CVE Vulnerability Catalog

A security flaw was discovered in PHPGurukul Bank Locker Management System 1.0 in sidebar.php. Manipulation of the UserType argument results in improper access controls and the attack may be launched remotely. The exploit has been released to the public and may be used for attacks.

A vulnerability was identified in PHPGurukul Bank Locker Management System 1.0 in /blms/view-assign-locker.php. Manipulation of the ltid argument leads to authorization bypass and the attack may be initiated remotely. The exploit is publicly available and might be used.

Froxlor before 2.3.12 fails to properly validate multi-line SSH public keys in the SshKeys::add() endpoint, allowing customers to inject arbitrary lines into authorized_keys files, including malicious SSH key entries with option directives.

A vulnerability was found in api-lambda-send-email-ses affecting the SES.sendEmail function in the template.yml file of the API Gateway Endpoint component. Manipulation of the toEmails/ccEmails/replyToEmails/subject/message arguments causes missing authentication. The attack can be initiated remotely.

A vulnerability was detected in OnlineBooks affecting unknown code in the src/cn/ylcto/book/servlet/BooksServlet.java file of the listSplit Interface component. Manipulation of the column argument results in SQL injection. The attack may be performed remotely and the exploit is publicly available.

A vulnerability was identified in WARP-Clash-API affecting the get_surge_subscription function in the services/subscription.py file of the Subscription Handler component. Manipulation of the key argument leads to improper access controls. The attack may be launched remotely and the exploit is publicly available.

A vulnerability was determined in WARP-Clash-API affecting an unknown function of the Save Account Job component. Manipulation causes a race condition. The attack may be initiated remotely, but its complexity is rated as high and exploitability is said to be difficult.

A race condition vulnerability was found in the doUpdateLicenseKey function of WARP-Clash-API. The attack can be launched remotely but requires a high level of complexity and exploitability is reported as difficult. The exploit has been made public, and the product is no longer supported by the maintainer.

A vulnerability was detected in lenve vhr 1.0-SNAPSHOT affecting the HrInfoController.updateHr function in HrMapper.xml. Manipulation of the Password argument leads to improper privilege management. The attack can be performed remotely and the exploit has been publicly disclosed.

A weakness was identified in lenve vhr 1.0-SNAPSHOT affecting the FastDFSUtils.upload function in /hr/userface (Avatar Upload component). Manipulation of the File argument causes unrestricted upload. The attack can be carried out remotely and the exploit is publicly available.

A security flaw was discovered in lenve vhr 1.0-SNAPSHOT affecting the HrInfoController.updatePass function in /hr/pass (Password Update Handler component). Manipulation of the hrid argument results in improper authorization. The attack can be executed remotely and the exploit has been released to the public.

A vulnerability was found in Feng Office up to 3.11.13.11 affecting the update_system_module_order/update_dimension_order functions in application/controllers/MoreController.class.php (Reorder Handlers component). Manipulation of the modules/dims arguments results in SQL injection. The attack may be initiated remotely and the exploit has been made public.

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.1 does not properly restrict the data returned by an availability-check request. This allows unauthenticated users to retrieve other customers' appointment details, including free-text booking comments and contact information.

The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media. It relies only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to make another user's private activity public or hide it.

The Simple Membership WordPress plugin before 4.7.8 does not validate that the membership level supplied in a PayPal payment notification matches the level configured for the paid payment button. This allows members to pay for a lower-priced membership while being granted a higher, more privileged membership level.

The User Registration & Membership WordPress plugin before 5.2.8 does not validate the destination of a post-login redirect before redirecting. This allows unauthenticated attackers to redirect visitors to an arbitrary external URL, which can be abused for phishing.

The Contact Form to Chat Apps | Click to Chat to Order WordPress plugin before 2.15.8 does not perform any capability, nonce or session check on one of its public AJAX actions. This allows unauthenticated users to read the submitted entries of any form created with a supported third-party form plugin.

Forgejo 13.0.0 through 16.0.4, when "[federation] ENABLED = true" is set, has a spoofing issue affecting identity integrity but not allowing account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belonging to the actor named in the activity body. A remote attacker hosting a single valid ActivityPub actor and keypair can submit signature-valid activities attributed to any actor identity.

A flaw was found in restify (node-restify) up to 12.0.0, affecting the serveStatic function in /lib/plugins/static.js. The manipulation causes path traversal. The attack can be initiated remotely and the vendor did not respond to the disclosure.

A vulnerability has been detected in webgjc web_robot versions 2.4.0, 2.5.0 and 2.8.0. The controller_listen/controller_recover functions in py/web.py mishandle the case_name argument, leading to OS command injection. The attack can be performed remotely and a public exploit is already available.