CVE Vulnerability Catalog

W oprogramowaniu SourceCodester Pet Grooming Management Software w wersji 1.0 odkryto podatność, która dotyczy nieznanej funkcjonalności pliku /admin/print_inv.php. Manipulacja argumentem ID prowadzi do wstrzykiwania SQL, co umożliwia zdalne przeprowadzenie ataku.

ProjectsAndPrograms School Management System 1.0 has an SQL injection vulnerability in owner_panel/fetch-data/select-students.php. Manipulating the select argument allows remote attacks. The exploit has been published.

W systemie rezerwacji hotelowej SourceCodester Online Hotel Reservation System w wersji 1.0 wykryto podatność. Manipulacja argumentem 'address' w pliku /admin/updateaddress.php prowadzi do wstrzykiwania SQL. Atak może być przeprowadzony zdalnie.

A security vulnerability has been detected in itsourcecode Open Source Job Portal 1.0. This impacts an unknown function of the file /jobportal/admin/category/index.php?view=edit. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

W PHPGurukul Small CRM w wersji 4.0 zidentyfikowano słabość w nieznanej funkcji pliku /forgot-password.php. Manipulacja argumentem email może prowadzić do wstrzyknięcia SQL.

The Professional Contact Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0.0. This is due to missing or incorrect nonce validation on the watch_for_contact_form_submit function. This makes it possible for unauthenticated attackers to trigger test email sending via a forged request if they can trick a site administrator into clicking a link.

The Trust Reviews plugin for Google, Tripadvisor, Yelp, Airbnb and other platforms for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0. This is due to missing or incorrect nonce validation on the feed_save function. This makes it possible for unauthenticated attackers to create or modify feed entries via a forged request if they can trick a site administrator into clicking a link.

The cForms – Light speed fast Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 3.0.0. This is due to missing or incorrect nonce validation on the cforms_api function. This makes it possible for unauthenticated attackers to modify forms and their settings via a forged request if they can trick a site administrator into clicking a link.

The HidePost plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 2.3.8. This is due to missing or incorrect nonce validation on the options.php settings page. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request if they can trick a site administrator into clicking a link.

The Sync Feedly plugin for WordPress (all versions up to and including 1.0.1) is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on the crsf_cron_job_func function. An unauthenticated attacker can trigger content synchronization from Feedly, potentially creating multiple posts via a forged request if they can trick a site administrator into clicking a link.

The VM Menu Reorder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0.0. This is due to missing or incorrect nonce validation on the vm_set_to_default function. This makes it possible for unauthenticated attackers to reset all menu reordering settings via a forged request if they can trick a site administrator into clicking a link.

W systemie CourseSelectionSystem w wersji 1.0/5.php odkryto lukę bezpieczeństwa, która pozwala na wstrzyknięcie SQL poprzez manipulację argumentem csslc. Atak może być przeprowadzony zdalnie, a exploit został udostępniony publicznie.

A cross-site request forgery (CSRF) vulnerability has been found in SourceCodester Pet Grooming Management Software 1.0. The vulnerability affects unknown code and can be exploited remotely.

Wtyczka WP Statistics – Najpopularniejsza wtyczka analityczna przyjazna prywatności dla WordPressa jest podatna na przechowywane ataki Cross-Site Scripting (XSS) poprzez nagłówek User-Agent we wszystkich wersjach do i włącznie z 14.5.4. Problem wynika z niewystarczającej sanitizacji wejścia i ucieczki wyjścia.

A flaw has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /periodo-lancamento. Executing manipulation can lead to improper authorization. The attack can be executed remotely. The exploit has been published and may be used.

A vulnerability was detected in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /unificacao-aluno. Performing manipulation results in improper authorization. Remote exploitation of the attack is possible. The exploit is now public and may be used.

The Ninja Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 3.12.0. This is due to missing or incorrect nonce validation on the maybe_opt_in() function, allowing unauthenticated attackers to opt a site into usage statistics collection via a forged request if they can trick an administrator into clicking a link.

The Ninja Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 3.12.0. This is due to missing or incorrect nonce validation when exporting CSV files, allowing unauthenticated attackers to delete those files if they can trick an administrator into clicking a link.

The Team Members plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the first and last name fields in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping.

IBM Storage TS4500 Library 1.11.0.0 and 2.11.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.