CVE Vulnerability Catalog

A security flaw has been discovered in SourceCodester Online Magazine Management System 1.0. This affects an unknown part of the file /view_magazine.php. The manipulation of the argument ID results in SQL injection. The attack may be performed remotely, and the exploit has been released to the public.

A SQL injection vulnerability was identified in SourceCodester Online Magazine Management System 1.0, specifically in the /categories.php file. Manipulation of the 'c' argument allows injection of malicious SQL code. The attack can be carried out remotely, and a publicly available exploit may be used.

W platformie lsfusion do wersji 6.1 zidentyfikowano podatność w funkcji UploadFileRequestHandler. Manipulacja argumentem sid może prowadzić do ataku typu path traversal, co umożliwia zdalne wykonanie ataku.

ThinPLUS opracowany przez ThinPLUS ma podatność na wstrzykiwanie poleceń systemowych, co pozwala nieautoryzowanym zdalnym atakującym na wstrzykiwanie dowolnych poleceń systemowych i ich wykonywanie na serwerze.

TenderDocTransfer developed by Chunghwa Telecom has an Arbitrary File Copy and Paste vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection in the APIs, unauthenticated remote attackers could use these APIs through phishing. Additionally, one of the APIs contains an Absolute Path Traversal vulnerability. Attackers can copy arbitrary files on the user's system and paste them into any path, posing a risk of information leakage or consuming hard drive space.

TenderDocTransfer developed by Chunghwa Telecom has an Arbitrary File Delete vulnerability. The application sets up a simple local web server and provides APIs for communication with the target website. Due to the lack of CSRF protection in the APIs, unauthenticated remote attackers could use these APIs through phishing. Additionally, one of the APIs contains an Absolute Path Traversal vulnerability, allowing attackers to delete arbitrary files on the user's system.

A vulnerability was found in lsfusion platform up to 6.1. Affected is the function DownloadFileRequestHandler of the file web-client/src/main/java/lsfusion/http/controller/file/DownloadFileRequestHandler.java. Manipulation of the argument Version results in path traversal. Remote exploitation is possible. The exploit has been made public and could be used.

A SQL injection vulnerability has been found in Campcodes Supplier Management System 1.0 in the file /manufacturer/edit_product.php. Manipulation of the cmbProductUnit argument leads to SQL injection. The attack may be launched remotely, and the exploit has been disclosed.

A SQL injection vulnerability has been found in Campcodes Supplier Management System 1.0 in the file /manufacturer/edit_unit.php. Manipulation of the ID argument causes SQL injection. The attack may be initiated remotely, and the exploit has been published.

BEIMS Contractor Web, a legacy product that is no longer maintained or patched by the vendor, contains a SQL injection vulnerability on the /BEIMSWeb/contractor.asp endpoint. An unauthorized user can retrieve sensitive database contents via unsanitized parameter input. Version 5.7.139 has been confirmed as vulnerable.

W systemie zarządzania zapasami itsourcecode w wersji 1.0 wykryto podatność na SQL injection. Problem dotyczy nieznanej funkcji w pliku /admin/user/index.php?view=edit, gdzie manipulacja argumentem ID prowadzi do wykonania złośliwego kodu SQL.

A weakness has been identified in projectworlds Advanced Library Management System 1.0. Impacted is an unknown function of the file /borrow.php. Executing a manipulation of the argument roll_number can lead to SQL injection. It is possible to launch the attack remotely, and the exploit has been made available to the public.

In the Advanced Library Management System 1.0 from projectworlds, a vulnerability was found in the file /book_search.php, where manipulation of the arguments book_pub/book_title results in SQL injection. The attack can be initiated remotely, and the exploit has been publicly released.

A SQL injection vulnerability was identified in projectworlds Advanced Library Management System 1.0 in the file /add_member.php via manipulation of the roll_number argument. The attack can be performed remotely and a publicly available exploit may be used.

A SQL injection vulnerability was determined in projectworlds Advanced Library Management System 1.0 in the file /add_librarian.php via manipulation of the Username argument. The attack can be carried out remotely and the exploit has been publicly disclosed.

Wykryto podatność w module ShopSuite ModulithShop do wersji 45a99398cec3b7ad7ff9383694f0b53339f2d35a, która dotyczy nieznanej funkcjonalności komponentu RSA/OAuth2/Baza danych. Manipulacja prowadzi do ujawnienia zakodowanych na stałe poświadczeń, co może być wykorzystane w ataku zdalnym.

Zidentyfikowano słabość w systemie zarządzania kolejką pacjentów SourceCodester w wersji 1.0. Problem dotyczy nieznanej funkcji w pliku /php/api_patient_schedule.php, gdzie manipulacja argumentem appointmentID prowadzi do wstrzykiwania SQL.

W systemie zarządzania turystyką PHPGurukul w wersji 1.0 odkryto lukę bezpieczeństwa. Problem dotyczy nieznanej funkcji w pliku /admin/user-bookings.php, gdzie manipulacja argumentem uid prowadzi do wstrzykiwania SQL.

W systemie Student Information System 2.0 odkryto podatność, która dotyczy nieznanego przetwarzania pliku /register.php. Manipulacja tym plikiem prowadzi do wstrzyknięcia SQL, co może być wykorzystane przez atakującego zdalnie.

W systemie informacyjnym dla studentów w wersji 2.0 znaleziono lukę, która dotyczy nieznanego kodu w pliku /index.php. Manipulacja argumentem 'Username' może prowadzić do wstrzyknięcia SQL, co umożliwia zdalne przeprowadzenie ataku.