CVE Vulnerability Catalog

Cross Site Scripting (XSS) vulnerability in sourcecodester Lost and Found Information System 1.0 allows remote attackers to execute arbitrary code via the First Name, Middle Name and Last Name fields on the Create User page.

Cross Site Scripting (XSS) vulnerability in sourcecodester Toll Tax Management System 1.0 allows remote attackers to run arbitrary code via the First Name and Last Name fields on the My Account page.

User enumeration is found in PHPJabbers Cleaning Business Software version 1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.

In PHPJabbers Cleaning Business Software version 1.0, lack of verification when changing an email address and/or password on the Profile Page allows remote attackers to take over accounts.

PHPJabbers Cleaning Business Software version 1.0 is vulnerable to Cross Site Scripting (XSS) via the theme parameter of preview.php.

There is a Cross Site Scripting (XSS) vulnerability in the 'theme' parameter of preview.php in PHPJabbers Class Scheduling System 1.0.

User enumeration is found in PHPJabbers Class Scheduling System v1.0. This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.

In PHP Jabbers Class Scheduling System version 1.0, lack of verification when changing an email address and/or password on the Profile Page allows remote attackers to take over accounts.

PHPJabbers Availability Booking Calendar version 5.0 is vulnerable to User Account Takeover through username/password change.

PHP Jabbers Availability Booking Calendar version 5.0 is vulnerable to Incorrect Access Control.

PHPJabbers Availability Booking Calendar version 5.0 is vulnerable to Incorrect Access Control due to improper input validation of the password parameter.

In ai-dev aitable versions before v0.2.2, a SQL injection vulnerability was discovered in the component /includes/ajax.php.

An insecure access control vulnerability in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate privileges because session IDs are not validated against user type. Any authenticated user can access administrative functions without restriction by making direct requests to admin endpoints.

A vulnerability in ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the server. It exploits a path traversal issue in the Username field and lack of input sanitization on the SSH Key field in /base/sftpsetting/ endpoints.

A vulnerability in a hidden API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to arbitrarily reset the Administrator password via a crafted web request.

A Persistent XSS vulnerability exists in a certain field of Unica Campaign. An attacker could hijack a user's session and perform other attacks.

A Persistent Cross-site Scripting (XSS) vulnerability exists on certain pages of Unica Platform. An attacker could hijack a user's session and perform other attacks.

A Persistent Cross-site Scripting (XSS) vulnerability exists in a certain field of the Unica Platform. An attacker could hijack a user's session and perform other attacks.

A user is capable of assigning him/herself to arbitrary groups by reusing a POST request issued by an administrator. It is possible that an attacker could potentially escalate their privileges.