CVE Vulnerability Catalog

An unauthorized command injection vulnerability exists in the ActionLogin function of the webman.lua file in Ikuai router OS through version 3.7.1.

Play With Docker versions below 0.0.2 have an insecure CAP_SYS_ADMIN privileged mode allowing Docker container escape.

Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files present in the installation folder in the server's response.

Cloud Platform Management Center version 1.0 is vulnerable to error-based SQL injection.

The Online Hotel Management System Project in PHP version 1.0.0 is vulnerable to SQL Injection. This vulnerability exists in the login password input box and can be exploited through time-based blind injection.

Wtyczka WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) jest podatna na obejście uwierzytelniania w wersjach do 7.6.4 włącznie. Problem wynika z niewystarczającego szyfrowania danych użytkownika podczas logowania, co pozwala nieautoryzowanym atakującym na logowanie się jako dowolny istniejący użytkownik, w tym administrator.

Chemex versions up to 3.7.1 are vulnerable to arbitrary file upload.

Parse Server prior to versions 5.5.2 and 6.2.1 is vulnerable to prototype pollution, which can lead to remote code execution through the MongoDB BSON parser.

The Lost and Found Information System v1.0 was found to contain a SQL injection vulnerability in the component /php-lfis/admin/?page=system_info/contact_information.

There is a Server-Side Request Forgery (SSRF) vulnerability in the GitHub repository plantuml/plantuml prior to version 1.2023.9. This may lead to unauthorized access to internal server resources.

Version 3.3.8.0 and earlier of BlogEngine.Net contains an Unrestricted Upload vulnerability due to insufficient validation in the UploadControlled.cs file, allowing remote attackers to execute remote code.

The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption.

The MStore API plugin for WordPress is vulnerable to Unauthenticated Blind SQL Injection via the 'id' parameter in versions up to and including 4.0.1 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query.

PHP-IMAP prior to version 5.3.0 has a remote code execution vulnerability due to unsanitized attachment filenames. An attacker can exploit this vulnerability by sending a malicious attachment, leading to code execution on the server.

XWiki Platform has a vulnerability allowing for XSS attacks by injecting JavaScript through a forged URL. This can be exploited using the previewactions template, potentially executing unauthorized code on the page.

XWiki Platform allows users to forge URLs with payloads, enabling JavaScript injection on the page (XSS). The DeleteApplication page can be exploited to perform an XSS attack using a specially crafted URL.

XWiki Platform has a vulnerability to XSS attacks, allowing users to inject JavaScript code through forged URLs. Exploiting the resubmit template enables the execution of malicious code, potentially leading to user data exposure.

XWiki Platform allows users to forge URLs with payloads that enable JavaScript injection on the page (XSS). The deletespace template can be exploited to perform an XSS attack, for example using the URL: > xwiki/bin/deletespace/Sandbox/?xredirect=javascript:alert(document.domain).

The XWiki Platform has a vulnerability that allows the injection of JavaScript (XSS) through a forged URL. Users can exploit the restore template to perform an XSS attack, potentially leading to unauthorized access to data.

XWiki Platform has a vulnerability to XSS attacks, allowing users to inject JavaScript through a forged URL. Exploiting the delete template enables XSS attacks, which may lead to unauthorized access to user data.