CVE Vulnerability Catalog

A vulnerability was found in Mstfakts College-Management-System in Front-end/login.php. Manipulation of the email argument causes improper authentication. The attack can be performed remotely. The exploit has been publicly disclosed and may be utilized. The project has not responded.

A SQL injection vulnerability was found in Mstfakts College-Management-System in the mysqli_query function of Front-end/university.php (Search Handler). Manipulation of book_name/book_author arguments results in SQL injection. The attack can be performed remotely. The exploit has been made public. The project has not responded.

h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie(). Attackers can send a crafted cookie header with an extremely large chunk count to trigger an O(n²) cleanup loop that hangs the server process.

Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled. The shared-object loader treats an http-prefixed path as a download URL, writes the body to a temporary .so, and passes it to plugin.Open. On dynamically linked builds this is unauthenticated remote code execution; on the static Docker image it is only SSRF.

PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login or skin packets with invalid geometry JSON to trigger an unhandled RuntimeException, causing server crash.

A SQL injection vulnerability was found in rabindralamsal inventory-management-system 1.0.0 in the file index.php of the Login component. Manipulating the username/password arguments allows remote attack execution. The exploit has been published and may be used.

A SQL injection vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the file /delete_user_account.php. Manipulating the ID argument allows remote attack execution. The exploit has been publicly disclosed and may be used.

A SQL injection vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the file /delete_user.php. Manipulating the ID argument causes SQL injection. The attack can be initiated remotely. The exploit has been made public and could be used.

A SQL injection vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the file /delete_teacher.php. Manipulating the ID argument results in SQL injection. The attack can be launched remotely. The exploit has been released and may be used.

A SQL injection vulnerability was found in code-projects Task Management System In PHP 1.0 in the file /index.php of the Login component. Manipulating the email argument leads to SQL injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be used.

The Kirki WordPress plugin before 6.3.0 does not properly handle all HTML entities when rendering, allowing unauthenticated users to store JavaScript in a comment that executes in the session of anyone viewing the page, including an administrator, and on every page when the header or footer is built to show comments.

The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that account via a password reset. It further allows an attacker-controlled customer record to be associated with an arbitrary user, and discloses customer identifiers and email addresses to any authenticated user, which together make the takeover reachable from a subscriber-level account alone.

A security flaw has been discovered in code-projects Content Management System 1.0. The affected element is an unknown function of the /login.php file. Manipulation of the user_name argument results in SQL injection. The attack can be executed remotely, and the exploit has been released to the public.

A vulnerability was determined in Tenda HG10 (version 300001138) in the formWanRedirect function of the /boaform/formWanRedirect file in the Boa Web Server component. Executing a manipulation of the 'if' argument can lead to a buffer overflow. The attack may be launched remotely, and the exploit has been publicly disclosed.

A SQL injection vulnerability was found in SourceCodester Online Voting System 1.0 in the file /ajax.php?action=login. Manipulating the Username argument allows remote SQL injection. The exploit has been publicly disclosed and may be used.

A SQL injection vulnerability was found in SourceCodester Online Voting System 1.0 in the file /ajax.php?action=delete_category. Manipulating the ID argument leads to SQL injection. The attack can be performed remotely, and the exploit is publicly available.

A SQL injection vulnerability was found in SourceCodester Online Voting System 1.0 in the file /ajax.php?action=delete_voting. Manipulating the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit has been publicly disclosed.

A SQL injection vulnerability was found in SourceCodester Online Voting System 1.0 in the file /ajax.php?action=save_user. Manipulating the ID argument causes SQL injection. The attack can be initiated remotely, and the exploit has been published.

The HivePress Authentication plugin for WordPress up to version 1.1.4 is vulnerable to authentication bypass via the access_token parameter. The authenticate_user function trusts responses from Facebook Graph API without verifying the application ID, allowing unauthenticated attackers to log in as any WordPress user, including administrators, if they have the victim's access token.

RouterOS WebFig contains an unauthenticated file-read vulnerability in the /jsproxy path where a newly allocated session retains a stale uninitialized principal pointer used for file authorization. An unauthenticated attacker can prepare the allocator so that the file-serving path dereferences this pointer with sufficient rights, then supply parent-directory components in an encrypted URI to escape the WebFig file namespace and disclose root-owned files, including configuration stores containing credentials. This issue affects only the 7.x branch and was fixed in versions 7.23.4 (Long-term) and 7.24.2 (Stable).