CVE Vulnerability Catalog

Vulnerability in Reyrolle 7SR5 exposes information through the web interface that can be used to calculate current and past session ID numbers. An attacker could bypass authentication and gain unauthorized access to the device.

A vulnerability has been identified in Teamcenter V2412 (All versions < V2412.0013), Teamcenter V2506 (All versions < V2506.0010), Teamcenter V2512 (All versions < V2512.2607), Teamcenter V2606 (All versions < V2606.2607). Affected applications do not properly encode user-supplied input reflected into HTML attribute contexts within the authentication redirect flow (/auth/ endpoint). This could allow an unauthenticated remote attacker to inject arbitrary JavaScript into the browser of an authenticated user who loads a crafted URL, enabling the attacker to perform actions within the victim's Teamcenter session.

Vulnerability in the OIS web module of Siveillance Control allows an attacker to upload arbitrary files to the server. Successful exploitation could allow an attacker to gain root access on the host system, potentially leading to full compromise of the OIS environment.

A vulnerability in Desigo CC applications allows Client Code Execution (CCE) due to insufficient input validation when handling scripts embedded in user-defined graphics documents. An attacker can craft a malicious graphics document that, when opened by a privileged user, executes a script, allowing arbitrary file writes to the client's operating system.

Unauthenticated Cross Site Scripting (XSS) vulnerability in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) versions up to 2.0.17. Allows an attacker to inject malicious script into a page, which executes in the victim's browser.

Unauthenticated Cross Site Scripting (XSS) vulnerability in Open User Map versions up to 1.4.50. Allows an attacker to inject malicious script into a page, which executes in the victim's browser.

Unauthenticated Cross Site Scripting (XSS) vulnerability in JetFormBuilder versions up to 3.6.5.1. Allows an attacker to inject malicious script into a page, which executes in the victim's browser.

Server-Side Request Forgery (SSRF) vulnerability in Hide My WP Ghost versions up to 7.0.09. Allows an attacker to send requests from the server to internal network resources, potentially leading to disclosure of sensitive information or further attacks.

Unauthenticated Insecure Direct Object References (IDOR) in WpEvently <= 5.6.0 versions.

DOM-Based Cross Site Scripting (XSS) vulnerability in Easy Appointments versions up to 4.0.2.1. Allows an attacker to manipulate the DOM of the page in the victim's browser, leading to execution of malicious script.

The Product Catalog Enquiry for WooCommerce by MultiVendorX plugin (versions up to and including 6.1.5) has an Incorrect Privilege Assignment vulnerability that allows Privilege Escalation.

Missing Authorization vulnerability in Csomagpontok és szállítási címkék WooCommerce-hez before version 4.2.8. Allows exploiting incorrectly configured access control security levels, potentially leading to unauthorized actions.

Missing Authorization vulnerability in Unbounce Landing Pages versions up to 1.1.4. Allows exploiting incorrectly configured access control security levels, potentially leading to unauthorized actions.

A vulnerability in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges can exploit Dogtag's ExternalProcessConstraint mechanism to execute arbitrary commands with attacker-controlled environment variables, achieving code execution as the pkiuser account.

Improper restriction of XML external entity reference vulnerability in Cosminexus Component Container. Allows an attacker to process malicious XML files, potentially leading to disclosure of sensitive data or unauthorized operations.

Deserialization of untrusted data vulnerability in Cosminexus Component Container. Could allow an attacker to execute arbitrary code or cause a crash.

Resource exhaustion vulnerability without limits or throttling in Automattic WooCommerce allows HTTP DoS. This affects WooCommerce versions before 11.1.0.

A vulnerability in code-projects Student Crud Operation 1.0 affects an unknown function of the file /card_activation.sql in the Backup File Handler component. Manipulation leads to information disclosure. The attack can be launched remotely, and the exploit has been made public.

A vulnerability in code-projects Student Crud Operation 1.0 affects an unknown function of the file /edit.php. Manipulation of the ID argument leads to SQL injection. The attack can be initiated remotely, and the exploit has been disclosed publicly.

A flaw in itsourcecode Sales and Inventory System 1.0 affects the mysqli_query function in /pages/us_searchfrm.php. Manipulation of the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit has been published.