CVE Vulnerability Catalog

The Hostel Management System v.2.1 has a Cross-Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the add course section.

The WP Zone Potent Donations plugin for WooCommerce versions <= 1.1.9 has a Cross-Site Request Forgery (CSRF) vulnerability. An attacker can exploit this flaw to perform unauthorized actions on behalf of the user.

CVE-2023-35887 vulnerability in Apache MINA exposes sensitive information to unauthorized actors. Logged users on SFTP servers may discover 'exists/does not exist' information about items outside the rooted tree using parent navigation or symlinks.

CVE-2023-35699 concerns cleartext storage on disk in the SICK ICR890-4 device. This allows an unauthenticated attacker with local access to the device to disclose sensitive information by accessing the SD card.

The SICK ICR890-4 has an observable response discrepancy that could allow a remote attacker to identify valid usernames for the FTP server from the response given during a failed login attempt.

Improper restriction of excessive authentication attempts in the SICK ICR890-4 could allow a remote attacker to brute-force user credentials.

The SmartBPM.NET component has a path traversal vulnerability in its file download function. An unauthenticated remote attacker can exploit this vulnerability to access arbitrary system files.

In the GitHub repository nilsteampassnet/teampass prior to version 3.0.10, there is improper encoding or escaping of output.

The Online Examination System Project version 1.0 is vulnerable to Cross-Site Request Forgery (CSRF) attacks. An attacker can craft a malicious link that, when clicked by an admin user, will delete a user account from the database without the admin's consent.

Chamilo versions 1.11.x up to 1.11.20 allow users with admin privileges to insert XSS in the usergroups management section.

Chamilo versions 1.11.x up to 1.11.20 allow users with admin privileges to insert XSS in the skills wheel.

Chamilo versions 1.11.x up to 1.11.20 allow users with admin privileges to insert XSS in the session category management section.

Chamilo versions 1.11.x up to 1.11.20 allow users with admin privileges to insert XSS in the extra fields management section.

Chamilo versions 1.11.x up to 1.11.20 allow users with admin privileges to insert XSS in the careers and promotions management section.

Chamilo versions 1.11.x up to 1.11.20 allow users with admin privilege accounts to insert XSS in the course categories' definition.

Chamilo versions 1.11.x up to 1.11.20 allow users with admin privilege accounts to insert XSS in the languages management section.

Zoho ManageEngine ADAudit Plus before version 7100 allows XSS via the username field.

The Release module in Zoho ManageEngine ServiceDesk Plus before version 14202, ServiceDesk Plus MSP before version 14300, and SupportCenter Plus before version 14300 has a privilege escalation vulnerability that allows unprivileged users to access the Reminders of a release ticket and make modifications.

A critical vulnerability was found in SourceCodester Shopping Website 1.0, affecting an unknown function in the check_availability.php file. Manipulation of the email argument leads to SQL injection.

A vulnerability in Apache Johnzon related to the deserialization of untrusted data allows an attacker to input large numbers in JSON format, potentially leading to slow conversion and Denial of Service risk.