CVE Vulnerability Catalog

A SQL injection vulnerability was discovered in the Admin page of Maid Hiring Management System v1.0. This allows an attacker to manipulate database queries.

Online Nurse Hiring System v1.0 was found to have a cross-site scripting (XSS) vulnerability in the Add Nurse page of the Admin portal. An attacker can inject malicious scripts that execute in the administrator's browser.

Online Nurse Hiring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the Search Report Page of the Admin portal. This allows an attacker to inject malicious scripts into the administrator's browser.

Online Nurse Hiring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the Search Report Details of the Admin portal. This allows an attacker to inject malicious scripts into the victim's browser.

Online Nurse Hiring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the Admin Profile Page. This allows an attacker to inject malicious scripts via unsanitized input.

The WP-Cirrus plugin versions up to 0.6.11 contain a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will be executed in the victim's browser context.

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.4). The affected applications accept unauthenticated file write messages.

In PHOENIX CONTACT's TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 and CLOUD CLIENT 1101T-TX/TX prior to 2.06.10, an authenticated remote attacker with admin privileges could upload a crafted XML file, leading to a denial-of-service.

In SAP BusinessObjects Business Intelligence version 420, if a user logs into a specific program, under certain specific conditions memory may not be cleared properly, which could allow an attacker to access user credentials.

In SAP Supplier Relationship Management versions 600, 602, 603, 604, 605, 606, 616, 617, there is a vulnerability that allows an unauthorized attacker to discover information related to SRM within Vendor Master Data. This information could be used to tailor attacks against SRM.

SAP NetWeaver Application Server ABAP and ABAP Platform in versions from 700 to 804 do not perform necessary authorization checks for an authenticated user, resulting in privilege escalation. This could allow an attacker to access sensitive information that can be used in a subsequent serious attack.

In SAP NetWeaver Process Integration versions SAP_XIESR 7.50, SAP_XITOOL 7.50, SAP_XIAF 7.50, insufficiently encoded user-controlled inputs may lead to a Cross-Site Scripting (XSS) attack. Successful exploitation could impact the confidentiality and integrity of the system.

SAP Business One (Service Layer) version 10.0 allows an authenticated attacker with deep knowledge to perform certain operations to access unintended data over the network.

Under certain conditions, SAP Commerce API (OCC) in versions HY_COM 2105, HY_COM 2205, COM_CLOUD 2211 allows an attacker to access information that would otherwise be restricted. Successful exploitation could lead to a high impact on confidentiality.

SAP PowerDesigner version 16.7 queries all password hashes in the backend database and compares them with the user-provided one during login attempts. This may allow an attacker to access password hashes from the client's memory.

PrestaShop is an open source e-commerce application. Prior to version 8.1.1, it was possible to delete files from the server via the CustomerMessage API.

PrestaShop prior to version 8.1.1 allows for file deletion from the server using the Attachments controller and the Attachments API. Version 8.1.1 contains a patch for this issue.

PrestaShop prior to version 8.1.1 contained the `displayAjaxEmailHTML` method that could be exploited to read any file on the server, potentially even outside of the project if the server is not correctly configured.

PrestaShop prior to version 8.1.1 has a vulnerability in the back office that allows file compromise through a path traversal attack. This can be achieved by replaying the import file deletion query with a specified file path that exploits this vulnerability.

ScanCode.io prior to version 32.5.1 has a command injection vulnerability in the docker fetch process. It allows appending malicious commands in the `docker_reference` parameter, leading to unauthorized command execution.