CVE Vulnerability Catalog

A critical vulnerability was found in Campcodes Retro Cellphone Online Store version 1.0, affecting an unknown function in the file /admin/edit_product.php. Manipulation of the argument username leads to SQL injection.

Some Zoom clients may expose information intended to be encrypted, potentially leading to the disclosure of sensitive data.

A reflected cross site scripting (XSS) vulnerability was discovered in Sophos Web Appliance v4.3.9.1 that allows for arbitrary code to be inputted via double quotes.

The thorsten/phpmyfaq GitHub repository prior to version 3.2.0-beta.2 is vulnerable to reflected Cross-site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious scripts that will be executed in users' browsers.

A stored Cross-Site Scripting (XSS) vulnerability was found in firmware version 2.2.6733 of the Multilaser RE 170 router. It allows an attacker to inject a malicious script that will execute in other users' browsers.

The affected TBox RTUs are missing authorization for running some API commands. An attacker could exploit these commands to reveal sensitive information such as software versions and web server file contents.

Tuleap has an issue with managing user permissions after changing project visibility. Restricted users who were project administrators before the visibility switch retain access to the project and can perform administrative actions.

ILIAS versions 7.21 and 8.0_beta1 through 8.2 are vulnerable to reflected Cross-Site Scripting (XSS).

ILIAS versions 7.21 and 8.0_beta1 through 8.2 are vulnerable to stored Cross Site Scripting (XSS).

Telegram v9.6.3 on iOS allows attackers to hide critical information on the User Interface via calling the function SFSafariViewController.

An issue was discovered in the Cargo extension for MediaWiki through version 1.39.3, allowing the storage of javascript: URLs in URL fields and automatically linking these URLs.

An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In Special:CheckUser, a check of the 'get edits' type is vulnerable to HTML injection through the User-Agent HTTP request header.

An issue was discovered in the Cargo extension for MediaWiki through 1.39.3 related to XSS. This can occur in Special:CargoQuery via a crafted page item when using the default format.

An issue was discovered in the GoogleAnalyticsMetrics extension for MediaWiki through 1.39.3, where the googleanalyticstrackurl parser function does not properly escape JavaScript in the onclick handler and does not prevent the use of javascript: URLs.

Multiple Cross-Site Scripting (XSS) vulnerabilities have been identified in Gibbon v25.0.0, which enable attackers to execute arbitrary Javascript code.

A critical vulnerability was found in SourceCodester Shopping Website 1.0, related to the forgot-password.php file. Manipulation of the contact argument leads to SQL injection, which can be exploited remotely.

A critical vulnerability was found in SourceCodester Shopping Website 1.0, affecting an unknown function in the index.php file. Manipulation of the username argument leads to SQL injection.

The Online Hotel Management System Project in PHP version 1.0.0 is vulnerable to Cross Site Scripting (XSS). Remote code execution can be achieved by entering malicious code in the date selection box.

A ReDoS issue was discovered in the URI component before version 0.12.2 for Ruby. The URI parser mishandles invalid URLs with specific characters, leading to increased execution time when parsing strings to URI objects.

MCL-Net version 4.3.5.8788 has a Directory Browsing vulnerability that allows attackers to gain sensitive information about the configured databases via the '/file' endpoint.