CVE Vulnerability Catalog

A vulnerability was found in AdithyaYelloju Restaurant Management System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c in the function mysqli_query of file admin/add_table.php. Manipulation of the table/members/price arguments results in SQL injection. The attack can be launched remotely and the exploit has been made public.

A vulnerability has been found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c affecting unknown functionality of file admin/add_menu.php. Manipulation of the item/price/image/type arguments leads to SQL injection. The attack can be initiated remotely and the exploit has been disclosed to the public.

In the OrdaSoft Joomla Gallery extension for Joomla versions below 6.2.7, an authenticated privileged remote code execution vulnerability was found. The saveWatermark() function copies an uploaded file to a web-accessible directory using the client-supplied filename exactly as sent, with no extension check, content check, or filename sanitization. An authenticated core.manage user could upload a .php file disguised with an image Content-Type header and execute it directly by requesting the resulting path.

In the OrdaSoft Joomla Gallery extension for Joomla versions below 6.2.7, an authenticated privileged remote code execution vulnerability was found. The updateOSGallery() function, reached via task=update_osgallery, reads a JSON request body and calls the value of a method field as a live PHP function, passing the value of a package field as its single argument, with no allow-list or is_callable() check. Any function name compatible with a single argument is directly reachable, including system, exec, shell_exec, and passthru.

In the OrdaSoft Joomla Gallery extension for Joomla versions below 6.2.7, an authenticated privileged SQL injection vulnerability was found. The saveGallery() function passes form data through a hand-rolled parser into Joomla's Input object, then reads it back with ARRAY/STRING filter types, neither of which sanitizes SQL content. Values from category_names[], catOrderIds, and image-ordering fields are concatenated directly into SQL with no quoting or integer cast, giving an authenticated core.manage user full read/write access to the database, including UNION-based extraction of #__users password hashes.

In the OrdaSoft Joomla Gallery extension for Joomla versions below 6.2.7, an unauthenticated SQL injection vulnerability was found. The showSearchResult() and showSearchResultAjax() functions read the textsearch/searchText request parameter with $input->getVar(), which is not a real Joomla filter method and only strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a LIKE clause with no escaping. The endpoint requires no login, and the search module is public.

A flaw was found in vas3k TaxHacker up to 0.8.5 in the function testLLMProviderAction of the file app/(app)/apps/settings/actions.ts. Manipulation of the arguments provider/apiKey/model/baseUrl leads to server-side request forgery. The attack can be performed remotely and the exploit has been published.

A server-side request forgery vulnerability was detected in vas3k TaxHacker up to 0.8.5 in the generateInvoicePDF function of /apps/invoices/actions.ts in the Invoice PDF Renderer component. Manipulation of the businessLogo argument results in server-side request forgery, and the attack can be carried out remotely. The exploit is public and may be used, and the project has not responded to the issue report.

A server-side request forgery vulnerability was detected in NonceGeek dim-sum-app in the textSearchV2Handler function of deno/main.tsx in the Deno Backend component. Manipulation of the supabase_url argument leads to server-side request forgery, and the attack can be executed remotely. The exploit has been publicly disclosed and may be used, and the patch is named 8389032e5d52c28c4855c6126ca7d0eae8af346a.

A weakness was identified in 00Kisumi00 mcp-file-analyzer up to 84740852f0cf0cf5db4781b1ca6d7c6a6d210405 in the function ControlFlowNode of the file main.py of the analyze_csv_data MCP tool component. Manipulation of the argument filename causes path traversal. Remote exploitation is possible and the exploit is publicly available.

A security flaw was discovered in D-Link DIR-X1860 and DIR-X1860Z up to 1.0.2.220120.165402 in an unknown function of /ubus in the routerd component. Manipulation of the passwd_set argument results in improper access controls, and the attack must originate from the local network. The exploit has been released to the public and may be used for attacks.

A vulnerability was determined in SourceCodester Drug Recommendation System 1.0 in an unknown function of the file /drug_recommender/index.php. Manipulation of the argument full name leads to cross site scripting. The attack can be launched remotely and the exploit has been publicly disclosed.

A vulnerability was found in SourceCodester Drug Recommendation System 1.0. This issue affects some unknown processing of the file /drug_recommender/Admin/change_password of the component Password Change. Performing a manipulation of the argument txtoldpassword/txtnewpassword results in cross site scripting. The attack can be initiated remotely. The exploit has been made public and could be used.

A vulnerability has been found in SourceCodester Drug Recommendation System 1.0. This vulnerability affects unknown code of the file /drug_recommender/Admin/add_user of the component User Management. Such manipulation of the argument txtname/txtemail/txtpassword leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

A flaw was found in itsourcecode Leave Management System 1.0 in an unknown part of the file /module/department/index.php. Manipulation of the argument ID causes SQL injection. The attack can be initiated remotely and the exploit has been published.

A vulnerability was detected in 0-Gaurav-0 nexus-mcp version aed0026e7ac1f23dc940e46e9fd3a2da6904f914 in the function child_process.exec of the file src/auth/browser.ts of the nexus_reauth MCP tool component. Manipulation of the argument url results in command injection. The attack can be performed remotely and the exploit is now public.

A security vulnerability has been detected in SerenityOS up to 3d83e4509fd20d7438e1ae8470ffe668c136229c. Affected by this vulnerability is the function decode_bmp_pixel_data of the file Userland/Libraries/LibGfx/ImageFormats/BMPLoader.cpp of the component LibGfx. The manipulation of the argument height leads to integer overflow. The attack is possible to be carried out remotely. The attack's complexity is rated as high. The exploitation appears to be difficult. The exploit has been disclosed publicly and may be used. This product adopts a rolling release strategy to maintain continuous delivery. Therefore, version details for affected or updated releases cannot be specified. The identifier of the patch is 007041bb2dd6d140c9e707caddfb0a49ecf96469. Applying a patch is the recommended action to fix this issue. This was reproducible with a minimal 55-byte PoC via the standard image-decode fuzz target but evidence for an actual exploitable defect is thin.

A weakness was identified in mealie-recipes Mealie up to 3.25.1 in the function payload.model_dump of the file mealie/routes/households/controller_group_recipe_actions.py of the Recipe Action Trigger component. Manipulation of the argument url leads to server-side request forgery. The attack can be executed remotely and the exploit is publicly available.

A security flaw has been discovered in SourceCodester Drug Recommendation System 1.0. This impacts an unknown function of the file /drug_recommender/Admin/add_symptom. Performing a manipulation of the argument txtname results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

A SQL injection vulnerability was identified in SourceCodester Drug Recommendation System 1.0 in an unknown function of /drug_recommender/Admin/edit_user.php. Manipulation of the ID argument leads to SQL injection, and the attack may be launched remotely. The exploit is publicly available and might be used.