CVE Vulnerability Catalog

A vulnerability was found in itsourcecode Payroll System 1.0 in the save_settings function of admin_class.php. Manipulation of the img argument results in unrestricted upload. The attack can be performed remotely, and the exploit has been made public.

A vulnerability was found in itsourcecode Payroll System 1.0 in the Login function of admin_class.php. Manipulation of the Username argument leads to SQL injection. The attack can be performed remotely, and the exploit has been disclosed publicly.

A flaw has been found in itsourcecode Library Management System 1.0. The affected element is an unknown function of the file editbooks.php. Executing a manipulation of the argument ID can lead to sql injection. The attack can be executed remotely. The exploit has been published and may be used.

A vulnerability was detected in SourceCodester Simple Online Food Ordering System 1.0 in an unknown function of the file /fos/view_prod.php. Manipulation of the ID argument results in SQL injection. Remote exploitation is possible, and the exploit is now public.

A security vulnerability has been detected in SourceCodester Simple Online Food Ordering System 1.0 in some unknown processing of the file /fos/admin/ajax.php?action=add_to_cart. Manipulation of the pid argument leads to SQL injection. The attack may be launched remotely, and the exploit has been disclosed publicly.

A weakness has been identified in SourceCodester Simple Online Food Ordering System 1.0. This vulnerability affects unknown code in the file /fos/admin/ajax.php?action=save_user. Manipulation of the Username argument causes SQL injection. The attack may be initiated remotely, and the exploit is public.

A security flaw was discovered in expo-share-intent up to version 8.0.0 in the getDataColumn function of ExpoShareIntentModule.kt in the Android File Copy Routine component. Manipulation of the _display_name argument results in path traversal. The attack requires local access.

A vulnerability has been found in Piwigo 16.3.0 in an unknown function of the Public Authentication Page component. Manipulation of the lang argument leads to cross site scripting. The attack may be performed remotely, but is difficult to exploit. The exploit has been disclosed. Upgrading to version 16.4.0 fixes this issue.

A flaw was found in Open5GS up to version 2.8.0 in an unknown function of src/hss/hss-cx-path.c in the HSS component. Manipulation of the User-Name argument causes a reachable assertion. The attack can be carried out remotely, and the exploit has been published.

Sakura Editor provided by Sakura Editor Development Community contains an OS command injection vulnerability. If a victim user is directed to edit a file in a crafted directory, arbitrary OS commands may be executed on the user's PC when the user invokes "Open Terminal".

Heptabase developed by Hepta Platforms, Inc. has a Stored Cross-Site Scripting vulnerability. Authenticated remote attackers can inject persistent malicious content into specific pages, causing arbitrary JavaScript code to execute when other users click the crafted content.

The 4MOSAn product by 4MOSAn Security Technology Co., Ltd. has an Arbitrary File Read vulnerability. Unauthenticated remote attackers can exploit a Relative Path Traversal flaw to download arbitrary system files.

The 4MOSAn GCB Doctor product by 4MOSAn Security Technology has an OS Command Injection vulnerability. Unauthenticated remote attackers can inject malicious commands through an unremoved ADOdb test page parameter, thereby executing arbitrary system commands on the server.

A vulnerability was detected in Sales and Inventory System 1.0 in an unknown function of /pages/cust_edit.php. Manipulation of the ID argument results in SQL injection. The attack can be executed remotely, and the exploit is now public.

A security vulnerability has been detected in Shenzhen Gongji Technology XBROTHER Dynamic Environment Monitoring System up to 300R004C00B300. The affected element is the function PlanController.getImmediatePlans of the file /xbreport/api/v1/plamange/plansImmediate. Manipulation of the order/sort arguments leads to SQL injection. Remote exploitation is possible, and the exploit is public.

A vulnerability was identified in ractivejs up to 1.4.4 in the Ractive#set function of the Keypath Handler component. Manipulation can lead to improperly controlled modification of object prototype attributes. The attack can be launched remotely and the exploit has been made public.

A security flaw was discovered in alibaba-fusion next up to 1.27.34 in the ConfigProvider.getContextProps function of the deepMerge component. Manipulating the locale argument results in improperly controlled modification of object prototype attributes. The attack can be initiated remotely.

A vulnerability was identified in phaser3-rex-notes up to version 1.80.17 in the SetValue function of plugins/utils/object/SetValue.js in the BehaviorTree Blackboard Data Interface component. Manipulation of the key argument leads to improperly controlled modification of object prototype attributes. The attack can be launched remotely.

NewSiteServer (NSS) developed by CyberTutor has a Missing Authentication vulnerability. Unauthenticated remote attackers can exploit a specific functionality to send emails to anyone on behalf of the school.

NewSiteServer (NSS) developed by CyberTutor has an Arbitrary File Upload vulnerability. Unauthenticated remote attackers can upload arbitrary files, including malicious HTML files, thereby achieving effects similar to cross-site scripting.