CVE Vulnerability Catalog

IBM DB2 High Performance Unload in the listed versions could allow an authenticated user to cause the program to crash due to an out of bounds write.

IBM DB2 High Performance Unload in the listed versions could allow an authenticated user to cause the program to crash due to a buffer being overwritten when it is allocated on the stack.

A SQL injection vulnerability was identified in shawon100 RUET OJ within the file /contestproblem.php, triggered by manipulation of the Name argument. The attack can be launched remotely, and a publicly available exploit might be used. The product operates on a rolling release basis, so no version details are available.

A security flaw has been discovered in code-projects Simple Food Ordering System 1.0. This vulnerability affects unknown code of the file /addproduct.php. The manipulation of the argument pname/category/price results in cross site scripting. It is possible to launch the attack remotely. The exploit has been released to the public and may be exploited.

A SQL injection vulnerability was found in CodeAstro Gym Management System 1.0 in the file /admin/actions/remove-announcement.php. Manipulation of the argument ID allows remote attack. The exploit has been made public and could be used.

The Online Event Judging System 1.0 by code-projects is vulnerable to SQL injection in /edit_contestant.php via the contestant_id argument. The attack can be executed remotely, and the exploit is publicly available.

The Entrada theme by Waituk contains a Cross-Site Request Forgery vulnerability in versions from n/a through 5.7.7. This vulnerability allows an attacker to leverage CSRF to perform unauthorized actions in the context of a logged-in administrator.

The Builderall Builder for WordPress plugin (builderall-cheetah-for-wp) is vulnerable to Stored XSS due to improper neutralization of input during web page generation. This issue affects versions from n/a through <= 3.0.1.

The 百度站长SEO合集 (baiduseo) plugin contains a missing authorization vulnerability that allows accessing functionality not properly constrained by ACLs. This issue affects 百度站长SEO合集 from n/a through <= 2.1.4.

BuddyForms (Themekraft plugin) up to version 2.10.2 contains a missing authorization vulnerability, allowing access to functionality not properly constrained by ACLs. Attackers can exploit this for unauthorized operations.

The WebinarPress plugin (wp-webinarsystem) contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through <= 1.33.28.

The DirectoryPress plugin (directorypress) is vulnerable to DOM-Based XSS due to improper neutralization of input during web page generation. This issue affects versions from n/a through <= 3.6.25.

The H5P plugin (icc0rz) contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through <= 1.16.0.

The Post List Featured Image plugin (Johnny) contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through <= 0.5.9.

The Open Close WooCommerce Store plugin (versions up to and including 5.0.0) contains a Missing Authorization vulnerability. It allows exploitation of incorrectly configured access control security levels.

The Custom Post Type Attachment plugin (aviplugins.com) contains a Stored Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions from n/a through <= 3.4.6.

Cross-Site Request Forgery (CSRF) vulnerability in Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars) allows Cross Site Request Forgery. This issue affects Off-Canvas Sidebars & Menus (Slidebars) from n/a through <= 0.5.8.5.

The Password Policy Manager | Password Manager plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the 'moppm_ajax' AJAX endpoint in all versions up to and including 2.0.5. This allows authenticated attackers with Subscriber-level access or higher to log out the site's connection to miniorange.

A vulnerability was found in the NDIS Usermode IO driver (RtkIOAC60.sys, version 6.0.5600.16348) that allows a local authenticated attacker to send a crafted IOCTL request, causing a denial of service (DoS).

PerfreeBlog version 4.0.11 has an arbitrary file read vulnerability in the validThemeFilePath function. It allows an attacker to read arbitrary files on the server.