CVE Vulnerability Catalog

A stack-based buffer overflow vulnerability has been found in Tenda CX12L version 16.03.53.12 in the form_fast_setting_wifi_set function of the /goform/fast_setting_wifi_set file. Manipulation of the ssid argument leads to buffer overflow. The attack can be launched remotely and the exploit is public.

A security flaw in SourceCodester Hospitals Patient Records Management System 1.0 allows SQL injection in the file /classes/Master.php?f=save_patient via the ID argument. The attack can be launched remotely and the exploit has been publicly released.

VMware Cloud Foundation Operations contains multiple stored cross-site scripting vulnerabilities. A malicious actor with privileges to create policies, views or text-widgets may inject scripts to perform administrative actions.

VMware Cloud Foundation Operations has multiple stored XSS vulnerabilities. A user with privileges to create policies, views, or text widgets can inject scripts to perform administrative actions.

VMware Cloud Foundation Operations has multiple stored cross-site scripting vulnerabilities. An attacker with privileges to create policies, views or text-widgets can inject scripts to perform administrative actions.

In Samba's WINS server component when running as an Active Directory Domain Controller, protocol handlers for certain request types do not properly validate incoming packets. An unauthenticated remote attacker can send specially crafted UDP packets, triggering a NULL pointer dereference and crashing the WINS service.

A vulnerability in Tenda HG7, HG9 and HG10 devices affects the asp_voip_OtherSet function in the /boaform/voip_other_set file of the Web Management Interface. Manipulating the funckey_transfer argument leads to a stack-based buffer overflow, which can be exploited remotely.

Online Music Site 1.0 by code-projects has a SQL Injection vulnerability in /Frontend/Search.php via the Category argument. The attack can be performed remotely, and the exploit is publicly available.

A SQL injection vulnerability was found in code-projects Online Music Site 1.0 in the file /Administrator/PHP/AdminDeleteAlbum.php via manipulation of the ID argument. The attack can be performed remotely and the exploit is public.

A SQL injection vulnerability was found in code-projects Simple Flight Ticket Booking System 1.0 in the file checkUser.php of the POST Parameter Handler component via manipulation of the Username argument. The attack can be performed remotely and the exploit is public.

A SQL injection vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the file /archive1.php via manipulation of the sy argument. The attack can be performed remotely and the exploit is public.

A SQL injection vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the file /archive2.php via the sy parameter. The attack can be performed remotely and the exploit has been published.

A SQL injection vulnerability has been identified in SourceCodester Class and Exam Timetabling System 1.0 in the file /archive3.php via the sy parameter. The attack can be performed remotely and the exploit is publicly available.

A security flaw was discovered in SourceCodester Class and Exam Timetabling System 1.0 in the file /archive4.php, where manipulation of the sy parameter leads to SQL injection. The attack can be performed remotely and the exploit has been made public.

SourceCodester Class and Exam Timetabling System 1.0 has a SQL Injection vulnerability in /archive5.php via the sy argument. The attack can be performed remotely, and the exploit is publicly available.

Stored XSS vulnerability in WordPress Sonaar Music Plugin 4.7. Unauthenticated attackers can inject malicious scripts via the comment functionality, which are stored and executed in browsers of users viewing playlist pages.

The WordPress Augmented-Reality plugin contains a remote code execution vulnerability in the elFinder component. An unauthenticated attacker can send POST requests to the connector.minimal.php endpoint, creating malicious PHP files in the file_manager directory and executing them on the server.

Kushan2k student-management-system up to commit f16a4ce has an unrestricted file upload vulnerability in service/RegisterService.php via the stimg argument. The attack can be performed remotely, and the exploit is publicly available. The project has not responded.

A SQL injection vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the file /index1.php via the Password argument. The attack can be performed remotely and the exploit has been publicly disclosed.

A SQL injection vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the file /index2.php via the Password argument. The attack can be performed remotely and the exploit has been publicly disclosed.