CVE Vulnerability Catalog

HCL Unica MaxAI Assistant is susceptible to an HTML injection vulnerability. An attacker could insert special characters that are processed client-side in the context of the user's session.

HCL Unica 12.1.10 can expose sensitive system information. An attacker could use this information to form an attack plan by leveraging known vulnerabilities in the application.

A flaw has been found in jimit105 Project-Online-Shopping-Website up to commit 7d892f442bd8a96dd242dbe2b9bd5ed641e13e64. This affects an unknown function of the file /delete.php of the component Product Inventory Handler. Manipulation of the argument product_code causes SQL injection. It is possible to initiate the attack remotely. The exploit has been published and may be used. This product uses a rolling release model, so no version details for affected or updated releases are available. The vendor was contacted but did not respond.

HCL Unica Centralized Offer Management is vulnerable to poor unhandled exceptions which exposes sensitive information. An attacker can exploit this information to launch targeted attacks, such as remote code execution or denial of service.

HCL Unica Centralized Offer Management is vulnerable to Insecure Direct Object References (IDOR). An attacker can bypass authorization and access resources in the system directly, for example database records or files.

HCL Unica Centralized Offer Management is vulnerable to Server-Side Request Forgery (SSRF). An attacker can exploit improper input validation by submitting maliciously crafted input to a target application running on a server.

W systemie zarządzania salonem Best Salon Management System w wersji 1.0 odkryto lukę bezpieczeństwa. Manipulacja argumentem ServiceId w pliku /panel/add_invoice.php prowadzi do wstrzykiwania SQL, co umożliwia zdalne wykorzystanie tej podatności.

Zidentyfikowano podatność w systemie zarządzania salonem Best Salon Management System w wersji 1.0. Problem dotyczy nieznanej funkcjonalności pliku /panel/edit-appointment.php, gdzie manipulacja argumentem editid prowadzi do wstrzykiwania SQL.

A SQL injection vulnerability was found in code-projects Simple Food Ordering System 1.0 in /addcategory.php. Manipulation of the cname argument allows remote attack. The exploit is publicly available.

A SQL injection vulnerability was found in code-projects Simple Food Ordering System 1.0 in /addproduct.php. Manipulation of the Category argument allows remote attack. The exploit is publicly available.

A SQL injection vulnerability was identified in SourceCodester Simple Inventory System 1.0, specifically in the /user.php file. Manipulation of the 'uemail' argument allows injection of malicious SQL code. The attack can be carried out remotely, and the exploit is publicly available.

A SQL injection vulnerability was found in SourceCodester Simple Inventory System 1.0 in /brand.php. Manipulation of the editBrandName argument allows remote attack. The exploit is publicly available.

A flaw in code-projects Hospital Management System 1.0 affects the session function of the express-session component. Manipulation of the secret argument with input 'secret' causes use of a hard-coded cryptographic key. The attack can be initiated remotely but has high complexity and is difficult to exploit. The exploit has been published.

W systemie E-Banking 1.0 wykryto podatność, która dotyczy nieznanej funkcji w pliku /register.php komponentu POST Parameter Handler. Manipulacja argumentami username/password prowadzi do wstrzykiwania SQL.

A weakness has been identified in harry0703 MoneyPrinterTurbo up to 1.2.6, impacting the upload_music function in app/controllers/v1/music.py of the API Endpoint component. Manipulation of the File argument can lead to path traversal, and the attack can be performed remotely. The exploit has been made public.

A security flaw has been discovered in iPynch Social Network Website up to commit b6933b6d7f82c84819abe458ccf0e59d61119541. The affected element is an unknown function of the component Search. Performing manipulation results in SQL injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited. This product adopts a rolling release strategy.

A vulnerability in code-projects Client Details System 1.0 affects an unknown function in the file /admin/update-profile.php. Manipulation of the argument uid leads to SQL injection. The attack can be executed remotely. The exploit is publicly available and might be used.

W systemie zamówień online Projectworlds w wersji 1.0 zidentyfikowano podatność, która dotyczy nieznanego przetwarzania pliku /all-orders.php. Manipulacja argumentem Status prowadzi do wstrzykiwania SQL.

A SQL injection vulnerability was found in Simple Food Ordering System 1.0 in /editproduct.php. Manipulation of the Category argument allows remote SQL injection. The exploit is publicly available.