CVE Vulnerability Catalog

Wtyczka BookIt dla WordPressa jest podatna na obejście uwierzytelniania w wersjach do 2.3.7 włącznie. Problem wynika z niewystarczającej weryfikacji użytkownika podczas rezerwacji wizyty przez wtyczkę.

XWiki Platform allows attackers to inject XWiki syntax and Velocity code by editing documents with an icon set, leading to remote code execution. Various attack vectors, including the use of the icon set in HTML, can be exploited.

XWiki Platform allows users to edit their profiles and notification settings, enabling the execution of arbitrary script macros, including Groovy and Python, leading to remote code execution. Versions 14.10.6 and 15.2RC1 contain patches for this vulnerability.

A vulnerability in XWiki Platform allows remote code execution even after upgrading to a version that includes fixes. The issue arises when old document versions containing vulnerabilities are not removed from history, allowing for their reuse.

XWiki commons had a vulnerability in HTML sanitization that allowed the use of form and input tags. An attacker could create phishing forms or inject malicious code that could be executed by an admin.

Sealos is an open source cloud operating system distribution based on the Kubernetes kernel. In versions of Sealos prior to 4.2.1-rc4 an improper configuration of RBAC permissions allowed an attacker to obtain cluster control permissions, enabling control over the entire cluster and hundreds of pods and other resources.

The password reset function in ILIAS versions 7.0_beta1 through 7.20 and 8.0_beta1 through 8.1 allows remote attackers to take over the account.

STW TCG-4 and TCG-4lite connectivity modules allow an attacker to gain full remote access with root privileges without the need for authentication. An attacker can execute arbitrary remote code over LTE / 4G network via SMS.

An unauthorized command injection vulnerability exists in the ActionLogin function of the webman.lua file in Ikuai router OS through version 3.7.1.

Play With Docker versions below 0.0.2 have an insecure CAP_SYS_ADMIN privileged mode allowing Docker container escape.

Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files present in the installation folder in the server's response.

Cloud Platform Management Center version 1.0 is vulnerable to error-based SQL injection.

The Online Hotel Management System Project in PHP version 1.0.0 is vulnerable to SQL Injection. This vulnerability exists in the login password input box and can be exploited through time-based blind injection.

Wtyczka WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) jest podatna na obejście uwierzytelniania w wersjach do 7.6.4 włącznie. Problem wynika z niewystarczającego szyfrowania danych użytkownika podczas logowania, co pozwala nieautoryzowanym atakującym na logowanie się jako dowolny istniejący użytkownik, w tym administrator.

Chemex versions up to 3.7.1 are vulnerable to arbitrary file upload.

Parse Server prior to versions 5.5.2 and 6.2.1 is vulnerable to prototype pollution, which can lead to remote code execution through the MongoDB BSON parser.

The Lost and Found Information System v1.0 was found to contain a SQL injection vulnerability in the component /php-lfis/admin/?page=system_info/contact_information.

There is a Server-Side Request Forgery (SSRF) vulnerability in the GitHub repository plantuml/plantuml prior to version 1.2023.9. This may lead to unauthorized access to internal server resources.

Version 3.3.8.0 and earlier of BlogEngine.Net contains an Unrestricted Upload vulnerability due to insufficient validation in the UploadControlled.cs file, allowing remote attackers to execute remote code.

The OCB feature in libnettle in Nettle 3.9 before 3.9.1 allows memory corruption.