CVE Vulnerability Catalog

A security flaw was discovered in itsourcecode Sales and Inventory System 1.0 in an unknown functionality of the file /pages/sup_edit.php. Manipulation of the argument ID results in SQL injection. The attack can be executed remotely, and the exploit has been released.

A vulnerability was identified in itsourcecode Sales and Inventory System 1.0 in an unknown function of the file /pages/cust_searchfrm.php. Manipulation of the argument ID leads to SQL injection. Remote exploitation is possible, and the exploit is publicly available.

A vulnerability in ash_sql allows a caller in a schema-based multitenant application to receive aggregate values computed from another tenant's rows. This occurs when an aggregate is computed over a distinct query, and the outer query is rebuilt without the schema prefix, leading to reads from the default schema instead of the tenant schema.

A vulnerability in ash_sql allows a caller to receive an aggregate value computed over rows a more restrictive filter should have excluded, disclosing counts, sums, or lists across an authorization or tenancy boundary. This occurs because two aggregate queries are considered identical when they differ only in filter, not sort.

A vulnerability in ash_sql allows a user to pad a string field with tab, newline, carriage-return, or form-feed characters and pass a trimmed uniqueness or equality check in the database that the same expression would fail in memory (or the reverse). This occurs because string_trim/1 in SQL removes only spaces, not all whitespace, causing behavioral differences between SQL and memory.

A vulnerability in ash_sql allows a user who supplies a search term to contains/2, string_starts_with/2, or string_ends_with/2 to inject live SQL LIKE wildcards, turning a literal substring search into an attacker-controlled pattern match. This occurs because escape helpers do not escape backslashes, allowing bypass of escaping and activation of wildcards.

An uncontrolled recursion vulnerability in ash-project ash_oban allows a user who can drive a trigger's on_error action to fail on the final attempt to exhaust worker CPU and memory, denying service. The generated worker's atomic handle_error/4 runs the trigger's on_error action on a job's final attempt inside a rescue that, when the action itself raises, calls handle_error/4 again with the same job, leading to infinite recursion and unbounded heap growth. This issue affects ash_oban from 0.8.0-rc.1 before 0.8.14.

A vulnerability in ash_oban allows a user whose input reaches the :args option of AshOban.build_trigger/3 to retarget an update or destroy trigger at another record, including across tenants. This occurs because caller keys arrive as strings after JSON round-trip, bypassing merge collision handling and allowing override of trusted values.

A vulnerability in ash_sql allows a caller to bypass a scoping or authorization filter expressed as exists/2 over a relationship that declares both a limit and a parent(...)-referencing filter or sort. In certain cases, the limit and predicate are dropped, causing the check to match any record with any related row.

A vulnerability was identified in TOTOLINK A720R 4.1.5cu.630_B20250509, affecting the setMacFilterRules function in cstecgi.cgi of the MAC Filtering component. Manipulating the desc argument can lead to memory corruption. The attack can be launched remotely, and the exploit has been publicly disclosed.

A vulnerability was identified in Beetel 450TC3 01.00.00_01, affecting the User Management component. Manipulating the Username argument leads to cross site scripting. The attack can be carried out remotely, and the exploit is publicly available. The vendor did not respond.

A vulnerability was identified in Beetel 450TC3 01.00.00_01, affecting an unknown part. Manipulation can lead to weak password recovery. The attack can be executed remotely, and the exploit has been publicly disclosed. The vendor did not respond.

A vulnerability was found in SiteServer SSCMS 7.4.0, affecting the Agent Installation Workflow component. Manipulating the SecurityKey argument results in improper access controls. Remote exploitation is possible but has high complexity and is difficult. The project did not respond.

A vulnerability was found in itsourcecode Sales and Inventory System 1.0, affecting the file /pages/pro_edit.php. Manipulating the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit has been publicly disclosed.

A vulnerability was found in itsourcecode Sales and Inventory System 1.0, affecting the file /pages/emp_searchfrm.php. Manipulating the ID argument causes SQL injection. The attack can be initiated remotely, and the exploit has been published.

A vulnerability was detected in Coppermine Photo Gallery up to 1.6.28, affecting the db_input.php file of the Hidden Album Update Endpoint. The manipulation results in cross site scripting. The attack can be launched remotely, and the exploit is public. Upgrading to version 1.6.29 fixes the issue.

A vulnerability was detected in Coppermine Photo Gallery up to 1.6.28, affecting the profile.php file of the edit_profile Endpoint. Manipulating the Biography argument leads to cross site scripting. The attack can be initiated remotely, and the exploit has been publicly disclosed. Upgrading to version 1.6.29 mitigates the issue.

The Really Simple Security WordPress plugin before 9.8.0 does not check if the user is allowed to install plugins, allowing a subsite administrator on a multisite network to install and execute arbitrary code in the network-shared plugin directory. Exploitation requires the network administrator to have enabled the plugin's administration menu for subsites, which is not the default.

The Groundhogg — CRM, Newsletters, and Marketing Automation WordPress plugin before 4.5.13 does not validate or escape values submitted to some optional web form fields before storing and outputting them in an administrative area, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users.

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admin.