CVE Vulnerability Catalog

In the Linux kernel, in the OrangeFS filesystem (orangefs), there is a memory leak during debugfs initialization (orangefs_{kernel,client}_debug_init). The fix uses a global variable as a buffer instead of dynamic allocation, eliminating the leak.

A vulnerability was found in SeaCMS up to 13.3 in an unknown function of /admin_members.php?ac=editsave, allowing SQL injection through manipulation of the ID argument. The attack can be launched remotely, and the exploit has been publicly disclosed.

Podatność CVE-2025-0547 dotyczy niewłaściwej neutralizacji danych wejściowych podczas generowania stron internetowych w oprogramowaniu Paraşüt Bizmu, co umożliwia ataki typu Cross-Site Scripting (XSS). Problem ten dotyczy wersji Bizmu od 2.27.0 do 20250212.

A weakness has been identified in D-Link DIR-823X 240126/240802/250416. The impacted element is the function sub_412E7C of the file /usr/sbin/goahead of the component Environment Variable Handler. This manipulation of the argument terminal_addr/server_ip/server_port causes command injection. The attack can be initiated remotely. The exploit has been made available to the public and could be exploited.

A vulnerability was detected in SourceCodester Online Exam Form Submission 1.0. Affected by this vulnerability is an unknown functionality of the file /user/dashboard.php?page=update_profile. The manipulation of the argument phone results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. Other parameters might be affected as well.

A vulnerability was detected in sequa-ai sequa-mcp up to 1.0.13 affecting the redirectToAuthorization function of the file src/helpers/node-oauth-client-provider.ts (OAuth Server Discovery component). Manipulation results in OS command injection. Remote exploitation is possible and the exploit is now public. Upgrading to version 1.0.14 mitigates the issue.

A security vulnerability has been detected in itsourcecode Online Clinic Management System 1.0. Affected by this issue is some unknown functionality of the file transact.php. Such manipulation of the argument firstname leads to SQL injection. The attack may be launched remotely and the exploit has been disclosed publicly.

A SQL injection vulnerability has been identified in SourceCodester Online Polling System 1.0, specifically in /admin/positions.php. Manipulation of the ID argument allows SQL injection, and the attack can be launched remotely. The exploit has been publicly disclosed.

A security flaw in itsourcecode E-Commerce Website 1.0 allows unrestricted file upload via /admin/users.php. The attack can be launched remotely, and the exploit has been publicly disclosed.

A reflected Cross-Site Scripting (XSS) vulnerability exists in the web-based management interface of network access control services. An unauthenticated remote attacker can execute arbitrary JavaScript in a victim's browser.

A vulnerability was identified in itsourcecode E-Commerce Website 1.0. This impacts an unknown function of the file /admin/products.php. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit is publicly available and might be used.

A vulnerability was determined in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0 on COVID. This affects an unknown function of the file /print_reports_prev.php. Executing manipulation of the argument profile_id can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

A vulnerability has been found in itsourcecode Student Information System 1.0. The affected element is an unknown function of the file /leveledit1.php. Such manipulation of the argument level_id leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

A vulnerability was detected in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /enrollment-history/. Performing manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit is now public and may be used.

A security flaw has been discovered in Portabilis i-Educar up to 2.10, affecting /agenda_preferencias.php. Manipulation of the tipoacao argument results in cross-site scripting (XSS), and the attack can be launched remotely. The exploit has been publicly released.

A SQL Injection vulnerability was found in SourceCodester Online Exam Form Submission 1.0 in the file /admin/delete_s1.php. By manipulating the ID argument, an attacker can execute arbitrary SQL queries. The vulnerability can be exploited remotely, and the exploit has been publicly disclosed.

SourceCodester Online Student File Management System 1.0 has a SQL injection vulnerability in /admin/delete_user.php via the user_id argument. The attack can be initiated remotely, and the exploit has been publicly disclosed.

In the Linux kernel, in the accel subsystem for Habana Labs, the destruction of the memory manager IDR was postponed to hpriv_release(). Previously, the IDR was destroyed when the file descriptor was released, but the user context might still be held and memory buffers still in use. Later calls to release those buffers would fail due to missing handles in the IDR, leading to a memory leak. The fix splits IDR destruction from memory manager fini and postpones it to hpriv_release() when there is no user context and no buffers are used.

In the Linux kernel, in the media subsystem for the IPU bridge, a NULL pointer dereference during SSDB/PLD parsing was fixed. In ipu_bridge_parse_rotation() and ipu_bridge_parse_orientation(), the sensor->adev pointer was not set yet, leading to a NULL pointer dereference when warnings about unknown values were triggered. The fix sets sensor->adev earlier, with a borrowed ref, to avoid issues.

An issue in Perplexity AI GPT-4 allows a remote attacker to obtain sensitive information via a GET parameter.