CVE Vulnerability Catalog

A vulnerability has been found in SourceCodester Online Reviewer Management System 1.0 in an unknown function of the file /reviewer_0/admins/assessments/databank/btn_functions.php?action=add. The manipulation of the argument difficulty_id leads to SQL injection. Remote exploitation is possible, and the exploit has been disclosed publicly.

Deserialization vulnerability in Dask up to 2026.8.0. Affects from_npy_stack in dask/array/core.py in Loader component. Remote attack, exploit public.

SQL Injection vulnerability in Restaurant-Management-System up to specific commit. Affects mysqli_query in admin/display_menu.php in Search Form component. Manipulation of s1 argument allows remote SQL injection. Exploit public.

SQL Injection vulnerability in Leave Management System 1.0. Affects unknown function in /module/leavetype/index.php. Manipulation of ID argument allows remote SQL injection. Exploit public.

Unrestricted upload vulnerability in Pixtream up to specific commit. Affects unknown processing in /post_upload.php. Manipulation of media argument allows remote attack. Exploit public.

A vulnerability was identified in TDuckCloud tduck-platform up to 5.3. It affects the PaginationInnerInterceptor.concatOrderBy function in MybatisPlusConfig.java, where manipulation of the orders[0].column argument leads to SQL injection. The attack can be launched remotely and a public exploit is available.

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains an OS command injection vulnerability in recbackup. An authenticated administrator can supply crafted backup-area configuration input that is passed to a shell command, allowing commands to execute with the privileges of the nvr user. The underlying design has been present since at least firmware 2.2.3.4. This vulnerability is resolved in OpenEye Apex version 3.4.3.

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 uses an administrator password-reset unlock-code design lacking a per-device secret or server-side cryptographic material. An attacker with physical-console access and access to the privileged password-reset workflow can forge a valid unlock code offline and reset the administrator password. The design has been present since at least firmware 2.2.3.4.

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 trusts an X-Forwarded-For header supplied by an arbitrary client when determining the request source address. An unauthenticated remote attacker can spoof a loopback address to bypass local-connection-only security controls on non-TLS web interfaces and disclose configuration information. The design has been present since at least firmware 2.2.3.4.

OpenEye Apex Network Video Recorder (NVR) firmware 3.2.9.376 contains a hardcoded, undocumented recovery account with a shared credential that cannot be changed, disabled, or rotated. An unauthenticated remote attacker can use the account to authenticate to the password-reset workflow. The account does not provide normal administrator access; additional vulnerabilities are required for administrator takeover. The design has been present since at least firmware 2.2.3.4.

A vulnerability was determined in Mstfakts College-Management-System affecting the session_start function in Front-end/server.php within the Authentication component. Manipulation leads to session fixation. The attack can be launched remotely and the exploit has been publicly disclosed. The product uses rolling releases, so version details are unavailable. The project was informed but has not responded.

A vulnerability was found in anirbandutta9 College-Notes-Gallery up to 8c1cf3d98f30982d069c88ca172612c001eb39f6. It affects unknown functionality of /dashboard/userprofile.php?section=admin1. Manipulation of the image argument results in unrestricted upload. The attack can be launched remotely and the exploit has been made public. The product uses rolling releases, so no version details are available. The vendor was contacted but did not respond.

ReactPress is a publishing system for React developers. Prior to version 3.7.0, ReactPress API list endpoints build TypeORM `QueryBuilder` conditions using unsanitized HTTP query parameter names as SQL column identifiers (e.g. `` `article.${key}` ``). TypeORM parameterizes values but not column names, allowing unauthenticated attackers to inject SQL through crafted query string keys. Version 3.7.0 contains a patch. As a workaround, allowlist allowed filter column names before interpolating into SQL.

plone.app.dexterity is a content-type system for Plone, and plone.app.contenttypes provides Dexterity-based content types. Versions through 3.2.2, 4.0.0 through 4.1.2, and 5.0.0 of plone.app.dexterity, and through 3.0.11, 4.0.0 through 4.0.9, and 5.0.0 of plone.app.contenttypes are vulnerable to denial of service because an authenticated user can create content with excessively long titles, descriptions, or uploaded-file names, causing Plone to become unresponsive and potentially making the content difficult to edit or delete. The vulnerability is patched in plone.app.dexterity 3.2.3, 4.1.3, and 5.0.1, and plone.app.contenttypes 3.0.12, 4.0.10, and 5.0.1.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to cleartext transmission of sensitive information.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper enforcement of mutual TLS authentication.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to obtain sensitive information due to improper restriction of XML external entity references.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to cause a denial of service due to allocation of resources without limits or throttling.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to obtain sensitive information due to improper validation of symbolic links.

IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute arbitrary code due to improper deserialization of untrusted data.