CVE Vulnerability Catalog

In CodeAstro Online Classroom 1.0, a SQL injection vulnerability was found in the file /OnlineClassroom/addvideos.php via manipulation of the videotitle argument. The attack can be performed remotely and the exploit is publicly available.

In CodeAstro Online Classroom 1.0, a SQL injection vulnerability was found in the file /OnlineClassroom/updatedetailsfromfaculty.php?myfid=108 via manipulation of the fname argument. The attack can be performed remotely and the exploit has been publicly disclosed.

In CodeAstro Online Classroom 1.0, an SQL injection vulnerability exists in /OnlineClassroom/addassessment.php via manipulation of the deleteid argument. Remote exploitation is possible and the exploit is public.

SourceCodester/jkev Record Management System 1.0 allows unrestricted file upload via save_emp.php on the Add Employee page. Remote exploitation is possible and the exploit is public.

Missing authorization in the deletefile function of the FsBrowseClean component in Technostrobe HI-LED-WR120-G2 (version 5.5.0.1R6.03.30). Manipulation of the dir/path argument allows remote file deletion.

Technostrobe HI-LED-WR120-G2 version 5.5.0.1R6.03.30 is vulnerable to CSRF in an unknown function. The attack can be performed remotely, and the exploit has been publicly released.

Technostrobe HI-LED-WR120-G2 version 5.5.0.1R6.03.30 has a vulnerability in an unknown function of the /fs file in the Configuration Data Handler component. Manipulating the File argument leads to information disclosure. The attack is remote, and the exploit is public. The vendor did not respond.

SQL Injection vulnerability in AutohomeCorp frostmourne up to version 1.0. The httpTest function in /api/monitor-api/alarm/previewData in Alarm Preview component allows manipulation leading to SQL injection. Remote attack possible. Exploit published.

Campcodes Complete POS Management and Inventory System up to 4.0.6 has an injection vulnerability in SettingsController.php in the Environment Variable Handler component. Remote attack is possible and the exploit is public.

A SQL injection vulnerability was found in PHPGurukul Online Shopping Portal Project 2.1 in the file /payment-method.php. Manipulation of the paymethod argument allows remote attack. The exploit has been made public.

In PyBlade versions 0.1.8-alpha and 0.1.9-alpha, the function _is_safe_ast in sandbox.py (AST Validation component) improperly neutralizes special elements used in a template engine. The attack can be performed remotely, and the exploit has been publicly disclosed.

In PHPGurukul Online Shopping Portal Project up to version 2.1, a SQL injection vulnerability was found in the file /pending-orders.php via manipulation of the ID argument. The attack can be performed remotely and the exploit has been published.

In pi-mono up to version 0.58.4, the pi-mom Slack Bot component in packages/mom/src/slack.ts has an authentication bypass vulnerability via an alternate channel. The attack can be executed remotely and the exploit is public.

pi-mono up to 0.58.4 has a code injection vulnerability in the discoverAndLoadExtensions function in loader.ts. Remote exploitation is possible and the exploit is public.

In itsourcecode Online Cellphone System 1.0, a SQL injection vulnerability was found in the file /cp/available.php via manipulation of the Name argument. The attack can be performed remotely and the exploit is publicly available.

A SQL injection vulnerability was identified in PHPGurukul Online Shopping Portal Project 2.1 in the file /sub-category.php. Manipulation of the pid argument allows remote attack. The exploit has been made public.

Vulnerability in Tenda AC10 version 16.03.10.10_multi_TDE01, in the file /webroot_ro/pem/privkeySrv.pem of the RSA 2048-bit Private Key Handler component. Manipulation leads to use of a hard-coded cryptographic key. Remote attack possible, exploit publicly available.

In the Tenda AC10 router version 16.03.10.10_multi_TDE01, the function formAddMacfilterRule in file /bin/httpd is vulnerable to OS command injection. The attack can be performed remotely, and multiple endpoints may be affected.

In Campcodes Complete Online Learning Management System 1.0, an unrestricted file upload vulnerability was found in the add_lesson function in the file /application/models/Crud_model.php. The attack can be performed remotely and the exploit has been published.

SQL Injection vulnerability in PHPGurukul User Registration & Login and User Management System 3.3. An unknown function in the file /admin/yesterday-reg-users.php allows manipulation of the ID argument, leading to SQL injection. Remote attack is possible, exploit is public.