CVE Vulnerability Catalog

In the Contacts service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.

In ims service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.

In Contacts Service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.

In Contacts Service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.

A critical vulnerability has been found in SourceCodester Resort Reservation System version 1.0. Manipulation of the 'id' argument in the view_fee.php file leads to SQL injection, which can be exploited remotely.

A critical vulnerability was found in SourceCodester Resort Reservation System version 1.0. Manipulation of the 'id' argument in the manage_user.php file leads to SQL injection, which can be executed remotely.

A critical vulnerability has been found in SourceCodester Resort Reservation System version 1.0. Manipulation of the 'page' argument in the index.php file leads to file inclusion, which can be exploited remotely.

A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository cockpit-hq/cockpit prior to version 2.6.3, allowing for the storage of malicious code.

A critical vulnerability was found in SourceCodester Pharmacy Management System version 1.0. It affects an unknown functionality of the file manage_website.php, leading to unrestricted file uploads.

A critical vulnerability was found in SourceCodester Online Hospital Management System version 1.0. Manipulation of the loginid and password arguments in the patientlogin.php file leads to SQL injection.

A vulnerability has been found in SourceCodester Inventory Management System 1.0 affecting unknown code of the file edit_update.php of the Password Handler component. Manipulation of the argument user_id leads to improper access controls.

A critical vulnerability has been found in SourceCodester Free Hospital Management System for Small Practices 1.0. The issue affects some unknown functionality of the file /vm/admin/delete-doctor.php?id=2 of the Redirect Handler component, leading to enforcement of unwanted workflow.

A critical vulnerability has been found in SourceCodester Free Hospital Management System for Small Practices version 1.0. Manipulation of the 'id' argument in the file /vm/doctor/doctors.php?action=view leads to SQL injection, which can be executed remotely.

All versions of Apache Roller have insufficient input validation and sanitation in the category name, website about, and file upload features, allowing an authenticated user to perform an XSS attack.

A critical vulnerability was found in SourceCodester Hospital Management System version 1.0. Manipulation of the 'time' argument in the appointmentapproval.php file leads to SQL injection.

Insufficient session expiration in the GitHub repository admidio/admidio prior to version 4.2.11 may lead to unauthorized access.

A vulnerability classified as problematic was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0, allowing absolute path traversal via the FileDirectory argument in the file Service/FileHandler.ashx. The attack can be initiated remotely, and the exploit has been publicly disclosed.

The HTTP Headers plugin by Dimitar Ivanov in versions up to 1.18.11 has a stored Cross-Site Scripting (XSS) vulnerability with admin privileges.

The WP-buy WP Content Copy Protection & No Right Click plugin versions up to 3.5.5 contains a stored Cross-Site Scripting (XSS) vulnerability with admin-level permissions. An attacker can exploit this vulnerability to inject malicious scripts that will be executed in the context of users visiting the site.

The My Content Management plugin versions up to 1.7.6 has a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will be executed in the victim's browser context.