CVE Vulnerability Catalog

A SQL injection vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0 in the file /edit_exam1.php. An unknown function improperly handles the ID argument, allowing remote attackers to execute arbitrary SQL queries. The exploit has been published and may be used.

A SQL injection vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the /edit_room.php file. An attacker can remotely manipulate the ID argument, leading to SQL injection. The exploit is publicly available.

A SQL injection vulnerability has been detected in code-projects Real State Services 1.0 in the /pay.php file via the Bankname argument. The attack can be performed remotely, and the exploit has been publicly disclosed.

A SQL injection vulnerability has been found in code-projects Real State Services 1.0 in the /builderHome.php file. An attacker can remotely manipulate the loc argument, leading to unauthorized database access. The exploit has been made public, increasing the risk of attacks.

AIL Framework has a path traversal vulnerability in its PDF object handling. The PDF.get_filepath() function constructs a file path by joining the configured PDF storage directory with a PDF object identifier without verifying the resolved path stays within the intended PDF_FOLDER directory. An authenticated attacker can use crafted identifiers with relative traversal sequences or absolute path components to open files outside the PDF directory, potentially disclosing sensitive data.

A SQL injection vulnerability has been found in the Hotel and Tourism Reservation 1.0 system in the /admin/add_event.php file. An attacker can remotely manipulate the fdetails argument, leading to SQL injection.

A SQL injection vulnerability has been found in the Hotel and Tourism Reservation 1.0 system in the /admin/tour_reserves.php file. An attacker can remotely manipulate the tour argument, leading to SQL code injection. The exploit has been published and may be used.

A SQL Injection vulnerability was found in Hotel and Tourism Reservation 1.0 in the /admin/rooms.php file. An attacker can remotely manipulate the delete argument, leading to SQL injection. The exploit is publicly available.

A vulnerability in Pardus-Parental-Control allows DNS spoofing due to incorrect permission assignment for critical resources and improper access control. The issue affects versions up to and including 0.5.1, before 0.7.0.

Missing authorization in Pardus Update allows privilege escalation. The vulnerability affects versions 0.6.3 and earlier, fixed in version 0.6.6.

A SQL injection vulnerability was found in the Hotel and Tourism Reservation 1.0 system in the file /admin/add_tour.php. Manipulation of the delete_image argument allows SQL injection. The attack can be launched remotely and the exploit is publicly available.

A SQL Injection vulnerability has been found in code-projects Hotel and Tourism Reservation 1.0 in the file /admin/reservations.php. The unknown functionality of the Reservations Management Page allows manipulation of the delete argument, enabling remote SQL injection. The exploit has been publicly disclosed.

A vulnerability in Pardus Domain Joiner allows sensitive information exposure during process invocation. Affected versions are from 0.5.2 before 0.5.4, enabling data excavation.

A SQL injection vulnerability has been found in Hotel and Tourism Reservation 1.0 in the file /admin/add_room.php. An attacker can remotely manipulate arguments delete_image, edit, description, number, price, rooms, or type, leading to unauthorized database access. The exploit has been published and may be used.

A vulnerability was found in mjperpinosa stumasy up to commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be. An unknown function in /PHP/objects/notes within the Note Handler/Assignment Handler component allows authorization bypass via manipulation of the assignment_item_id argument. The attack is remotely exploitable and the exploit is public.

A SQL injection vulnerability was discovered in mjperpinosa stumasy up to commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be in the Notes_controller::accessing_dictionary_authorization function. Remote attacks are possible by manipulating the Password argument. The exploit has been publicly released, increasing the risk of exploitation.

A vulnerability was found in mjperpinosa stumasy up to version 327d1b0f2915ba79d7ef8ebb74553e987609d9be in the eval function of calculate.php. Manipulating the mathematical_sentence argument allows remote code injection. The exploit is publicly available and may be used.

A SQL Injection vulnerability was found in Real State Services 1.0 in the /addprojectsale.php file. An attacker can remotely manipulate the amen argument, leading to SQL injection.

A SQL Injection vulnerability has been detected in code-projects Real State Services 1.0. The flaw exists in the /addprojectrent.php file, where the amen argument is susceptible to SQL injection. The attack can be performed remotely, and the exploit has been publicly disclosed.

A SQL injection vulnerability has been found in Real State Services 1.0 in the /single-list_rent.php file. Manipulating the ID argument allows remote exploitation. A public exploit increases the risk of attacks.