CVE Vulnerability Catalog

Unauthenticated arbitrary file deletion vulnerability in WooCommerce File Approval versions up to 10.7.

Unauthenticated arbitrary file download vulnerability in Super Forms versions up to 6.3.315.

Unauthenticated Cross Site Scripting (XSS) vulnerability in Tourmaster versions up to 5.4.9.

Unauthenticated Privilege Escalation in Digits versions up to 9.2. An attacker can gain elevated privileges without authentication.

Unauthenticated Cross Site Scripting (XSS) vulnerability in Events Made Easy versions up to 3.2.5.

Unauthenticated Broken Access Control vulnerability in Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More versions up to 1.7.1.

Unauthenticated Local File Inclusion in Tonda Core versions prior to 2.6.

Unauthenticated Local File Inclusion in Tonda versions prior to 2.6.

Firmware in KAON PG5298A and PG5298B routers allow an authenticated user to send crafted JSON-RPC requests and perform operations not possible via GUI, e.g. system file read or command execution. Fixed in firmware version 3.0.82 for PG5298A and 4.0.82 for PG5298B.

Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the application origin via an SVG document containing an embedded script element.

A flaw has been found in itsourcecode Online Pharmacy System 1.0. This affects the function move_uploaded_file of the file all_users/register.php of the component User Registration. Executing a manipulation of the argument photo can lead to unrestricted upload. The attack may be launched remotely. The exploit has been published and may be used.

A vulnerability was detected in itsourcecode Real Estate Management System 1.0. Affected by this issue is some unknown functionality of the file search.php. Performing a manipulation of the argument search/delivery_type/search_price/property_type results in sql injection. The attack may be initiated remotely. The exploit is now public and may be used.

The fast-uri URI parser for Node.js mishandles schemes with percent-encoded slashes, allowing an attacker to manipulate the host and bypass allowlists. Affected versions are 2.3.1 up to 2.4.4, 3.0.0 up to 3.1.5, and 4.0.0 up to 4.1.2.

Outbound HTTP requests using a Micrometer-instrumented client can cause a denial-of-service (DoS) condition due to an unbounded memory leak. Affected versions include Micrometer 1.17.0, 1.16.0-1.16.6, 1.15.0-1.15.12, 1.14.0-1.14.16, and 1.9.18 and earlier.

Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New code in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string, dropping escaping, and RenderAttributes escapes only values that are still byte slices, so its escaping branch is never reached. A quote inside an attribute value can terminate the attribute and allow a further attribute, including an event handler, to be placed on the wrapper element, causing script execution for every visitor who loads the page.

Hugo does not verify the actual IP address the HTTP client connects to when fetching resources via resources.GetRemote. The security.http.urls allowlist only checks the URL text, not the real destination, allowing access to internal resources.

SQL Injection vulnerability in Delta DIAEnergie v1.11.00.002 allows an attacker to perform remote code execution.

SQL Injection vulnerability in Delta DIAEnergie v1.11.00.002 allows an attacker to perform remote code execution.

SQL Injection vulnerability in Delta DIAEnergie v1.11.00.002 allows an attacker to perform remote code execution.

SQL Injection vulnerability in Delta DIAEnergie v1.11.00.002 allows an attacker to perform remote code execution.