CVE Vulnerability Catalog

SQL injection vulnerability in /mail.php of code-projects Library System 1.0. Manipulation of the ID argument leads to SQL injection. Attack can be performed remotely, exploit is public.

SQL injection vulnerability in /return.php of code-projects Library System 1.0. Manipulation of the ID argument results in SQL injection. Attack can be launched remotely, exploit is public.

W systemie bibliotecznym code-projects w wersji 1.0 odkryto podatność, która dotyczy nieznanej funkcji w pliku /index.php komponentu Logowanie. Manipulacja argumentem 'Username' prowadzi do wstrzykiwania SQL.

A cross site scripting flaw has been found in PHPGurukul Hostel Management System 2.1. The impacted element is an unknown function of the file /register-complaint.php, and manipulation of the cdetails argument leads to script execution. The attack can be launched remotely and the exploit has been published.

A vulnerability was detected in code-projects Blog Site 1.0. The affected element is an unknown function of the file /admin.php. Performing manipulation results in improper authorization. It is possible to initiate the attack remotely. The exploit is now public and may be used. Multiple endpoints are affected.

A security vulnerability has been detected in code-projects Blog Site 1.0. Impacted is the function category_exists of the file /resources/functions/blog.php of the component Category Handler. Such manipulation of the argument name/field leads to sql injection. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Multiple endpoints are affected.

A weakness was identified in code-projects Online Bidding System 1.0 in the categoryadd function of /administrator/addcategory.php. Manipulation of the catimage argument leads to unrestricted file upload. The attack can be carried out remotely and the exploit is publicly available.

A security flaw has been discovered in projectworlds can pass malicious payloads up to 1.0. This vulnerability affects unknown code of the file /add_book.php. The manipulation of the argument image results in unrestricted upload. The attack can be executed remotely. The exploit has been released to the public and may be exploited.

Zidentyfikowano podatność w systemie zarządzania biblioteką Advanced Library Management System w wersji 1.0. Problem dotyczy nieznanej części pliku /delete_admin.php, gdzie manipulacja argumentem admin_id prowadzi do wstrzykiwania SQL.

The WP Shortcodes Plugin — Shortcodes Ultimate for WordPress in versions up to and including 7.4.5 is vulnerable to Server-Side Request Forgery via the su_shortcode_csv_table function. An authenticated attacker with Administrator-level access or higher can make web requests to arbitrary locations from the web application, which can be used to query and modify information from internal services. If the 'Unsafe features' option is enabled, this issue becomes exploitable by Contributor+ attackers.

A vulnerability in Simple Food Ordering System 1.0 affects the /listorder.php file. Manipulation of the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit has been publicly disclosed.

A vulnerability in COVID Tracking System 1.0 affects the /admin/?page=state file. Manipulation of the ID argument leads to SQL injection. The attack can be initiated remotely, and the exploit has been made public.

A vulnerability in COVID Tracking System 1.0 affects the /admin/?page=city file. Manipulation of the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit has been disclosed.

A vulnerability in COVID Tracking System 1.0 affects the /admin/?page=people file. Manipulation of the ID argument leads to SQL injection. The attack can be initiated remotely, and the exploit has been published.

A vulnerability was detected in itsourcecode COVID Tracking System 1.0 affecting an unknown function of the file /admin/?page=establishment. Manipulation of the ID argument results in SQL injection.

A vulnerability has been detected in jarun nnn up to version 5.1. The issue affects the function show_content_in_floating_window/run_cmd_as_plugin in the file nnn/src/nnn.c and leads to a double free. The attack requires local access.

A weakness was identified in SourceCodester Inventory Management System 1.0 in an unknown function of /model/user/resetPassword.php, leading to weak password recovery. The attack can be performed remotely and a public exploit is available.

A security flaw has been discovered in SourceCodester Pre-School Management System 1.0. The function removefile in app/controllers/FilehelperController.php is affected. Manipulation of the argument filepath results in denial of service. The attack can be carried out remotely and the exploit has been released.

Zidentyfikowano podatność w D-Link DIR-852 w wersji 1.00, która dotyczy nieznanego przetwarzania pliku /gena.cgi. Manipulacja argumentem service prowadzi do wstrzyknięcia poleceń, co może być zrealizowane zdalnie.

W systemie CMS 1.0 firmy SourceCodester zidentyfikowano podatność, która dotyczy nieznanego kodu w pliku /admin/index.php. Manipulacja argumentem 'Username' prowadzi do wstrzykiwania SQL.