sitesi Scripti V1 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL…EPSS 0.5%Mar 12, 2026
- High8.7Jettweb PHP Hazir Haber Sitesi Scripti V3 contains an authentication bypass vulnerability in the login.php administration panel that allows unauthenticated attackers t…EPSS 1.1%Mar 12, 2026
- High8.8Jettweb PHP Hazir Haber Sitesi Scripti V3 contains an SQL injection vulnerability that allows attackers to inject malicious SQL commands through the kelime parameter i…EPSS 0.5%Mar 12, 2026