CVE Vulnerability Catalog

User enumeration is found in PHPJabbers Taxi Booking Script v2.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.

User enumeration is found in PHPJabbers Fundraising Script v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.

User enumeration is found in PHPJabbers Yacht Listing Script v2.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.

User enumeration is found in PHP Jabbers Hotel Booking System v4.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.

User enumeration is found in PHP Jabbers Restaurant Booking Script v3.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.

User enumeration is found in PHPJabbers Document Creator v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.

User enumeration is found in PHPJabbers Food Delivery Script v3.1. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.

User enumeration is found in PHPJabbers Callback Widget v1.0 during the password recovery process. Differences in messages could allow an attacker to determine if a user is valid, enabling a brute force attack on valid users.

PHPJabbers Food Delivery Script v3.0 is vulnerable to SQL Injection in the 'column' parameter of index.php.

PHPJabbers Food Delivery Script version 3.0 has a SQL injection (SQLi) vulnerability in the 'q' parameter of index.php.

Saho's attendance devices ADM100 and ADM-100FP have insufficient filtering for special characters and file types within their file uploading function. This allows an unauthenticated remote attacker to upload and execute arbitrary files, potentially performing arbitrary system commands or disrupting service.

Saho's attendance devices ADM100 and ADM-100FP have insufficient authentication. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication to read system information and operate user's data.

SpotCam Sense has a hidden Telnet function that is vulnerable to OS command injection. A remote unauthenticated attacker can exploit this vulnerability to execute arbitrary system commands or disrupt service.

SpotCam FHD 2 by SpotCam Co., Ltd. has a vulnerability related to the use of hard-coded uBoot credentials. A remote attacker can exploit this vulnerability to gain access to the system to perform arbitrary system operations or disrupt service.

The SpotCam FHD 2 device from SpotCam Co., Ltd. has a hidden Telnet function that is vulnerable to OS command injection. A remote unauthenticated attacker can exploit this vulnerability to perform command injection attacks or disrupt service.

The SpotCam FHD 2 device from SpotCam Co., Ltd. has a hidden Telnet function that contains a vulnerability due to hard-coded Telnet credentials. A remote unauthenticated attacker can exploit this vulnerability to gain access to the system and perform arbitrary system operations or disrupt services.

In versions 0.2.3 and prior, the weblogic-framework tool does not verify returned data packets, leading to a deserialization vulnerability. This may result in remote code execution when the tool deserializes data returned by the server without verification.

Tenda AC23 version Vv16.03.07.45_cn is vulnerable to buffer overflow in the sub_450A4C function.

IceWarp Mail Server v10.4.5 was discovered to contain a local file inclusion (LFI) vulnerability via the component /calendar/minimizer/index.php. This vulnerability allows attackers to include or execute files from the local file system of the targeted server.

CVE-2023-4420 allows a remote unprivileged attacker to intercept communication with SICK LMS5xx devices due to the absence of TLS security. This can lead to unauthorized disclosure of sensitive information and data manipulation.