CVE Vulnerability Catalog

A vulnerability in SIMATIC IPC BX-21A, SIMATIC IPC RW-543A, and SIMATIC IPC227G / IPC277G / IPC277G PRO / IPC327G / IPC377G is due to the presence of a BIOS vendor test key in the UEFI Secure Boot key database. A local attacker with physical or administrative access can boot an operating system or UEFI application signed with that test key, bypassing UEFI Secure Boot protections even when Secure Boot is enabled, potentially leading to a full loss of confidentiality, integrity, and availability of the device.

A vulnerability in SIMATIC WinCC V7.5, V8.0, and V8.1 is due to insufficient restriction of permissions assigned to a database role. An authenticated remote attacker with database access can escalate privileges and execute arbitrary commands on the host system where SIMATIC WinCC is installed, potentially leading to system compromise.

A vulnerability in APOGEE MBC, APOGEE MEC, APOGEE PXC Compact, APOGEE PXC Modular, TALON TC Compact, and TALON TC Modular is due to lack of validation of user-supplied input in upload code in the web service. An unauthenticated remote attacker can cause a denial of service.

A vulnerability in the web service of APOGEE and TALON products. Improper validation of user input in multipart handling could allow an unauthenticated remote attacker to cause a denial of service.

A vulnerability in the FTP service of APOGEE and TALON products. Improper validation of input length could allow an unauthenticated remote attacker to cause a denial of service.

A vulnerability in the web service of APOGEE and TALON products. Improper validation of input length could allow an unauthenticated remote attacker to read portions of device memory or cause a denial-of-service condition.

Client-Side Enforcement of Server-Side Security vulnerability in Biletiva Ticketing Platform by Divasoft. Allows manipulating state.

Blind SQL Injection vulnerability in Link Whisper Free plugin. Improper neutralization of special elements in SQL command allows blind SQL injection.

A vulnerability in AdithyaYelloju Restaurant-Management-System. The mysqli_query function in Order Management component allows authorization bypass via manipulation of the ID argument.

SQL Injection vulnerability in User/forgot3.php of Password Reset component in Restaurant-Management-System. Manipulation of email/password arguments results in SQL injection.

A vulnerability in User/login.php of Login Form component in Restaurant-Management-System. Manipulation of email/passwd arguments leads to improper authentication.

Blind SQL Injection vulnerability in WOLF bulk-editor plugin by PluginUs.Net. Improper neutralization of special elements in SQL command allows blind SQL injection.

An incorrect permission assignment for critical resource in AssetView, AssetView CLOUD, and AssetView Cloud +. A local authenticated attacker may gain SYSTEM privileges.

Firefox for iOS directly interpolated the page's HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox's privileged content world and bypass the page's Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1.

The AcyMailing plugin for WordPress in versions up to and including 11.1.0 is vulnerable to Stored Cross-Site Scripting via the customField[] parameter of the public frontusers::subscribe endpoint. The acym_cleanVar() sanitizer only strips complete HTML tags, and SubscriberInsertion::replaceUserInformation() together with the archive view template insert the stored subscriber field value into the mail body without HTML encoding. This allows an unauthenticated attacker to inject arbitrary scripts that execute when the online-archive URL for the poisoned subscriber is accessed.

The Bit Integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress in all versions up to and including 2.10.6 is vulnerable to Stored Cross-Site Scripting via the field mapped to notification_content (attacker-chosen key, e.g. payload_text) due to insufficient input sanitization and output escaping. Exploitation requires a site administrator to have preconfigured a Bit Integrations flow binding the public Bit Assist webhook to a BuddyBoss "Send Notification" action with a form field mapped to notification_content, and the attacker to know the flow's UUID callback URL.

Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices), RUTOS 7.22 before 7.25.2 (TAP devices), and TSWOS 1.9 before 1.10.4 (TSW and SWM devices) allows a remote authenticated attacker to execute arbitrary OS commands.

A security flaw has been discovered in SourceCodester Library Management System 1.0 affecting the move_uploaded_file function in admin/add_admin.php. Manipulation of the image argument results in unrestricted upload. The attack may be initiated remotely and the exploit has been released to the public.

A vulnerability was identified in SourceCodester E-Learning System 1.0 affecting the save_users function in /classes/Users.php?f=save. Manipulation of the img argument leads to unrestricted upload. The attack can be launched remotely and the exploit is publicly available.

A vulnerability was determined in SourceCodester Contact Tracing System 1.0 affecting the move_uploaded_file function in /classes/Users.php?f=save. Manipulation of the img/id argument causes unrestricted upload. The attack can be initiated remotely and the exploit has been publicly disclosed.