CVE Vulnerability Catalog

A SQL injection vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script 1.0 in the file /admin/mensproductdeletequery.php. An attacker can remotely manipulate the user_id argument, leading to SQL injection. The exploit has been publicly disclosed.

A SQL injection vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script 1.0 in the file /admin/login.php. An attacker can remotely manipulate the Username argument, leading to SQL injection. The exploit has been made public and could be used.

A vulnerability was found in code-projects Online Voting System 1.0 in the file /saveVote.php. The test_input function fails to properly sanitize user input, allowing SQL injection via the voterName, voterEmail, voterID, and selectedCandidate parameters. The attack can be performed remotely.

A SQL injection vulnerability was found in the Online Voting System up to version 1.0 in the test_input function of /authentication.php (Login component). Manipulating adminUserName/adminPassword arguments allows remote SQL injection.

A SQL injection vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the /edit_class2.php file. Manipulation of the ID argument allows remote SQL injection. The exploit is publicly available.

A SQL injection vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the /edit_course.php file. An attacker can remotely manipulate the ID argument, leading to unauthorized database access. The exploit has been publicly disclosed and may be used.

A SQL injection vulnerability was found in CodeAstro Apartment Visitor Management System 1.0 in the /index.php file within the Login component. Manipulating the Username argument allows an attacker to inject SQL code. The attack can be performed remotely and the exploit has been made public.

A deserialization vulnerability was found in the getCartItems function of ShoppingCart.php in Ecommerce-CodeIgniter-Bootstrap. The attack can be launched remotely by manipulating the shopping_cart argument. The exploit has been publicly disclosed, increasing the risk of exploitation.

Dancer2::Plugin::Auth::OAuth::Provider versions before 0.23 for Perl lack OAuth 2.0 state parameter support. The authentication_url method does not issue a state value, and the callback method does not verify the callback corresponds to the session's authorization request, enabling login CSRF attacks.

The vulnerability in the Plack::Middleware::OAuth library for Perl (versions up to 0.10) is due to missing support for the OAuth 2.0 state parameter. The authorization request does not generate a unique identifier, and the callback code verification does not check if it originates from the same session, enabling login CSRF attacks.

A path traversal vulnerability was discovered in Ecommerce-CodeIgniter-Bootstrap up to commit 222ff31c06687b1c6d0e1ab63953f82c3674c52b in the file application/modules/vendor/controllers/AddProduct.php of the Vendor Multi-Image Endpoint. An attacker can remotely manipulate the folder argument, leading to unauthorized file access. The exploit has been publicly released and may be used in attacks.

In fickling up to version 0.1.11, the UnsafeImportsML analysis pass registers shortened code for every import in a shared set, causing the subsequent MLAllowlist pass to skip all checks as already reported. This renders MLAllowlist dead code, allowing imports of modules outside the allowlist (e.g., torch, numpy) to be missed, leading to a false LIKELY_SAFE verdict.

The vulnerability in fickling up to version 0.1.10 is due to missing Python standard library modules (_posixsubprocess, site, atexit) in the UNSAFE_IMPORTS denylist. This causes check_safety() to incorrectly mark malicious pickle payloads as LIKELY_SAFE, allowing deserialization and execution of dangerous functions like fork_exec, execsitecustomize, or _run_exitfuncs.

In the Linux kernel's af_unix subsystem, a synchronization issue was found in the unix_gc() function. The gc_in_progress flag could be set to false while the garbage collector was still running, allowing another GC run to start prematurely. The unix_peek_fpl() function relies on this flag to avoid errors with MSG_PEEK.

A critical vulnerability in the Linux kernel's KVM/SEV component for AMD EPYC processors with SEV-SNP support. The lack of requiring the scratch area to reside in the GHCB v2+ shared buffer, combined with multiple validation flaws, allows a malicious SNP guest to perform out-of-bounds (OOB) reads and writes in the host kernel heap.

A use-after-free vulnerability was found in the Linux kernel's KVM shadow paging for x86. The bug occurs due to a role mismatch when a PDE mapping is changed from outside the guest, causing reuse of a kvm_mmu_page with an incorrect role. This leads to a dangling rmap entry after memslot deletion, and subsequent operations on the freed page cause memory corruption.

HestiaCP panel contains a broken access control vulnerability in the cronjob feature. Low privilege users can modify panel cronjobs to execute HestiaCP management scripts with passwordless sudo.

myVesta is affected by an authenticated remote code execution vulnerability. Low privileged users can inject arbitrary commands via the v_ftp_user parameter when deleting FTP usernames.

A missing authentication vulnerability was found in the AJAX Endpoint component of restaurant-website-php-mysql, specifically in the /admin/ajax_files file. Remote attackers can manipulate the endpoint without authentication. The exploit has been publicly disclosed, increasing the risk of attacks.