CVE Vulnerability Catalog

A vulnerability was detected in sequa-ai sequa-mcp up to 1.0.13 affecting the redirectToAuthorization function of the file src/helpers/node-oauth-client-provider.ts (OAuth Server Discovery component). Manipulation results in OS command injection. Remote exploitation is possible and the exploit is now public. Upgrading to version 1.0.14 mitigates the issue.

A security vulnerability has been detected in itsourcecode Online Clinic Management System 1.0. Affected by this issue is some unknown functionality of the file transact.php. Such manipulation of the argument firstname leads to SQL injection. The attack may be launched remotely and the exploit has been disclosed publicly.

A SQL injection vulnerability has been identified in SourceCodester Online Polling System 1.0, specifically in /admin/positions.php. Manipulation of the ID argument allows SQL injection, and the attack can be launched remotely. The exploit has been publicly disclosed.

A security flaw in itsourcecode E-Commerce Website 1.0 allows unrestricted file upload via /admin/users.php. The attack can be launched remotely, and the exploit has been publicly disclosed.

A reflected Cross-Site Scripting (XSS) vulnerability exists in the web-based management interface of network access control services. An unauthenticated remote attacker can execute arbitrary JavaScript in a victim's browser.

A vulnerability was identified in itsourcecode E-Commerce Website 1.0. This impacts an unknown function of the file /admin/products.php. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit is publicly available and might be used.

A vulnerability was determined in itsourcecode E-Logbook with Health Monitoring System for COVID-19 1.0 on COVID. This affects an unknown function of the file /print_reports_prev.php. Executing manipulation of the argument profile_id can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

A vulnerability has been found in itsourcecode Student Information System 1.0. The affected element is an unknown function of the file /leveledit1.php. Such manipulation of the argument level_id leads to sql injection. The attack may be performed from remote. The exploit has been disclosed to the public and may be used.

A vulnerability was detected in Portabilis i-Educar up to 2.10. The affected element is an unknown function of the file /enrollment-history/. Performing manipulation results in improper access controls. The attack is possible to be carried out remotely. The exploit is now public and may be used.

W Dyad, lokalnej aplikacji do budowy AI, odkryto krytyczną podatność, która dotyczy wersji v0.19.0 i wcześniejszych. Umożliwia ona atakującym wykonanie dowolnego kodu na systemach użytkowników poprzez funkcjonalność okna podglądu aplikacji.

A security flaw has been discovered in Portabilis i-Educar up to 2.10, affecting /agenda_preferencias.php. Manipulation of the tipoacao argument results in cross-site scripting (XSS), and the attack can be launched remotely. The exploit has been publicly released.

Zidentyfikowano podatność w PHPGurukul Online Discussion Forum w wersji 1.0, która dotyczy nieznanej części pliku /admin/edit_member.php. Manipulacja argumentem ID prowadzi do wstrzyknięcia SQL.

W PHPGurukul Online Discussion Forum w wersji 1.0 zidentyfikowano podatność, która dotyczy nieznanej funkcjonalności pliku /admin/admin_forum/search_result.php. Manipulacja argumentem Search może prowadzić do wstrzyknięcia SQL.

A SQL Injection vulnerability was found in SourceCodester Online Exam Form Submission 1.0 in the file /admin/delete_s1.php. By manipulating the ID argument, an attacker can execute arbitrary SQL queries. The vulnerability can be exploited remotely, and the exploit has been publicly disclosed.

Wykryto podatność w SourceCodester Online Exam Form Submission w wersji 1.0, która dotyczy nieznanej funkcji w pliku /admin/index.php. Manipulacja argumentem email prowadzi do wstrzyknięcia SQL, co umożliwia zdalne przeprowadzenie ataku.

W systemie SourceCodester Online Exam Form Submission w wersji 1.0 odkryto lukę, która dotyczy nieznanej funkcji pliku /register.php. Manipulacja argumentem img umożliwia nieograniczone przesyłanie plików.

W systemie zarządzania laboratoriami internetowymi itsourcecode w wersji 1.0 odkryto lukę bezpieczeństwa. Manipulacja argumentem user_email w funkcji User::AuthenticateUser w pliku login.php prowadzi do podatności na atak typu SQL injection.

Zidentyfikowano podatność w oprogramowaniu SourceCodester Pet Grooming Management Software w wersji 1.0. Problem dotyczy nieznanego przetwarzania pliku /admin/search_product.php, co prowadzi do możliwości wstrzyknięcia SQL.

A vulnerability was determined in kidaze CourseSelectionSystem up to 42cd892b40a18d50bd4ed1905fa89f939173a464. This affects unknown code in the file /Profilers/PriProfile/COUNT2.php. Manipulation of the cname argument causes SQL injection. The attack may be initiated remotely.

Apache::AuthAny::Cookie w wersji 0.201 lub wcześniejszej dla Perla generuje identyfikatory sesji w sposób niebezpieczny. Identyfikatory sesji są tworzone przy użyciu hasha MD5 czasu epoki oraz funkcji rand, która nie jest odpowiednia do zastosowań kryptograficznych.