CVE Vulnerability Catalog

W systemie zarządzania biblioteką Advanced Library Management System w wersji 1.0 zidentyfikowano podatność. Manipulacja argumentem user_id w pliku /view_member.php może prowadzić do wstrzyknięcia SQL. Atak może być przeprowadzony zdalnie.

A SQL injection vulnerability was found in SourceCodester Hotel and Lodge Management System 1.0 in the file /edit_booking.php. Manipulating the Name argument allows remote attack. The exploit has been publicly disclosed and may be used.

W systemie zarządzania hotelami i pensjonatami SourceCodester w wersji 1.0 odkryto podatność. Manipulacja argumentem currsymbol w pliku /edit_curr.php prowadzi do wstrzyknięcia SQL, co umożliwia zdalne przeprowadzenie ataku.

W systemie zarządzania hotelami i pensjonatami SourceCodester w wersji 1.0 znaleziono lukę, która dotyczy nieznanej funkcji w pliku /edit_room.php. Manipulacja argumentem ID prowadzi do wstrzykiwania SQL, co umożliwia zdalne przeprowadzenie ataku.

W systemie zarządzania hotelami i pensjonatami SourceCodester w wersji 1.0 wykryto podatność, która dotyczy nieznanej funkcji w pliku /edit_customer.php. Manipulacja argumentem ID prowadzi do wstrzyknięcia SQL, co może być przeprowadzone zdalnie.

The Welcart e-Commerce plugin for WordPress is vulnerable to SQL Injection via the cookie in all versions up to, and including, 2.11.21 due to insufficient escaping on the user supplied value and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Author-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

File upload leading to remote code execution (RCE) in the “melis-cms-slider” module of Melis Technology's Melis Platform. This vulnerability allows an attacker to upload a malicious file via a POST request to '/melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm' using the 'mcsdetail_img' parameter.

A vulnerability in the melis-core module of Melis Technology's Melis Platform allows an unauthenticated attacker to create an administrator account. Exploitation occurs via a request to the '/melis/MelisCore/ToolUser/addNewUser' endpoint.

A SQL injection vulnerability in the melis-cms module of the Melis platform from Melis Technology allows an attacker to retrieve, create, update, and delete databases. The vulnerability occurs in the 'idPage' parameter in the '/melis/MelisCms/PageEdition/getTinyTemplates' endpoint.

A security vulnerability has been detected in SourceCodester Hotel and Lodge Management System up to version 1.0. The impacted element is an unknown function of the file /manage_website.php, where manipulation of the website_image/back_login_image arguments leads to unrestricted upload. The attack can be carried out remotely, and the exploit has been publicly disclosed.

A SQL injection vulnerability was found in SourceCodester Hotel and Lodge Management System 1.0 in /pages/save_customer.php. Manipulation of the Contact argument allows remote attack. The exploit is publicly available.

A security vulnerability has been detected in TOTOLINK N600R up to 4.3.0cu.7866_B20220506 in the setWiFiBasicConfig function of the /cgi-bin/cstecgi.cgi file in the HTTP Request Handler component. Manipulation of the wepkey argument leads to buffer overflow. The attack can be launched remotely, and the exploit has been publicly disclosed.

A weakness in JhumanJ OpnForm up to 1.9.3 affects an unknown function in /api/password/email of the Forgotten Password Handler component. This manipulation causes information exposure through discrepancy. The attack can be initiated remotely but has high complexity and is difficult to exploit. The exploit is public. This issue is aligned with Laravel issue #46465, so no mitigation was taken.

A security flaw has been discovered in JhumanJ OpnForm up to 1.9.3. The impacted element is an unknown function of the component API Endpoint. The manipulation results in cross-site request forgery. The attack may be performed from remote. The exploit has been released to the public and may be exploited. The vendor has stated that API calls require authentication through Authorization Bearer Tokens, so classic CSRF attacks do not apply here. An attacker would need to possess the JWT through means such as XSS which were mitigated, disabling any form of initial access.

Successful exploitation of the vulnerability could allow an unauthenticated attacker to gain access to a victim's Sync account data such as account credentials and email protection information.

A vulnerability in JhumanJ OpnForm up to 1.9.3 affects an unknown function of the HTTP Header Handler component. Manipulation of the X-Forwarded-For argument leads to improper restriction of excessive authentication attempts. The attack can be carried out remotely but requires high complexity and is difficult to exploit. The exploit is publicly available. A patch is identified as 11e99960e14ca986b1a001a56e7533223d2cfa5b.

A vulnerability in JhumanJ OpnForm up to 1.9.3 involves improper access controls in /edit. The attack can be executed remotely. The exploit is publicly disclosed. A patch is recommended: b15e29021d326be127193a5dbbd528c4e37e6324.

A vulnerability in JhumanJ OpnForm up to 1.9.3 involves missing authorization in /show/integrations. The attack can be executed remotely. The exploit is publicly disclosed. A patch is recommended: 11d97d78f2de2cb49f79baed6bde8b611ec1f384.

A vulnerability has been found in JhumanJ OpnForm up to 1.9.3 affecting /custom-domains in the API Endpoint component. Manipulation leads to missing authorization. The attack may be launched remotely and the exploit is public. The patch name is beb153ce52dceb971c1518f98333328c95f1ba20.

A flaw in JhumanJ OpnForm up to 1.9.3 affects an unknown part of /api/open/forms/ of the Form Editor component. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been published. The vendor has stated that the feature is disabled until the user configures their own domain, which mitigates the attack vector.