CVE Vulnerability Catalog

The Song-Li cross_browser project (up to ca690f0fe6954fd9bcda36d071b68ed8682a786a) contains a SQL injection vulnerability in the file flask/uniquemachine_app.py in the 'details' endpoint. Attackers can manipulate the ID argument, leading to SQL injection. The attack can be performed remotely, and the exploit has been publicly disclosed.

In SourceCodester/jkev Record Management System 1.0, the index.php file in the Login component is vulnerable to SQL injection via the Username argument. Remote exploitation is possible and the exploit is public.

A weakness has been identified in Technostrobe HI-LED-WR120-G2 version 5.5.0.1R6.03.30 in an unknown function of the file /fs. Manipulating the argument cwd can lead to unrestricted upload. The attack can be launched remotely. The exploit has been made public and could be used for attacks.

Technostrobe HI-LED-WR120-G2 version 5.5.0.1R6.03.30 has a vulnerability in the index_config function of the /LoginCB file, causing improper authentication. The attack can be performed remotely, and the exploit is publicly available.

The Technostrobe HI-LED-WR120-G2 device version 5.5.0.1R6.03.30 has a vulnerability in an unknown function of the /Technostrobe/ endpoint. Manipulation leads to improper access controls. The attack can be performed remotely, and the exploit has been made public. The vendor did not respond.

A vulnerability in the venueless system allows a user with API access and 'manage users' permission in any world to trigger deletion of user accounts in other worlds.

In Tenda M3 version 1.0.0.10, the function setAdvPolicyData in /goform/setAdvPolicyData is vulnerable to buffer overflow via manipulation of the argument policyType. The attack can be executed remotely, and the exploit is published.

A vulnerability was detected in UTT HiPER 1250GW up to 3.2.7-210907-180535. It affects the function strcpy in the file /goform/formNatStaticMap. Manipulation of the argument NatBind results in buffer overflow. Remote exploitation is possible, and the exploit is publicly available.

A SQL injection vulnerability was found in Simple Laundry System 1.0 in the file /delmemberinfo.php via the userid parameter. The attack can be performed remotely and the exploit is publicly available.

A SQL injection vulnerability was found in Simple Laundry System 1.0 in the file /searchguest.php via the searchServiceId parameter. The attack can be performed remotely and the exploit is publicly available.

In provectus kafka-ui up to version 0.7.2, the function validateAccess in /api/smartfilters/testexecutions is vulnerable to code injection. The attack can be initiated remotely, and the exploit is publicly available. The vendor did not respond.

A SQL injection vulnerability was found in Concert Ticket Reservation System 1.0 in the file login.php via the Email parameter. The attack can be performed remotely and the exploit is publicly available.

A SQL injection vulnerability was found in Concert Ticket Reservation System 1.0 in the file process_search.php via the searching parameter. The attack can be performed remotely and the exploit is publicly available.

A SQL injection vulnerability was found in Free Hotel Reservation System 1.0 in the file /hotel/admin/login.php via the email parameter. The attack can be performed remotely and the exploit is publicly available.

A stack-based buffer overflow vulnerability was identified in the fromSysToolChangePwd function of the /bin/httpd file in Tenda AC10 firmware version 16.03.10.10_multi_TDE01. The attack can be initiated remotely and may affect multiple endpoints.

A stack-based buffer overflow vulnerability has been found in Tenda AC10 16.03.10.10_multi_TDE01 in the function fromSysToolChangePwd of the file /bin/httpd. Manipulating the argument sys.userpass results in buffer overflow, and the attack can be initiated remotely.

A security flaw has been discovered in UTT HiPER 1250GW up to 3.2.7-210907-180535. It affects an unknown function in the file /goform/formRemoteControl. Manipulation of the argument Profile results in stack-based buffer overflow. The attack can be executed remotely, and the exploit is publicly available.

In code-projects Simple Laundry System 1.0, the /modifymember.php file in the Parameter Handler component is vulnerable to SQL injection via the firstName argument. Remote exploitation is possible and the exploit is public.

FedML-AI FedML up to version 0.8.9 contains a deserialization vulnerability in the sendMessage function of the grpc_server.py file in the gRPC server component. Remote attackers can perform manipulation leading to deserialization, potentially enabling arbitrary code execution.

A SQL injection vulnerability was found in Online Enrollment System 1.0 in the file /sms/user/index.php?view=edit&id=10 via the USERID parameter. The attack can be performed remotely and the exploit is publicly available.