CVE Vulnerability Catalog

W podatności CVE-2021-22291 występuje niewłaściwa neutralizacja danych wejściowych podczas generowania stron internetowych, co prowadzi do ataków typu Cross-site Scripting (XSS) w urządzeniach ABB EIBPORT V3 KNX oraz EIBPORT V3 KNX GSM. Problem dotyczy wersji przed 3.9.2.

An IDOR vulnerability in Negotiator v3.15.2 from BBMRI-ERIC allows an attacker to access or modify unauthorized resources by manipulating the 'userID' parameter in requests to '/api/v3/users/<userID>'. This may result in exposure or alteration of sensitive data.

Stored Cross-Site Scripting (XSS) in Biobanking and Biomolecular Resources Negotiator v3.15.2 (BBMRI-ERIC) due to lack of proper validation of user input when sending a POST request with parameter text in '/api/v3/negotiations/<postUID>/posts'. This could allow a remote user to send a specially crafted query to an authenticated user and steal their cookie session details.

W interfejsie zarządzania webowego odkryto podatność typu przejście ścieżki po stronie klienta z powodu braku walidacji parametru wejściowego. Użytkownik z ograniczonymi uprawnieniami może stworzyć złośliwy URL, który, jeśli zostanie odwiedzony przez ofiarę, prowadzi do ataku Cross-Site Scripting (XSS).

Zidentyfikowano podatność w systemie zamówień żywności Simple Food Ordering System w wersji 1.0. Manipulacja argumentem Category w pliku /product.php prowadzi do wstrzyknięcia SQL, co może być wykorzystane przez atakującego zdalnie.

A weakness in PHPGurukul Cyber Cafe Management System 1.0 in /search.php (POST Parameter Handler) allows manipulation of the searchdata argument leading to cross-site scripting. The attack can be executed remotely, and the exploit is publicly available.

W urządzeniu Tenda AC15 w wersji 15.03.05.18 odkryto lukę bezpieczeństwa w nieznanej funkcji pliku /goform/saveAutoQos. Manipulacja argumentem enable prowadzi do przepełnienia bufora na stosie, co umożliwia zdalne wykorzystanie tej podatności.

W podatności CVE-2025-0603 występuje niewłaściwa neutralizacja specjalnych elementów używanych w poleceniu SQL, co pozwala na ataki typu SQL Injection oraz Blind SQL Injection w systemie Callvision Healthcare Callvision Emergency Code przed wersją 3.0.

A stack-based buffer overflow vulnerability was identified in Tenda AC15 version 15.03.05.18. Manipulation of the newVersion argument in /goform/setNotUpgrade allows remote attacks, and the exploit is publicly available.

A stack-based buffer overflow vulnerability was determined in Tenda AC15 version 15.03.05.18. Manipulation of the Password argument in /goform/fast_setting_pppoe_set allows remote attacks, and the exploit has been publicly disclosed.

A stack-based buffer overflow vulnerability was found in Tenda AC15 version 15.03.05.18. Manipulation of the ddnsEn argument in /goform/SetDDNSCfg allows remote attacks, and the exploit has been publicly disclosed.

A buffer overflow vulnerability exists in Tenda AC20 up to version 16.03.08.12 in the sscanf function of /goform/fast_setting_wifi_set. Manipulation of the timeZone argument allows remote attacks, and the exploit has been publicly disclosed.

A cross site scripting vulnerability was detected in jakowenko double-take up to version 1.13.1 in the app.use function of the file api/src/app.js of the API component. Manipulation of the X-Ingress-Path argument allows remote attack execution. Upgrading to version 1.13.2 resolves the issue.

In code-projects Simple Banking System 1.0, a SQL injection vulnerability exists in an unknown function of the file /transfermoney.php. Manipulation of the argument ID leads to SQL injection. The attack can be performed remotely, and the exploit has been publicly disclosed.

The WP Reset plugin for WordPress up to version 2.05 is vulnerable to Sensitive Information Exposure via the WF_Licensing::log() method when debugging is enabled (default). This allows unauthenticated attackers to extract sensitive license key and site data.

The Featured Image from URL (FIFU) plugin for WordPress up to version 5.2.7 is vulnerable to Stored Cross-Site Scripting (XSS) via a post's Featured Image custom fields due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access can inject arbitrary web scripts that execute when a user accesses an injected page. NOTE: This vulnerability was partially fixed in version 5.2.2.

In code-projects Simple Banking System 1.0, a weakness exists in an unknown function of the file /removeuser.php. Manipulation of the argument ID can lead to SQL injection. The attack may be launched remotely, and the exploit has been made public.

In code-projects Simple Banking System 1.0, a security flaw exists in some unknown processing of the file /createuser.php. Manipulation of the argument Name results in SQL injection. The attack may be initiated remotely, and the exploit has been released.

A buffer overflow vulnerability exists in Tenda AC23 up to version 16.03.07.52 in the sscanf function of /goform/SetStaticRouteCfg. Manipulation of the list argument allows remote attacks, and the exploit has been publicly disclosed.

A buffer overflow vulnerability exists in UTT 1250GW up to v2v3.2.2-200710 in the strcpy function of /goform/aspChangeChannel. Manipulation of the pvid argument allows remote attacks, and the exploit has been publicly disclosed.