CWE-94
Improper Control of Generation of Code ('Code Injection')
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CVE-2025-14538 (GCVE-0-2025-14538)
Vulnerability from cvelistv5 – Published: 2025-12-11 21:02 – Updated: 2025-12-12 21:48
VLAI
Title
yangshare warehouseManager 仓库管理系统 CustomerManageHandler.java addCustomer cross site scripting
Summary
A security vulnerability has been detected in yangshare warehouseManager 仓库管理系统 1.1.0. This affects the function addCustomer of the file CustomerManageHandler.java. Such manipulation of the argument Name leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.335877 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.335877 | signaturepermissions-required |
| https://vuldb.com/?submit.703736 | third-party-advisory |
| https://gitee.com/yangshare/warehouseManager/issu… | exploitissue-tracking |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| yangshare | warehouseManager 仓库管理系统 |
Affected:
1.1.0
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-14538",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-12T21:48:06.968791Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-12T21:48:16.525Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "warehouseManager \u4ed3\u5e93\u7ba1\u7406\u7cfb\u7edf",
"vendor": "yangshare",
"versions": [
{
"status": "affected",
"version": "1.1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "zzdzz (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in yangshare warehouseManager \u4ed3\u5e93\u7ba1\u7406\u7cfb\u7edf 1.1.0. This affects the function addCustomer of the file CustomerManageHandler.java. Such manipulation of the argument Name leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed publicly and may be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-11T21:02:10.087Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-335877 | yangshare warehouseManager \u4ed3\u5e93\u7ba1\u7406\u7cfb\u7edf CustomerManageHandler.java addCustomer cross site scripting",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.335877"
},
{
"name": "VDB-335877 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.335877"
},
{
"name": "Submit #703736 | gitee WarehouseManager v1.1.0 - Remove CAPTCHA Improper Neutralization of Alternate XSS Syntax",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.703736"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://gitee.com/yangshare/warehouseManager/issues/ID9NAU"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-12-11T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-12-11T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-12-11T12:09:52.000Z",
"value": "VulDB entry last update"
}
],
"title": "yangshare warehouseManager \u4ed3\u5e93\u7ba1\u7406\u7cfb\u7edf CustomerManageHandler.java addCustomer cross site scripting"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-14538",
"datePublished": "2025-12-11T21:02:10.087Z",
"dateReserved": "2025-12-11T11:04:48.830Z",
"dateUpdated": "2025-12-12T21:48:16.525Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-14539 (GCVE-0-2025-14539)
Vulnerability from cvelistv5 – Published: 2025-12-13 04:31 – Updated: 2026-04-08 17:06
VLAI
Title
Shortcode Loader <= 1.0 - Unauthenticated Arbitrary Shortcode Execution via 'code' Parameter
Summary
The The Shortcode Ajax plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.
Severity
5.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| rang501 | Shortcode Ajax |
Affected:
0 , ≤ 1.0
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-14539",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-15T15:43:18.640430Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-15T15:47:27.658Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Shortcode Ajax",
"vendor": "rang501",
"versions": [
{
"lessThanOrEqual": "1.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Ivan Cese"
}
],
"descriptions": [
{
"lang": "en",
"value": "The The Shortcode Ajax plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.0. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:06:17.381Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8e2a994f-7a42-4ccb-8fa0-77107ba1150c?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/shortcode-ajax/trunk/shortcode-ajax.php#L29"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-12-08T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2025-12-12T16:11:16.000Z",
"value": "Disclosed"
}
],
"title": "Shortcode Loader \u003c= 1.0 - Unauthenticated Arbitrary Shortcode Execution via \u0027code\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2025-14539",
"datePublished": "2025-12-13T04:31:29.334Z",
"dateReserved": "2025-12-11T11:11:50.073Z",
"dateUpdated": "2026-04-08T17:06:17.381Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-14541 (GCVE-0-2025-14541)
Vulnerability from cvelistv5 – Published: 2026-02-11 01:23 – Updated: 2026-04-08 17:14
VLAI
Title
Lucky Wheel Giveaway <= 1.0.22 - Authenticated (Administrator+) Remote Code Execution via 'conditional_tags' Parameter
Summary
The Lucky Wheel Giveaway plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.22 via the conditional_tags parameter. This is due to the plugin using PHP's eval() function on user-controlled input without proper validation or sanitization. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server.
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-94 - Improper Control of Generation of Code ('Code Injection')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| villatheme | Lucky Wheel Giveaway |
Affected:
0 , ≤ 1.0.22
(semver)
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-14541",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-02-11T15:40:35.381347Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-11T15:45:26.400Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Lucky Wheel Giveaway",
"vendor": "villatheme",
"versions": [
{
"lessThanOrEqual": "1.0.22",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Nguyen Truong"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Lucky Wheel Giveaway plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.0.22 via the conditional_tags parameter. This is due to the plugin using PHP\u0027s eval() function on user-controlled input without proper validation or sanitization. This makes it possible for authenticated attackers, with Administrator-level access and above, to execute code on the server."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:14:46.577Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ac0455a2-1fa8-4a37-a72f-9ed5cca1d9ee?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3439141/wp-lucky-wheel/trunk"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-12-08T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2025-12-11T13:13:10.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-02-10T11:56:58.000Z",
"value": "Disclosed"
}
],
"title": "Lucky Wheel Giveaway \u003c= 1.0.22 - Authenticated (Administrator+) Remote Code Execution via \u0027conditional_tags\u0027 Parameter"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2025-14541",
"datePublished": "2026-02-11T01:23:34.921Z",
"dateReserved": "2025-12-11T12:57:34.735Z",
"dateUpdated": "2026-04-08T17:14:46.577Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-14576 (GCVE-0-2025-14576)
Vulnerability from cvelistv5 – Published: 2026-04-30 12:39 – Updated: 2026-04-30 13:14
VLAI
Title
Possible QML code injection in VectorImage component
Summary
Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application's privilege level and data access.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://codereview.qt-project.org/c/qt/qtdeclarat… | patch |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| The Qt Company | Qt |
Affected:
6.8.0 , ≤ 6.8.6
(python)
Affected: 6.10.0 , ≤ 6.10.1 (python) |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-14576",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-30T13:13:55.418329Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-30T13:14:04.728Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://www.qt.io/",
"defaultStatus": "unaffected",
"modules": [
"Qt Declarative (Qt Quick)",
"VectorImage Component"
],
"packageName": "qtdeclarative",
"platforms": [
"Windows",
"MacOS",
"Linux",
"iOS",
"Android",
"x86",
"ARM",
"64 bit",
"32 bit"
],
"product": "Qt",
"vendor": "The Qt Company",
"versions": [
{
"lessThanOrEqual": "6.8.6",
"status": "affected",
"version": "6.8.0",
"versionType": "python"
},
{
"lessThanOrEqual": "6.10.1",
"status": "affected",
"version": "6.10.0",
"versionType": "python"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:the_qt_company:qt:*:*:windows:*:*:*:*:*",
"versionEndIncluding": "6.8.6",
"versionStartIncluding": "6.8.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:the_qt_company:qt:*:*:macos:*:*:*:*:*",
"versionEndIncluding": "6.8.6",
"versionStartIncluding": "6.8.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:the_qt_company:qt:*:*:linux:*:*:*:*:*",
"versionEndIncluding": "6.8.6",
"versionStartIncluding": "6.8.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:the_qt_company:qt:*:*:ios:*:*:*:*:*",
"versionEndIncluding": "6.8.6",
"versionStartIncluding": "6.8.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:the_qt_company:qt:*:*:android:*:*:*:*:*",
"versionEndIncluding": "6.8.6",
"versionStartIncluding": "6.8.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:the_qt_company:qt:*:*:x86:*:*:*:*:*",
"versionEndIncluding": "6.8.6",
"versionStartIncluding": "6.8.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:the_qt_company:qt:*:*:arm:*:*:*:*:*",
"versionEndIncluding": "6.8.6",
"versionStartIncluding": "6.8.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:the_qt_company:qt:*:*:64_bit:*:*:*:*:*",
"versionEndIncluding": "6.8.6",
"versionStartIncluding": "6.8.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:the_qt_company:qt:*:*:32_bit:*:*:*:*:*",
"versionEndIncluding": "6.8.6",
"versionStartIncluding": "6.8.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:the_qt_company:qt:*:*:windows:*:*:*:*:*",
"versionEndIncluding": "6.10.1",
"versionStartIncluding": "6.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:the_qt_company:qt:*:*:macos:*:*:*:*:*",
"versionEndIncluding": "6.10.1",
"versionStartIncluding": "6.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:the_qt_company:qt:*:*:linux:*:*:*:*:*",
"versionEndIncluding": "6.10.1",
"versionStartIncluding": "6.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:the_qt_company:qt:*:*:ios:*:*:*:*:*",
"versionEndIncluding": "6.10.1",
"versionStartIncluding": "6.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:the_qt_company:qt:*:*:android:*:*:*:*:*",
"versionEndIncluding": "6.10.1",
"versionStartIncluding": "6.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:the_qt_company:qt:*:*:x86:*:*:*:*:*",
"versionEndIncluding": "6.10.1",
"versionStartIncluding": "6.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:the_qt_company:qt:*:*:arm:*:*:*:*:*",
"versionEndIncluding": "6.10.1",
"versionStartIncluding": "6.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:the_qt_company:qt:*:*:64_bit:*:*:*:*:*",
"versionEndIncluding": "6.10.1",
"versionStartIncluding": "6.10.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:the_qt_company:qt:*:*:32_bit:*:*:*:*:*",
"versionEndIncluding": "6.10.1",
"versionStartIncluding": "6.10.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Qt Development Team"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eInsufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application\u0027s privilege level and data access.\u003c/p\u003e"
}
],
"value": "Insufficient validation of node IDs in Qt SVG module allows arbitrary QML/JavaScript code injection when loading malicious SVG files through the VectorImage component in Qt Quick. While QML execution is typically more restricted than native code execution, this could still lead to denial of service, information disclosure, or other impacts depending on the application\u0027s privilege level and data access."
}
],
"impacts": [
{
"capecId": "CAPEC-242",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-242 Code Injection"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"exploitMaturity": "UNREPORTED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "CWE-94 Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-30T12:51:40.517Z",
"orgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3",
"shortName": "TQtC"
},
"references": [
{
"name": "Qt Code Review - Fix for QTBUG-142556",
"tags": [
"patch"
],
"url": "https://codereview.qt-project.org/c/qt/qtdeclarative/+/697273"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpdate to Qt 6.8.7 or Qt 6.10.2 or later. As a temporary mitigation, validate and sanitize all SVG files before loading them with VectorImage, or only load SVG files from trusted sources.\u003c/p\u003e"
}
],
"value": "Update to Qt 6.8.7 or Qt 6.10.2 or later. As a temporary mitigation, validate and sanitize all SVG files before loading them with VectorImage, or only load SVG files from trusted sources."
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Possible QML code injection in VectorImage component",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "a59d8014-47c4-4630-ab43-e1b13cbe58e3",
"assignerShortName": "TQtC",
"cveId": "CVE-2025-14576",
"datePublished": "2026-04-30T12:39:40.067Z",
"dateReserved": "2025-12-12T12:52:21.516Z",
"dateUpdated": "2026-04-30T13:14:04.728Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-14580 (GCVE-0-2025-14580)
Vulnerability from cvelistv5 – Published: 2025-12-12 20:32 – Updated: 2026-02-24 05:47
VLAI
Title
Qualitor viewDocumento.php cross site scripting
Summary
A security vulnerability has been detected in Qualitor up to 8.24.73. The impacted element is an unknown function of the file /Qualitor/html/bc/bcdocumento9/biblioteca/request/viewDocumento.php. Such manipulation of the argument cdscript leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. It is suggested to upgrade the affected component. The vendor confirms the existence of the issue: "We became aware of the issue through an earlier direct notification from the original reporter, and our engineering team promptly investigated and implemented the necessary corrective measures. (...) Updated versions containing the fix have already been provided to our customer base".
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.336201 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.336201 | signaturepermissions-required |
| https://vuldb.com/?submit.705193 | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | Qualitor |
Affected:
8.24.0
Affected: 8.24.1 Affected: 8.24.2 Affected: 8.24.3 Affected: 8.24.4 Affected: 8.24.5 Affected: 8.24.6 Affected: 8.24.7 Affected: 8.24.8 Affected: 8.24.9 Affected: 8.24.10 Affected: 8.24.11 Affected: 8.24.12 Affected: 8.24.13 Affected: 8.24.14 Affected: 8.24.15 Affected: 8.24.16 Affected: 8.24.17 Affected: 8.24.18 Affected: 8.24.19 Affected: 8.24.20 Affected: 8.24.21 Affected: 8.24.22 Affected: 8.24.23 Affected: 8.24.24 Affected: 8.24.25 Affected: 8.24.26 Affected: 8.24.27 Affected: 8.24.28 Affected: 8.24.29 Affected: 8.24.30 Affected: 8.24.31 Affected: 8.24.32 Affected: 8.24.33 Affected: 8.24.34 Affected: 8.24.35 Affected: 8.24.36 Affected: 8.24.37 Affected: 8.24.38 Affected: 8.24.39 Affected: 8.24.40 Affected: 8.24.41 Affected: 8.24.42 Affected: 8.24.43 Affected: 8.24.44 Affected: 8.24.45 Affected: 8.24.46 Affected: 8.24.47 Affected: 8.24.48 Affected: 8.24.49 Affected: 8.24.50 Affected: 8.24.51 Affected: 8.24.52 Affected: 8.24.53 Affected: 8.24.54 Affected: 8.24.55 Affected: 8.24.56 Affected: 8.24.57 Affected: 8.24.58 Affected: 8.24.59 Affected: 8.24.60 Affected: 8.24.61 Affected: 8.24.62 Affected: 8.24.63 Affected: 8.24.64 Affected: 8.24.65 Affected: 8.24.66 Affected: 8.24.67 Affected: 8.24.68 Affected: 8.24.69 Affected: 8.24.70 Affected: 8.24.71 Affected: 8.24.72 Affected: 8.24.73 cpe:2.3:a:qualitor:qualitor:*:*:*:*:*:*:*:* |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-14580",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-15T18:06:21.441200Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-15T18:11:46.065Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:qualitor:qualitor:*:*:*:*:*:*:*:*"
],
"product": "Qualitor",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "8.24.0"
},
{
"status": "affected",
"version": "8.24.1"
},
{
"status": "affected",
"version": "8.24.2"
},
{
"status": "affected",
"version": "8.24.3"
},
{
"status": "affected",
"version": "8.24.4"
},
{
"status": "affected",
"version": "8.24.5"
},
{
"status": "affected",
"version": "8.24.6"
},
{
"status": "affected",
"version": "8.24.7"
},
{
"status": "affected",
"version": "8.24.8"
},
{
"status": "affected",
"version": "8.24.9"
},
{
"status": "affected",
"version": "8.24.10"
},
{
"status": "affected",
"version": "8.24.11"
},
{
"status": "affected",
"version": "8.24.12"
},
{
"status": "affected",
"version": "8.24.13"
},
{
"status": "affected",
"version": "8.24.14"
},
{
"status": "affected",
"version": "8.24.15"
},
{
"status": "affected",
"version": "8.24.16"
},
{
"status": "affected",
"version": "8.24.17"
},
{
"status": "affected",
"version": "8.24.18"
},
{
"status": "affected",
"version": "8.24.19"
},
{
"status": "affected",
"version": "8.24.20"
},
{
"status": "affected",
"version": "8.24.21"
},
{
"status": "affected",
"version": "8.24.22"
},
{
"status": "affected",
"version": "8.24.23"
},
{
"status": "affected",
"version": "8.24.24"
},
{
"status": "affected",
"version": "8.24.25"
},
{
"status": "affected",
"version": "8.24.26"
},
{
"status": "affected",
"version": "8.24.27"
},
{
"status": "affected",
"version": "8.24.28"
},
{
"status": "affected",
"version": "8.24.29"
},
{
"status": "affected",
"version": "8.24.30"
},
{
"status": "affected",
"version": "8.24.31"
},
{
"status": "affected",
"version": "8.24.32"
},
{
"status": "affected",
"version": "8.24.33"
},
{
"status": "affected",
"version": "8.24.34"
},
{
"status": "affected",
"version": "8.24.35"
},
{
"status": "affected",
"version": "8.24.36"
},
{
"status": "affected",
"version": "8.24.37"
},
{
"status": "affected",
"version": "8.24.38"
},
{
"status": "affected",
"version": "8.24.39"
},
{
"status": "affected",
"version": "8.24.40"
},
{
"status": "affected",
"version": "8.24.41"
},
{
"status": "affected",
"version": "8.24.42"
},
{
"status": "affected",
"version": "8.24.43"
},
{
"status": "affected",
"version": "8.24.44"
},
{
"status": "affected",
"version": "8.24.45"
},
{
"status": "affected",
"version": "8.24.46"
},
{
"status": "affected",
"version": "8.24.47"
},
{
"status": "affected",
"version": "8.24.48"
},
{
"status": "affected",
"version": "8.24.49"
},
{
"status": "affected",
"version": "8.24.50"
},
{
"status": "affected",
"version": "8.24.51"
},
{
"status": "affected",
"version": "8.24.52"
},
{
"status": "affected",
"version": "8.24.53"
},
{
"status": "affected",
"version": "8.24.54"
},
{
"status": "affected",
"version": "8.24.55"
},
{
"status": "affected",
"version": "8.24.56"
},
{
"status": "affected",
"version": "8.24.57"
},
{
"status": "affected",
"version": "8.24.58"
},
{
"status": "affected",
"version": "8.24.59"
},
{
"status": "affected",
"version": "8.24.60"
},
{
"status": "affected",
"version": "8.24.61"
},
{
"status": "affected",
"version": "8.24.62"
},
{
"status": "affected",
"version": "8.24.63"
},
{
"status": "affected",
"version": "8.24.64"
},
{
"status": "affected",
"version": "8.24.65"
},
{
"status": "affected",
"version": "8.24.66"
},
{
"status": "affected",
"version": "8.24.67"
},
{
"status": "affected",
"version": "8.24.68"
},
{
"status": "affected",
"version": "8.24.69"
},
{
"status": "affected",
"version": "8.24.70"
},
{
"status": "affected",
"version": "8.24.71"
},
{
"status": "affected",
"version": "8.24.72"
},
{
"status": "affected",
"version": "8.24.73"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "chor4o (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security vulnerability has been detected in Qualitor up to 8.24.73. The impacted element is an unknown function of the file /Qualitor/html/bc/bcdocumento9/biblioteca/request/viewDocumento.php. Such manipulation of the argument cdscript leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. It is suggested to upgrade the affected component. The vendor confirms the existence of the issue: \"We became aware of the issue through an earlier direct notification from the original reporter, and our engineering team promptly investigated and implemented the necessary corrective measures. (...) Updated versions containing the fix have already been provided to our customer base\"."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-02-24T05:47:47.304Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-336201 | Qualitor viewDocumento.php cross site scripting",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.336201"
},
{
"name": "VDB-336201 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.336201"
},
{
"name": "Submit #705193 | Qualitor 8.20.77 - 8.24.73 Cross Site Scripting",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.705193"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-12-12T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-12-12T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-12-20T04:51:24.000Z",
"value": "VulDB entry last update"
}
],
"title": "Qualitor viewDocumento.php cross site scripting"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-14580",
"datePublished": "2025-12-12T20:32:06.152Z",
"dateReserved": "2025-12-12T14:46:09.470Z",
"dateUpdated": "2026-02-24T05:47:47.304Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-1465 (GCVE-0-2025-1465)
Vulnerability from cvelistv5 – Published: 2025-02-19 15:31 – Updated: 2025-02-19 16:23
VLAI
Title
lmxcms Maintenance db.inc.php code injection
Summary
A vulnerability, which was classified as problematic, was found in lmxcms 1.41. Affected is an unknown function of the file db.inc.php of the component Maintenance. The manipulation leads to code injection. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
4.1 (Medium)
4.1 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.296238 | vdb-entry |
| https://vuldb.com/?ctiid.296238 | signaturepermissions-required |
| https://vuldb.com/?submit.496877 | third-party-advisory |
| https://github.com/NeoVuln/CVE/issues/6 | exploitissue-tracking |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-1465",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-19T16:14:27.371667Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-19T16:23:26.787Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Maintenance"
],
"product": "lmxcms",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "1.41"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Neo-O (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as problematic, was found in lmxcms 1.41. Affected is an unknown function of the file db.inc.php of the component Maintenance. The manipulation leads to code injection. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way."
},
{
"lang": "de",
"value": "Es wurde eine Schwachstelle in lmxcms 1.41 gefunden. Sie wurde als problematisch eingestuft. Dabei betrifft es einen unbekannter Codeteil der Datei db.inc.php der Komponente Maintenance. Durch Manipulieren mit unbekannten Daten kann eine code injection-Schwachstelle ausgenutzt werden. Die Umsetzung des Angriffs kann dabei \u00fcber das Netzwerk erfolgen. Die Komplexit\u00e4t eines Angriffs ist eher hoch. Sie gilt als schwierig auszunutzen. Der Exploit steht zur \u00f6ffentlichen Verf\u00fcgung."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4.3,
"vectorString": "AV:N/AC:H/Au:M/C:P/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-74",
"description": "Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-19T15:31:05.020Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-296238 | lmxcms Maintenance db.inc.php code injection",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.296238"
},
{
"name": "VDB-296238 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.296238"
},
{
"name": "Submit #496877 | LMXCMS lmxcms 1.41 Code Injection",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.496877"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/NeoVuln/CVE/issues/6"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-02-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-02-19T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-02-19T07:43:09.000Z",
"value": "VulDB entry last update"
}
],
"title": "lmxcms Maintenance db.inc.php code injection"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-1465",
"datePublished": "2025-02-19T15:31:05.020Z",
"dateReserved": "2025-02-19T06:38:06.254Z",
"dateUpdated": "2025-02-19T16:23:26.787Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-14662 (GCVE-0-2025-14662)
Vulnerability from cvelistv5 – Published: 2025-12-14 13:32 – Updated: 2025-12-15 20:49 X_Freeware
VLAI
Title
code-projects Student File Management System Update User update_user.php cross site scripting
Summary
A vulnerability was found in code-projects Student File Management System 1.0. This affects an unknown part of the file /admin/update_user.php of the component Update User Page. Performing manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.336394 | vdb-entry |
| https://vuldb.com/?ctiid.336394 | signaturepermissions-required |
| https://vuldb.com/?submit.713873 | third-party-advisory |
| https://github.com/jjjjj-zr/jjjjjzr15/issues/1 | exploitissue-tracking |
| https://code-projects.org/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| code-projects | Student File Management System |
Affected:
1.0
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-14662",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-15T20:49:35.696851Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-15T20:49:52.114Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Update User Page"
],
"product": "Student File Management System",
"vendor": "code-projects",
"versions": [
{
"status": "affected",
"version": "1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "jjzr (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in code-projects Student File Management System 1.0. This affects an unknown part of the file /admin/update_user.php of the component Update User Page. Performing manipulation results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.4,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.4,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 3.3,
"vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-14T13:32:06.818Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-336394 | code-projects Student File Management System Update User update_user.php cross site scripting",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.336394"
},
{
"name": "VDB-336394 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.336394"
},
{
"name": "Submit #713873 | Code-projects Student File Management System v1.0 Stored XSS vulnerability",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.713873"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/jjjjj-zr/jjjjjzr15/issues/1"
},
{
"tags": [
"product"
],
"url": "https://code-projects.org/"
}
],
"tags": [
"x_freeware"
],
"timeline": [
{
"lang": "en",
"time": "2025-12-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-12-13T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-12-13T14:33:48.000Z",
"value": "VulDB entry last update"
}
],
"title": "code-projects Student File Management System Update User update_user.php cross site scripting"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-14662",
"datePublished": "2025-12-14T13:32:06.818Z",
"dateReserved": "2025-12-13T13:28:43.115Z",
"dateUpdated": "2025-12-15T20:49:52.114Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-14663 (GCVE-0-2025-14663)
Vulnerability from cvelistv5 – Published: 2025-12-14 14:02 – Updated: 2025-12-15 20:48 X_Freeware
VLAI
Title
code-projects Student File Management System update_student.php cross site scripting
Summary
A vulnerability was determined in code-projects Student File Management System 1.0. This vulnerability affects unknown code of the file /admin/update_student.php. Executing manipulation can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.336395 | vdb-entry |
| https://vuldb.com/?ctiid.336395 | signaturepermissions-required |
| https://vuldb.com/?submit.714018 | third-party-advisory |
| https://github.com/jjjjj-zr/jjjjjzr16/issues/1 | exploitissue-tracking |
| https://code-projects.org/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| code-projects | Student File Management System |
Affected:
1.0
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-14663",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-15T20:48:10.154618Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-15T20:48:30.349Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Student File Management System",
"vendor": "code-projects",
"versions": [
{
"status": "affected",
"version": "1.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "jjzr (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in code-projects Student File Management System 1.0. This vulnerability affects unknown code of the file /admin/update_student.php. Executing manipulation can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.4,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.4,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 3.3,
"vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-14T14:02:08.318Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-336395 | code-projects Student File Management System update_student.php cross site scripting",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.336395"
},
{
"name": "VDB-336395 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.336395"
},
{
"name": "Submit #714018 | Code-projects Student File Management System v1.0 Stored XSS vulnerability",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.714018"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/jjjjj-zr/jjjjjzr16/issues/1"
},
{
"tags": [
"product"
],
"url": "https://code-projects.org/"
}
],
"tags": [
"x_freeware"
],
"timeline": [
{
"lang": "en",
"time": "2025-12-13T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-12-13T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-12-13T14:35:21.000Z",
"value": "VulDB entry last update"
}
],
"title": "code-projects Student File Management System update_student.php cross site scripting"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-14663",
"datePublished": "2025-12-14T14:02:08.318Z",
"dateReserved": "2025-12-13T13:30:17.874Z",
"dateUpdated": "2025-12-15T20:48:30.349Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-14691 (GCVE-0-2025-14691)
Vulnerability from cvelistv5 – Published: 2025-12-14 23:02 – Updated: 2025-12-15 20:07
VLAI
Title
Mayan EDMS authentication cross site scripting
Summary
A vulnerability was detected in Mayan EDMS up to 4.10.1. The affected element is an unknown function of the file /authentication/. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit is now public and may be used. Upgrading to version 4.10.2 is sufficient to fix this issue. You should upgrade the affected component. The vendor confirms that this is "[f]ixed in version 4.10.2". Furthermore, that "[b]ackports for older versions in process and will be out as soon as their respective CI pipelines complete."
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.336409 | vdb-entry |
| https://vuldb.com/?ctiid.336409 | signaturepermissions-required |
| https://vuldb.com/?submit.711713 | third-party-advisory |
| https://github.com/ionutluca888/Mayan-EDMS-XSS-POC | exploit |
| https://docs.mayan-edms.com/chapters/releases/4.1… | patch |
| https://docs.mayan-edms.com/chapters/releases/4.1… | patch |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-14691",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-15T20:06:05.802949Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-15T20:07:15.232Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "EDMS",
"vendor": "Mayan",
"versions": [
{
"status": "affected",
"version": "4.10.0"
},
{
"status": "affected",
"version": "4.10.1"
},
{
"status": "unaffected",
"version": "4.10.2"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "luca_irinel (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in Mayan EDMS up to 4.10.1. The affected element is an unknown function of the file /authentication/. The manipulation results in cross site scripting. The attack may be performed from remote. The exploit is now public and may be used. Upgrading to version 4.10.2 is sufficient to fix this issue. You should upgrade the affected component. The vendor confirms that this is \"[f]ixed in version 4.10.2\". Furthermore, that \"[b]ackports for older versions in process and will be out as soon as their respective CI pipelines complete.\""
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-14T23:02:08.010Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-336409 | Mayan EDMS authentication cross site scripting",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/?id.336409"
},
{
"name": "VDB-336409 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.336409"
},
{
"name": "Submit #711713 | Mayan EDMS CMS 4.10 Cross Site Scripting",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.711713"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/ionutluca888/Mayan-EDMS-XSS-POC"
},
{
"tags": [
"patch"
],
"url": "https://docs.mayan-edms.com/chapters/releases/4.10.2.html"
},
{
"tags": [
"patch"
],
"url": "https://docs.mayan-edms.com/chapters/releases/4.10.2.html#security"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-12-13T00:00:00.000Z",
"value": "Countermeasure disclosed"
},
{
"lang": "en",
"time": "2025-12-14T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-12-14T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-12-14T11:46:45.000Z",
"value": "VulDB entry last update"
}
],
"title": "Mayan EDMS authentication cross site scripting"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-14691",
"datePublished": "2025-12-14T23:02:08.010Z",
"dateReserved": "2025-12-14T10:41:29.284Z",
"dateUpdated": "2025-12-15T20:07:15.232Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-14722 (GCVE-0-2025-14722)
Vulnerability from cvelistv5 – Published: 2025-12-15 20:32 – Updated: 2025-12-15 21:09
VLAI
Title
vion707 DMadmin Backend AddonsController.class.php add cross site scripting
Summary
A vulnerability was determined in vion707 DMadmin up to 3403cafdb42537a648c30bf8cbc8148ec60437d1. This impacts the function Add of the file Admin/Controller/AddonsController.class.php of the component Backend. Executing manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.336467 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.336467 | signaturepermissions-required |
| https://vuldb.com/?submit.707130 | third-party-advisory |
| https://github.com/DeepMountains/zzz/blob/main/CV… | exploit |
Impacted products
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-14722",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-15T21:08:48.011340Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-15T21:09:11.656Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"modules": [
"Backend"
],
"product": "DMadmin",
"vendor": "vion707",
"versions": [
{
"status": "affected",
"version": "3403cafdb42537a648c30bf8cbc8148ec60437d1"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "Dee.Mirage (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in vion707 DMadmin up to 3403cafdb42537a648c30bf8cbc8148ec60437d1. This impacts the function Add of the file Admin/Controller/AddonsController.class.php of the component Backend. Executing manipulation can lead to cross site scripting. The attack can be executed remotely. The exploit has been publicly disclosed and may be utilized. This product implements a rolling release for ongoing delivery, which means version information for affected or updated releases is unavailable. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 2.4,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 2.4,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 3.3,
"vectorString": "AV:N/AC:L/Au:M/C:N/I:P/A:N/E:POC/RL:ND/RC:UR",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-94",
"description": "Code Injection",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-12-15T20:32:06.907Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-336467 | vion707 DMadmin Backend AddonsController.class.php add cross site scripting",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.336467"
},
{
"name": "VDB-336467 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.336467"
},
{
"name": "Submit #707130 | \u5927\u6f20\u6025\u901f\u5f00\u53d1 DMadmin Based on ThinkPhp 3.23 development version xss",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/?submit.707130"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/DeepMountains/zzz/blob/main/CVE-2025-2-2.md"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-12-15T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2025-12-15T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2025-12-15T16:06:56.000Z",
"value": "VulDB entry last update"
}
],
"title": "vion707 DMadmin Backend AddonsController.class.php add cross site scripting"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2025-14722",
"datePublished": "2025-12-15T20:32:06.907Z",
"dateReserved": "2025-12-15T15:01:44.445Z",
"dateUpdated": "2025-12-15T21:09:11.656Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Mitigation
Phase: Architecture and Design
Strategy: Refactoring
Description:
- Refactor your program so that you do not have to dynamically generate code.
Mitigation
Phase: Architecture and Design
Description:
- Run your code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which code can be executed by your product.
- Examples include the Unix chroot jail and AppArmor. In general, managed code may provide some protection.
- This may not be a feasible solution, and it only limits the impact to the operating system; the rest of your application may still be subject to compromise.
- Be careful to avoid CWE-243 and other weaknesses related to jails.
Mitigation ID: MIT-5
Phase: Implementation
Strategy: Input Validation
Description:
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of code injection, use stringent allowlists that limit which constructs are allowed. If you are dynamically constructing code that invokes a function, then verifying that the input is alphanumeric might be insufficient. An attacker might still be able to reference a dangerous function that you did not intend to allow, such as system(), exec(), or exit().
Mitigation
Phase: Testing
Description:
- Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
Mitigation ID: MIT-32
Phase: Operation
Strategy: Compilation or Build Hardening
Description:
- Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation ID: MIT-32
Phase: Operation
Strategy: Environment Hardening
Description:
- Run the code in an environment that performs automatic taint propagation and prevents any command execution that uses tainted variables, such as Perl's "-T" switch. This will force the program to perform validation steps that remove the taint, although you must be careful to correctly validate your inputs so that you do not accidentally mark dangerous inputs as untainted (see CWE-183 and CWE-184).
Mitigation
Phase: Implementation
Description:
- For Python programs, it is frequently encouraged to use the ast.literal_eval() function instead of eval, since it is intentionally designed to avoid executing code. However, an adversary could still cause excessive memory or stack consumption via deeply nested structures [REF-1372], so the python documentation discourages use of ast.literal_eval() on untrusted data [REF-1373].
CAPEC-242: Code Injection
An adversary exploits a weakness in input validation on the target to inject new code into that which is currently executing. This differs from code inclusion in that code inclusion involves the addition or replacement of a reference to a code file, which is subsequently loaded by the target and used as part of the code of some application.
CAPEC-35: Leverage Executable Code in Non-Executable Files
An attack of this type exploits a system's trust in configuration and resource files. When the executable loads the resource (such as an image file or configuration file) the attacker has modified the file to either execute malicious code directly or manipulate the target process (e.g. application server) to execute based on the malicious configuration parameters. Since systems are increasingly interrelated mashing up resources from local and remote sources the possibility of this attack occurring is high.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.