CVE Vulnerability Catalog

Improper validation in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment and have the sponsor pay for provisioning an access key on the client's own account. Missing check of the key_authorization field in the 0x76 envelope allows attaching a signed key, increasing cost from about 46,587 to about 1,808,700 gas.

Improper validation in ZenHive mpp allows an unauthenticated remote client to inflate the fee-payer's gas cost per sponsored payment and have the sponsor pay for EIP-7702 account delegations of the client's choosing. Missing read of the aa_authorization_list field in the 0x76 envelope allows attaching delegations, increasing cost from about 46,575 to about 1,884,087 gas.

PostgreSQL Anonymizer contains a vulnerability allowing unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries carrying untrusted expressions. When evaluated in the masking context, malicious code can run with elevated privileges. Fixed in version 3.1.4 and later.

MISP's UiBeta collection view performs a secondary query of member events by UUID without applying the caller's ACL. An authenticated user with view access to a collection can retrieve full details of events they are not permitted to read, including identifiers, info, dates, timestamps, creator org, tags, and galaxy clusters.

OpenMAIC before 1.0.1 skips SSRF validation in non-production builds, allowing unauthenticated attackers to reach cloud instance metadata services. Attackers can supply arbitrary provider URLs via x-base-url header or baseUrl parameter to access sensitive cloud credentials and metadata.

A vulnerability was found in Mstfakts College-Management-System in Front-end/login.php. Manipulation of the email argument causes improper authentication. The attack can be performed remotely. The exploit has been publicly disclosed and may be utilized. The project has not responded.

A SQL injection vulnerability was found in Mstfakts College-Management-System in the mysqli_query function of Front-end/university.php (Search Handler). Manipulation of book_name/book_author arguments results in SQL injection. The attack can be performed remotely. The exploit has been made public. The project has not responded.

h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie(). Attackers can send a crafted cookie header with an extremely large chunk count to trigger an O(n²) cleanup loop that hangs the server process.

Bifrost HTTP transport before 2.0.0 accepts an enabled custom plugin whose path is an HTTP URL through unauthenticated POST /api/plugins when management authentication is disabled. The shared-object loader treats an http-prefixed path as a download URL, writes the body to a temporary .so, and passes it to plugin.Open. On dynamically linked builds this is unauthenticated remote code execution; on the static Docker image it is only SSRF.

PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login or skin packets with invalid geometry JSON to trigger an unhandled RuntimeException, causing server crash.

A SQL injection vulnerability was found in rabindralamsal inventory-management-system 1.0.0 in the file index.php of the Login component. Manipulating the username/password arguments allows remote attack execution. The exploit has been published and may be used.

A SQL injection vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the file /delete_user_account.php. Manipulating the ID argument allows remote attack execution. The exploit has been publicly disclosed and may be used.

A SQL injection vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the file /delete_user.php. Manipulating the ID argument causes SQL injection. The attack can be initiated remotely. The exploit has been made public and could be used.

A SQL injection vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the file /delete_teacher.php. Manipulating the ID argument results in SQL injection. The attack can be launched remotely. The exploit has been released and may be used.

A SQL injection vulnerability was found in code-projects Task Management System In PHP 1.0 in the file /index.php of the Login component. Manipulating the email argument leads to SQL injection. The attack can be initiated remotely. The exploit has been publicly disclosed and may be used.

The Kirki WordPress plugin before 6.3.0 does not properly handle all HTML entities when rendering, allowing unauthenticated users to store JavaScript in a comment that executes in the session of anyone viewing the page, including an administrator, and on every page when the header or footer is built to show comments.

The SureCart WordPress plugin before 4.6.3 does not ensure that the account affected by a customer update is the same account its permission check authorised, allowing users with a subscriber-level account to change another user's email address, including an administrator's, and take over that account via a password reset. It further allows an attacker-controlled customer record to be associated with an arbitrary user, and discloses customer identifiers and email addresses to any authenticated user, which together make the takeover reachable from a subscriber-level account alone.

A security flaw has been discovered in code-projects Content Management System 1.0. The affected element is an unknown function of the /login.php file. Manipulation of the user_name argument results in SQL injection. The attack can be executed remotely, and the exploit has been released to the public.

A vulnerability was determined in Tenda HG10 (version 300001138) in the formWanRedirect function of the /boaform/formWanRedirect file in the Boa Web Server component. Executing a manipulation of the 'if' argument can lead to a buffer overflow. The attack may be launched remotely, and the exploit has been publicly disclosed.

A SQL injection vulnerability was found in SourceCodester Online Voting System 1.0 in the file /ajax.php?action=login. Manipulating the Username argument allows remote SQL injection. The exploit has been publicly disclosed and may be used.