CVE Vulnerability Catalog

The Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the PersonView.php component.

Version 5.0.0 of ChurchCRM contains an SQL injection vulnerability that allows a remote attacker to obtain sensitive information via the FundRaiserID parameter within the /FundRaiserEditor.php endpoint.

Cross Site Scripting (XSS) vulnerability in ChurchCRM v.5.0.0 allows a remote attacker to execute arbitrary code via a crafted payload to the systemSettings.php component.

Cross Site Scripting vulnerability in wger Workout Manager v.2.2.0a3 allows a remote attacker to gain privileges via the license_author field in the add-ingredient function.

CVE-2023-3653 describes an improper neutralization of input during web page generation, leading to Stored XSS vulnerability in Digital Ant E-Commerce Software.

The Digital Ant E-Commerce Software has a Cross-site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. This issue affects versions of the software before 11.

A Cross Site Scripting (XSS) vulnerability in Adiscon Aiscon LogAnalyzer through 4.1.13 allows a remote attacker to execute arbitrary code via the asktheoracle.php, details.php, index.php, search.php, export.php, reports.php, and statistics.php components.

PHPJabbers Class Scheduling System 1.0 lacks encryption on the password when editing a user account, allowing an attacker to capture all user names and passwords in clear text.

Maid Hiring Management System v1.0 has a SQL injection vulnerability in the Search Maid page. Attackers can exploit this flaw to manipulate database queries.

A SQL injection vulnerability was discovered in the Booking Request page of Maid Hiring Management System v1.0. It allows an attacker to manipulate database queries.

A SQL injection vulnerability was discovered in the Admin page of Maid Hiring Management System v1.0. This allows an attacker to manipulate database queries.

Online Nurse Hiring System v1.0 was found to have a cross-site scripting (XSS) vulnerability in the Add Nurse page of the Admin portal. An attacker can inject malicious scripts that execute in the administrator's browser.

Online Nurse Hiring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the Search Report Page of the Admin portal. This allows an attacker to inject malicious scripts into the administrator's browser.

Online Nurse Hiring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the Search Report Details of the Admin portal. This allows an attacker to inject malicious scripts into the victim's browser.

Online Nurse Hiring System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the Admin Profile Page. This allows an attacker to inject malicious scripts via unsanitized input.

The WP-Cirrus plugin versions up to 0.6.11 contain a stored Cross-Site Scripting (XSS) vulnerability with admin authorization. An attacker can exploit this flaw to inject malicious scripts that will be executed in the victim's browser context.

A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.4). The affected applications accept unauthenticated file write messages.

In PHOENIX CONTACT's TC ROUTER and TC CLOUD CLIENT in versions prior to 2.07.2 and CLOUD CLIENT 1101T-TX/TX prior to 2.06.10, an authenticated remote attacker with admin privileges could upload a crafted XML file, leading to a denial-of-service.

In SAP BusinessObjects Business Intelligence version 420, if a user logs into a specific program, under certain specific conditions memory may not be cleared properly, which could allow an attacker to access user credentials.

In SAP Supplier Relationship Management versions 600, 602, 603, 604, 605, 606, 616, 617, there is a vulnerability that allows an unauthorized attacker to discover information related to SRM within Vendor Master Data. This information could be used to tailor attacks against SRM.