CVE Vulnerability Catalog

A critical vulnerability has been found in SourceCodester Shopping Website 1.0, related to an unknown functionality of the file insert-product.php. Manipulation of this functionality leads to unrestricted file uploads.

A critical vulnerability was found in SourceCodester Shopping Website version 1.0, affecting an unknown function in the file search-result.php. Manipulation of the argument 'product' leads to SQL injection.

The Ultimate Member WordPress plugin before version 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will.

The Protect WP Admin WordPress plugin before 4.0 discloses the URL of the admin panel via a redirection of a crafted URL, bypassing the protection offered.

The Tutor LMS WordPress plugin before 2.2.1 does not implement adequate permission checks for REST API endpoints, allowing unauthenticated attackers to access information from Lessons that should not be publicly available.

All versions of the TWinSoft Configuration Tool store encrypted passwords as plaintext in memory. An attacker with access to system files could open a file to load the document into memory, including sensitive information associated with the document, such as the password.

Affected TBox RTUs allow low privilege users to access software security tokens of higher privilege. An attacker with 'user' privileges could access files requiring higher privileges by establishing an SSH session and providing the other tokens.

Affected TBox RTUs generate software security tokens using insufficient entropy. The random seed used to generate the software tokens is not initialized correctly, and other parts of the token are generated using predictable time-based values.

Buffer Overflow vulnerability in mtrojnar osslsigncode v.2.3 and before allows a local attacker to execute arbitrary code via crafted .exe, .sys, and .dll files.

Maxsite CMS version 108.7 has a Cross Site Scripting vulnerability that allows a remote attacker to execute arbitrary code via the f_content parameter in the admin/page_new file.

An issue in LangChain before version 0.0.236 allows an attacker to execute arbitrary code. The ability to use os.system, exec, or eval in Python code poses a significant risk.

A Cross-Site Scripting vulnerability in bbs-go version 3.5.5 and earlier allows a remote attacker to execute arbitrary JavaScript code via a crafted payload in the 'announcements' parameter of the settings function.

Cross Site Scripting (XSS) vulnerability in bbs-go version 3.5.5 and earlier. A remote attacker can execute arbitrary code via a crafted payload in the comment parameter of the article function.

Buffer Overflow vulnerability in OpenImageIO v.2.4.12.0 and before allows a remote attacker to execute arbitrary code and obtain sensitive information via a crafted file to the readimg function.

ZZCMS versions 2023 and earlier have a Cross Site Request Forgery vulnerability that allows a remote attacker to gain privileges via the add function in adminlist.php.

Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory.

Affected TBox RTUs run OpenVPN with root privileges and can run user defined configuration scripts. An attacker could set up a local OpenVPN server and push a malicious script onto the TBox host to acquire root privileges.

Affected TBox RTUs store hashed passwords using MD5 encryption, which is considered insecure.

Knowage is a professional open source suite for data analytics that has a vulnerability in versions 6.x.x and prior to 8.1.8. It allows authenticated users to download template files, but the lack of sanitization of the '_templateName_' parameter enables attackers to download any file from the system.

In version 0.1.0 of the `tktchurch/website` project, a Stripe API key was found in the public code repository. This sensitive information was unintentionally exposed, creating risks of unauthorized transactions and privacy violations.