CVE Vulnerability Catalog

A vulnerability has been found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. An unknown function in the file delete_exam.php is affected. Manipulation of the argument ID leads to authorization bypass. The attack can be carried out remotely and the exploit has been disclosed publicly.

A flaw has been found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This issue affects some unknown processing in the file db.php. Executing a manipulation can lead to hard-coded credentials. The attack can be executed remotely and the exploit has been published.

A weakness has been identified in projeto-siga siga up to 11.1.1. The function DownloadExterno.getUrl in the HTML-to-PDF Endpoint component is affected. Manipulation of the html argument causes server-side request forgery, which can be initiated remotely. The exploit has been made public.

An unrestricted upload vulnerability in U+Smart Enjoyment WebSite 18.6001.1096.1000, affecting an unknown function in /Report/Upload/UploadFormImg.ashx. Manipulating the File argument allows remote arbitrary file upload. The exploit is public.

SQL injection vulnerability in itsourcecode School Management System 1.0, affecting an unknown function in User_Login.php. Manipulating the email argument leads to SQL injection. The attack can be executed remotely, and the exploit is public.

Out-of-bounds write vulnerability in Samsung Opensource Walrus, allowing buffer overflows. Affects version af80e665ea49d9003695a66502f841ed1d8397e7.

Authorization bypass vulnerability in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8, affecting the orderRecordsService.cancelOrder function in OrderController.java. Manipulating the ID argument allows remote authorization bypass. The exploit is public.

Authorization bypass vulnerability in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8, affecting the updateOrderSta1/updateOrderdiseaseInfo functions in OrderController.java. Manipulating userID/id arguments leads to remote authorization bypass. The exploit is public.

Authorization bypass vulnerability in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8, affecting an unknown function in OrderController.java. Manipulating the userIdenf argument leads to remote authorization bypass. The exploit is public.

In the vdec module, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege without needing additional execution privileges. User interaction is not required for exploitation.

In the vdec module, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to local escalation of privilege without needing additional execution privileges. User interaction is not required for exploitation.

Vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The mysqli_query function in /admin/modal_add_room.php is vulnerable to SQL injection via the room_name argument. The attack can be performed remotely, and the exploit is publicly available.

Vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The mysqli_query function in /admin/modal_add_product.php is vulnerable to SQL injection via the fname argument. The attack can be performed remotely, and the exploit has been publicly disclosed.

Vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The mysqli_query function in /admin/modal_add_coursea.php is vulnerable to SQL injection via the course argument. The attack can be performed remotely, and the exploit has been made public.

Vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The mysqli_query function in /admin/modal_add_course2.php is vulnerable to SQL injection via the course argument. The attack can be performed remotely, and the exploit has been disclosed to the public.

Vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The mysqli_query function in /admin/modal_add_course1.php is vulnerable to SQL injection via the course argument. The attack can be performed remotely, and the exploit has been published.

Vulnerability in SourceCodester Class and Exam Timetabling System 1.0. The mysqli_query function in /admin/modal_add_course.php is vulnerable to SQL injection via the course argument. The attack can be performed remotely, and the exploit is now public.

When libpsl support is enabled, libcurl fails to enforce the Public Suffix List boundary check when processing a Set-Cookie header where the Domain attribute explicitly matches an origin host that is itself a public suffix (e.g., Domain=co.uk set by co.uk). Instead of coercing it into a strict host-only cookie, libcurl saves the cookie with wildcard domain scope (.co.uk), causing the cookie to be sent to arbitrary sibling subdomains under the same public suffix.

In libcurl with the wolfSSL backend, when CA caching is enabled and a CURLOPT_SSL_CTX_FUNCTION callback replaces the trust store, libcurl can silently reinstall the cached store after the callback returns. A certificate trusted by the cached store but rejected by the callback-selected store is then incorrectly accepted.

A Set-Cookie header using a tab (ASCII 9) instead of a space (ASCII 32) immediately before the Secure attribute causes curl to store the cookie without its Secure flag. The cookie might then wrongfully be sent over plaintext HTTP on subsequent requests to the same host.