CVE Vulnerability Catalog

Datalust Seq before 2023.2.9489 allows insertion of sensitive information into an externally accessible file or directory. This is exploitable only when external (SQL Server or PostgreSQL) metadata storage is used.

A critical vulnerability has been found in IBOS OA version 4.5.5, affecting an unknown functionality of the file /?r=recruit/resume/edit&op=status of the Interview Handler component. Manipulation of the argument resumeid leads to SQL injection.

A vulnerability has been found in Dapr that allows bypassing API token authentication. An attacker could craft a well-formed HTTP request that is accepted by Dapr, even if the API token is invalid or missing.

KubePi is an opensource kubernetes management panel. The endpoint /kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leaks password hashes of users, including admins, which may allow an attacker to crack them.

The `ckeditor-wordcount-plugin` for CKEditor4 is susceptible to cross-site scripting (XSS) when switching to source code mode. This issue has been addressed in version 1.17.12 of the plugin.

Indico, a web-based event management tool, has a Cross-Site Scripting vulnerability in confirmation prompts used for deleting content. Exploitation requires someone with submission privileges to attempt to delete content, creating an attack risk.

A vulnerability in Microsoft Edge (Chromium-based) allows for elevation of privilege. An attacker can exploit this flaw to gain higher privileges on the system.

A vulnerability in Microsoft Edge for Android allows spoofing, which may lead to user data theft. An attacker can exploit this flaw to impersonate trusted sources.

A vulnerability in Microsoft Edge (Chromium-based) allows for spoofing, which may lead to unauthorized access to user data.

A sensitive information leak issue has been discovered in GitLab EE affecting all versions from 16.0 to 16.0.6 and from 16.1 to 16.1.1. It allows access to titles of private issues and MRs.

WebBoss.io CMS before version 3.7.0.1 contains a reflected XSS vulnerability.

A Cross-site Scripting (XSS) vulnerability - Reflected exists in the GitHub repository pimcore/pimcore prior to version 10.6.4.

A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository pimcore/pimcore prior to version 10.6.4, allowing for the storage of malicious code.

In the GitHub repository pimcore/pimcore prior to version 10.6.4, there is a vulnerability that allows the exposure of sensitive information to unauthorized actors.

A critical vulnerability was found in Hospital Management System version 1.0. The issue affects some unknown processing of the file patientprofile.php, where manipulation of the argument address leads to SQL injection.

A critical vulnerability was found in Hospital Management System version 1.0, affecting unknown code in the file patientappointment.php. Manipulation of the arguments loginid, password, mobileno, appointmentdate, appointmenttime, patiente, dob, doct, and city leads to SQL injection.

A critical vulnerability was found in Hospital Management System version 1.0. Manipulation of the 'address' argument in the patient.php file leads to SQL injection, which can be executed remotely.

A critical vulnerability was found in Hospital Management System version 1.0, affecting some unknown functionality of the file patientforgotpassword.php. Manipulation of this file leads to SQL injection.

A critical vulnerability has been found in Campcodes Beauty Salon Management System version 1.0. Manipulation of the id argument in the edit_product.php file leads to SQL injection, allowing for remote attacks.

A critical vulnerability was found in SourceCodester House Rental and Property Listing System version 1.0. The issue affects an unknown function in the btn_functions.php file, leading to unrestricted file uploads.