CVE Vulnerability Catalog

PHPgurukl Hospital Management System v.1.0 is vulnerable to Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious scripts in the context of the victim's browser.

PHPgurukl Small CRM version 1.0 is vulnerable to Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code in the context of the user's browser.

An unauthenticated attacker within BLE proximity can remotely connect to a 7-Eleven LED Message Cup, Hello Cup 1.3.1 for Android, and bypass the application's client-side chat censor filter.

A critical vulnerability was found in the Ruijie RG-BCR860 device version 2.5.13, affecting unknown processing of the Network Diagnostic Page component. Manipulation leads to OS command injection.

A critical vulnerability has been found in IBOS OA 4.5.5 affecting the actionExport function of the file ?r=recruit/interview/export&interviews=x of the Interview Management Export component. Manipulation of the interviews argument leads to SQL injection.

A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository spinacms/spina prior to version 2.15.1, allowing for the storage of malicious code.

Reflected XSS vulnerability affects the 'mode' parameter in the /admin functionality of the web application in versions <=2.0.44.

The Subscribe2 plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 10.40. This is due to missing or incorrect nonce validation when sending test emails.

The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 8.4.6. This is due to missing or incorrect nonce validation on the 'save_customer' function, allowing unauthenticated attackers to change the admin role to customer or modify user meta via a forged request.

A vulnerability in NEC Aterm devices allows an attacker to execute arbitrary scripts after obtaining high privileges by exploiting the previous vulnerabilities CVE-2023-3330 and CVE-2023-3331.

The CVE-2023-3331 vulnerability in NEC Corporation Aterm products has an improper limitation of a pathname to a restricted directory, allowing an attacker to delete specific files in the product.

CVE-2023-3330 describes an improper limitation of a pathname to a restricted directory vulnerability in NEC Corporation products, allowing an attacker to access specific files on the device.

The pypdf library, an open-source pure-Python library, has a vulnerability that can lead to an infinite loop when processing a malicious PDF file. This issue occurs in versions where the `__parse_content_stream` method is executed.

Meldekarten generator is an open source project that allows creating, storing, and printing registration cards for volunteers. All text fields on the webpage are vulnerable to XSS attacks as user input isn't (fully) sanitized after submission.

A CSRF vulnerability in Issabel issabel-pbx v.4.0.0-6 allows a remote attacker to gain privileges via a Custom CSRF exploit to create new user function in the application.

A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary code via a crafted script to the Description parameter.

A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary code via a vulnerable parameter GrpPath.

A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary code via a crafted script to the Dtltyp and ListName parameters.

A Cross Site Scripting vulnerability in Microworld Technologies eScan Management console v.14.0.1400.2281 allows a remote attacker to execute arbitrary JavaScript code via a vulnerable delete_file parameter.