Y4y17/CVE

Releases0

Stars1

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2026-37430 ↗	May 13, 2026Wednesday, 13 May 2026, 14:17	7.3 HIGH	—
An arbitrary file upload vulnerability in the ShopOrderImportController.java component of qihang-wms commit 75c15a allows attackers to execute arbitrary code via uploading a crafted file.
CVE-2026-37429 ↗	May 13, 2026Wednesday, 13 May 2026, 14:17	6.5 MEDIUM	—
qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysUserMapper.xml file. This vulnerability allows attackers to access sensitive database information, including users' Personally Identifiable Information (PII) via a crafted SQL statement.
CVE-2026-37428 ↗	May 13, 2026Wednesday, 13 May 2026, 14:17	6.5 MEDIUM	—
qihang-wms commit 75c15a was discovered to contain a SQL injection vulnerability via the datascope parameter in the SysDeptMapper.xml file. This vulnerability allows attackers to access sensitive database information, including users' Personally Identifiable Information (PII).
CVE-2026-37431 ↗	May 8, 2026Friday, 8 May 2026, 15:16	9.8 CRITICAL	—
Beauty Parlour Management System v1.1 was discovered to contain a SQL injection vulnerability via the aptnumber parameter in the /appointment-detail.php endpoint. This vulnerability allows attackers to access sensitive database information via a crafted SQL statement.
CVE-2025-69992 ↗	Jan 13, 2026Tuesday, 13 January 2026, 16:16	9.8 CRITICAL	—
phpgurukul News Portal Project V4.1 has File Upload Vulnerability via upload.php, which enables the upload of files of any format to the server without identity authentication.
CVE-2025-69991 ↗	Jan 13, 2026Tuesday, 13 January 2026, 16:16	9.8 CRITICAL	—
phpgurukul News Portal Project V4.1 is vulnerable to SQL Injection in check_availablity.php.
CVE-2025-69990 ↗	Jan 13, 2026Tuesday, 13 January 2026, 16:16	9.1 CRITICAL	—
phpgurukul News Portal Project V4.1 has an Arbitrary File Deletion Vulnerability in remove_file.php. The parameter file can cause any file to be deleted.
CVE-2025-55910 ↗	Sep 19, 2025Friday, 19 September 2025, 16:15	6.3 MEDIUM	—
CMSEasy v7.7.8.0 and before is vulnerable to Arbitrary file deletion in database_admin.php.
CVE-2025-51818 ↗	Aug 21, 2025Thursday, 21 August 2025, 14:15	5.4 MEDIUM	—
MCCMS 2.7.0 is vulnerable to Arbitrary file deletion in the Backups.php component. This allows an attacker to execute arbitrary commands
CVE-2025-51655 ↗	Jul 14, 2025Monday, 14 July 2025, 17:15	5.4 MEDIUM	—
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Quanxian.php.
CVE-2025-51660 ↗	Jul 14, 2025Monday, 14 July 2025, 17:15	5.4 MEDIUM	—
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the lgid parameter at SEMCMS_Products.php.
CVE-2025-51659 ↗	Jul 14, 2025Monday, 14 July 2025, 17:15	5.4 MEDIUM	—
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_Products.php.
CVE-2025-51658 ↗	Jul 14, 2025Monday, 14 July 2025, 17:15	5.4 MEDIUM	—
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_InquiryView.php.
CVE-2025-51657 ↗	Jul 14, 2025Monday, 14 July 2025, 17:15	5.4 MEDIUM	—
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the lgid parameter at SEMCMS_Link.php.
CVE-2025-51656 ↗	Jul 14, 2025Monday, 14 July 2025, 17:15	5.4 MEDIUM	—
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the ID parameter at SEMCMS_Link.php.
CVE-2025-51651 ↗	Jul 14, 2025Monday, 14 July 2025, 17:15	5.5 MEDIUM	—
An authenticated arbitrary file download vulnerability in the component /admin/Backups.php of Mccms v2.7.0 allows attackers to download arbitrary files via a crafted GET request.
CVE-2025-51654 ↗	Jul 14, 2025Monday, 14 July 2025, 17:15	5.4 MEDIUM	—
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Infocategories.php.
CVE-2025-51653 ↗	Jul 14, 2025Monday, 14 July 2025, 17:15	5.4 MEDIUM	—
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_ct.php.
CVE-2025-51652 ↗	Jul 14, 2025Monday, 14 July 2025, 17:15	5.4 MEDIUM	—
SemCms v5.0 was discovered to contain a SQL injection vulnerability via the pid parameter at SEMCMS_Categories.php.