CVE Vulnerability Catalog

A vulnerability was found in SourceCodester School Registration and Fee System 1.0. The affected element is an unknown function of the file /bilal/normal/pay_report.php. Performing a manipulation of the argument period results in sql injection. The attack can be initiated remotely. The exploit has been made public and could be used.

A vulnerability was determined in SourceCodester School Registration and Fee System 1.0. The impacted element is an unknown function of the file /bilal/normal/delete_stud.php. Executing a manipulation of the argument selector[] can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

In rustypaste before 0.18.1, the destination path is validated before the optional custom filename HTTP header is applied, allowing attackers to bypass directory-escape checks. Attackers can supply path traversal sequences in the filename header to write files outside the configured upload directory to arbitrary locations.

Amundsen frontend through 4.3.0 renders table, dashboard, and feature descriptions with dangerouslySetInnerHTML without HTML sanitization in ResourceListItem components. Attackers can inject malicious markup like img elements with onerror handlers into descriptions via the metadata service or Elasticsearch, executing JavaScript in every user's browser that views search results.

Spug through 3.4.0 contains a remote code execution vulnerability in the ping_check function that interpolates user-supplied monitor addresses directly into shell commands without validation. Authenticated users with monitor permissions can inject shell metacharacters via the /monitor/run_test/ endpoint to execute arbitrary commands as the Spug process user.

Open Notebook before 1.11.0 fails to validate the URL parameter in the POST /api/sources endpoint, allowing authenticated users to perform server-side requests to internal services. Attackers can supply arbitrary URLs to read cloud metadata, internal network services, and localhost-bound services through the application server's direct HTTP requests.

CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by other users. Attackers can enumerate all tasks in the system and delete arbitrary analyses by sending requests to task view and delete endpoints without ownership verification.

LangBot before 4.10.11 generates password recovery keys with only 24 bits of entropy and applies no rate limiting to the unauthenticated reset-password endpoint. Remote attackers knowing the administrator email can exhaust the keyspace through concurrent requests to reset the admin password and gain account access.

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious script tags in rich text fields that execute in an Editor or Super Admin's session when the preview pane is expanded, enabling account takeover.

A vulnerability has been found in SourceCodester School Registration and Fee System 1.0. Impacted is an unknown function of the file /bilal/normal/save_stud.php. Such manipulation of the argument Status leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

A security vulnerability has been detected in dromara orion-visor up to 2.5.7. This affects the function HostKeyServiceImpl.encryptKey of the file HostKeyServiceImpl.java. The manipulation leads to use of hard-coded cryptographic key. The attack is possible to be carried out remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.

A weakness has been identified in dromara orion-visor up to 2.5.7. Affected by this issue is the function ExposeApiAspect.beforeExposeApi of the file ExposeApiAspect.java. Executing a manipulation can lead to hard-coded credentials. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability was found in WARP-Clash-API where the authorized function lacks authentication. Manipulation of the SECRET_KEY argument allows unauthorized remote access. The exploit has been publicly disclosed and may be used.

A vulnerability was identified in lenve vhr 1.0-SNAPSHOT involving the use of default credentials in the vhr.sql file. The attack can be performed remotely and the exploit is publicly available. The vendor did not respond to the disclosure.

The Really Simple Security WordPress plugin before 9.8.1 does not prevent an unauthenticated request from resetting an account's completed email two-factor enrolment. An attacker who knows the account password can bypass the second factor and obtain the user's session, up to administrator.

The User Registration & Membership WordPress plugin before 5.2.8 does not check the capability of the user making a membership purchase, and does not validate the payment method or the plan submitted with it. Any authenticated user such as a subscriber can be granted the WordPress role attached to a paid plan without paying for it.

The User Registration & Membership WordPress plugin before 5.2.8 does not properly restrict who may author a membership plan or validate the plan a user attaches to their own account. Authenticated users with Author-level access and above can assign themselves an arbitrary role and escalate their privileges to Administrator.

A vulnerability of the HTTP request smuggling type was discovered in HAProxy versions 3.3.0 through 3.4.4 and 3.5-dev1 through 3.5-dev5. It requires an HTTP/3 frontend (built with QUIC support and a QUIC bind listener) and a backend reached over HTTP/1.1 using chunked transfer coding on a reused connection. When an HTTP/3 request carries no Content-Length header, the declared length from a DATA frame header is credited before the payload is received and emitted verbatim as the HTTP/1.1 chunk size, desynchronizing the connection.

A SQL injection vulnerability was found in Feng Office up to 3.11.13.11, affecting the Contacts::instance->findAll function in application/models/CompanyWebsite.class.php within the Legacy API component. Manipulation of the auth argument leads to SQL injection. The attack can be launched remotely and the exploit has been publicly disclosed.

A vulnerability was detected in Tonec Internet Download Manager up to 6.42 Build 63 on Windows. The kernel driver idmwfp.sys exposes the \\.\IDMWFP device interface to authenticated local users with an access control descriptor equivalent to D:P(A;;GA;;;AU), and its IOCTL 0x12C028 handler does not authenticate the caller or restrict operations to IDM-owned registry namespaces. This allows a low-privileged local authenticated user to read, create, modify, and delete arbitrary registry values under HKLM and HKU.