CVE Vulnerability Catalog

A vulnerability has been found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. An unknown function in the file delete_exam.php is affected. Manipulation of the argument ID leads to authorization bypass. The attack can be carried out remotely and the exploit has been disclosed publicly.

A vulnerability was identified in Advantech WISE-6610 devices (multiple models) version 1.2.1_20251110 in the nodered_lib_apply function of the Node-RED Library component. Manipulation of the argument act leads to command injection. The attack can be launched remotely and the exploit is publicly available. The vendor released a fix in version 1.2.4_20260821.

A vulnerability was identified in Advantech WISE-6610 devices (multiple models) version 1.2.1_20251110 in the basicstation_apply function of the Basic Station Certificate-Deletion Handler component. Manipulation of the argument act causes command injection. The attack can be initiated remotely and the exploit is publicly disclosed. The vendor released a fix in version 1.2.4_20260821.

A flaw has been found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This issue affects some unknown processing in the file db.php. Executing a manipulation can lead to hard-coded credentials. The attack can be executed remotely and the exploit has been published.

A vulnerability was detected in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0 affecting the register function of the file auth.php. Manipulation of the argument role results in improper privilege management. Remote exploitation is possible and the exploit is public.

A security vulnerability has been detected in projeto-siga siga up to 11.0.2.10/11.0.2.13/11.1.1 affecting the function ExAutenticacaoController.autenticar of the file sigaex/src/main/java/br/gov/jfrj/siga/vraptor/ExAutenticacaoController.java in the Authentication Flow component. Manipulation of the arguments cod/jwt leads to missing authorization. The attack may be launched remotely and the exploit is public. The project was informed but has not responded.

A weakness has been identified in projeto-siga siga up to 11.1.1. The function DownloadExterno.getUrl in the HTML-to-PDF Endpoint component is affected. Manipulation of the html argument causes server-side request forgery, which can be initiated remotely. The exploit has been made public.

An unrestricted upload vulnerability in U+Smart Enjoyment WebSite 18.6001.1096.1000, affecting an unknown function in /Report/Upload/UploadFormImg.ashx. Manipulating the File argument allows remote arbitrary file upload. The exploit is public.

Missing authorization vulnerability in FluentCMS up to 0.0.5, affecting the GetAccessible function in PermissionManager.cs. Manipulation results in missing authorization. The attack can be initiated remotely, and the exploit is public.

SQL injection vulnerability in itsourcecode Sales and Inventory System 1.0, affecting an unknown function in /pages/settings_edit.php. Manipulating the ID argument leads to SQL injection. The attack may be performed remotely, and the exploit is public.

An out-of-bounds write caused by numeric truncation in Samsung Open Source Escargot on Linux x86-64 allows an attacker who can supply JavaScript for execution to corrupt native memory and crash the host process via a crafted class definition whose instance initialization entry count exceeds UINT16_MAX. Affects version 5dc93606abd42b859045add05d704a038e197359.

A vulnerability was found in itsourcecode Sales and Inventory System 1.0, specifically in the file /pages/emp_edit1.php. Manipulation of the ID argument leads to SQL injection. The attack can be performed remotely, and the exploit has been published.

SQL injection vulnerability in itsourcecode School Management System 1.0, affecting an unknown function in User_Login.php. Manipulating the email argument leads to SQL injection. The attack can be executed remotely, and the exploit is public.

A vulnerability was detected in itsourcecode Information System Society Membership System 1.0, in the file /society/check_student.php. Manipulation of the student_id argument leads to SQL injection. Remote exploitation is possible, and the exploit has been publicly disclosed.

A vulnerability was found in itsourcecode Sales and Inventory System 1.0, in the file /pages/us_transac.php. Manipulation of the Username argument leads to SQL injection. The attack can be launched remotely, and the exploit has been publicly disclosed.

An integer overflow in the source-bounds check in Memory::init() in Samsung walrus on all platforms allows a remote attacker to cause an out-of-bounds heap read and denial of service via a crafted WebAssembly module where a 32-bit unsigned addition wraps around and bypasses the bounds check.

Out-of-bounds write vulnerability in Samsung Opensource Walrus, allowing buffer overflows. Affects version af80e665ea49d9003695a66502f841ed1d8397e7.

A flaw was found in sfturing ssm_pro up to 627f426331da8086ce8fff2017d65b1ddef384f8. The affected component is Order Endpoint, in the file ssm_pro/src/main/java/cn/sfturing/web/OrderController.java. Manipulation of hospitalName/officesName/doctorName arguments causes cross-site scripting. The attack can be initiated remotely, and the exploit has been published. The project has not responded yet.

Authorization bypass vulnerability in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8, affecting the orderRecordsService.cancelOrder function in OrderController.java. Manipulating the ID argument allows remote authorization bypass. The exploit is public.

Authorization bypass vulnerability in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8, affecting the updateOrderSta1/updateOrderdiseaseInfo functions in OrderController.java. Manipulating userID/id arguments leads to remote authorization bypass. The exploit is public.