CVE Vulnerability Catalog

A vulnerability was found in SourceCodester Online Reviewer Management System 1.0. Impacted is an unknown function of the file /reviewer_0/admins/assessments/Subject/btn_functions.php?action=update. Performing a manipulation of the argument Subject results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.

A flaw has been found in ChatGPTNextWeb NextChat up to 2.16.1. This vulnerability affects the function proxyHandler of the file app/api/proxy.ts of the component Proxy Fallback Handler. This manipulation of the argument x-base-url causes server-side request forgery. It is possible to initiate the attack remotely. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.

YAML before version 1.27_001 for Perl allows a loaded perl/glob document to replace any package variable, which can lead to arbitrary code execution. The document can enable code loading options that are off by default.

A flaw has been found in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The impacted element is an unknown function of the file delivery/deliverysignup.php of the component Registration Page. This manipulation of the argument username/email/location causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The affected element is an unknown function of the file admin/signup.php of the component Admin Registration. The manipulation of the argument email/username/location results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.

A security vulnerability has been detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Impacted is an unknown function of the file delivery/deliverymyord.php. The manipulation of the argument delivery_person_id/order_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was identified in kishor-23 food-waste-management-system within signup.php of the User Registration Endpoint component. Manipulating the email/name/gender arguments leads to SQL injection, and the attack can be performed remotely. The exploit is publicly available and may be used for attacks.

A vulnerability was detected in itsourcecode Online Admission System 1.0 affecting an unknown function of /admin/examinee.php. Manipulating the ID argument results in SQL injection, and the attack can be initiated remotely. The exploit is now public and may be used.

A security vulnerability was detected in itsourcecode Online Admission System 1.0 affecting an unknown function of /admin/creteria.php. Manipulating the ID argument leads to SQL injection, and the attack can be launched remotely. The exploit has been publicly disclosed and may be used.

A weakness was identified in itsourcecode Online Admission System 1.0 affecting an unknown function of /admin/confirm.php. Manipulating the schedid argument causes SQL injection, and the attack can be initiated remotely. The exploit is publicly available and may be used for attacks.

A security flaw was discovered in SourceCodester Online Reviewer Management System 1.0 affecting an unknown function of /reviewer_0/admins/assessments/activities/btn_functions.php?action=update. Manipulating the Title argument results in SQL injection, and the attack may be performed remotely. The exploit has been released to the public and may be used for attacks.

In the vdec component, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote privilege escalation with no additional execution privileges needed. User interaction is needed for exploitation.

In the apu module, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not required for exploitation.

In the Modem component, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote privilege escalation if a UE connects to a rogue base station controlled by the attacker. User interaction is needed, but no additional execution privileges are required.

In the apu component, there is a possible memory corruption due to improper input validation. This could lead to local privilege escalation with no additional execution privileges needed. User interaction is not needed for exploitation.

In the neuropilot component, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local privilege escalation with no additional execution privileges needed. User interaction is not needed for exploitation.

In the neuropilot component, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local privilege escalation with no additional execution privileges needed. User interaction is not needed for exploitation.

In the Video HAL component, there is a possible escalation of privilege due to a missing bounds check. This could lead to local privilege escalation with no additional execution privileges needed. User interaction is not needed for exploitation.

In the Modem component, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote privilege escalation if a UE connects to a rogue base station controlled by the attacker. No additional execution privileges or user interaction are needed.

In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a rogue base station controlled by the attacker, with no additional execution privileges needed. User interaction is not needed for exploitation.