CVE Vulnerability Catalog

A vulnerability was found in Colorful iGameCenter 2.0.0.81. This vulnerability affects the function sub_11504 in the library WinRing0x64.sys of the component IOCTL Dispatch. Performing a manipulation of the argument PhysicalAddress/AlignNumer/AlignSize results in improper privilege management. Attacking locally is a requirement.

WaveSuite is affected by insufficient role-based access control in the CPB Log Files feature. An authenticated low-privilege user can access pages restricted to higher-privilege roles by directly requesting the URL in the browser.

A weakness has been identified in Soarkey StudentManagement and 学生信息管理系统 up to e08f7f1d5015af407aa4cca0ada3dea189b4937e. This impacts the function AdminDao.doGet of the file code/src/service/AdminDao.java of the component Administrative Servlet. Executing a manipulation of the argument action can lead to authorization bypass. It is possible to launch the attack remotely. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

A SQL injection vulnerability was found in itsourcecode Online Medicine Delivery System 1.0 in the Customer::find_phone function of /passwordrecover.php, part of the Password Recovery Interface. Manipulation of the phonenumber argument leads to SQL injection. Remote exploitation is possible, and the exploit has been disclosed.

A SQL injection vulnerability was found in itsourcecode Online Medicine Delivery System 1.0 in the loadResultList function of /index.php?q=product, part of the Product Category Filter Interface. Manipulation of the Category argument leads to SQL injection. The attack may be launched remotely, and the exploit has been published.

An incorrect authorization vulnerability in ash-project ash_phoenix invokes the SubdomainHook authorization callback with a nil tenant, so tenant-scoped access checks never see the tenant they are meant to enforce. This affects ash_phoenix from 2.1.26 before 2.3.25.

A SQL injection vulnerability was found in itsourcecode Online Medicine Delivery System 1.0 in the loadResultList function of /index.php?q=product, part of the Product Search Interface. Manipulation of the Search argument leads to SQL injection. The attack may be initiated remotely, and the exploit is now public.

A SQL injection vulnerability was found in itsourcecode Online Medicine Delivery System 1.0 in the loadResultList function of /index.php?q=single-item, part of the Product Detail Page. Manipulation of the ID argument leads to SQL injection. The attack can be launched remotely, and the exploit has been disclosed publicly.

A SQL injection vulnerability was found in itsourcecode Online Medicine Delivery System 1.0 in the Customer::cusAuthentication function of /login.php, part of the Customer Login Interface. Manipulation of the U_USERNAME argument causes SQL injection. The attack can be initiated remotely, and the exploit has been made public.

A SQL injection vulnerability was found in itsourcecode Online Medicine Delivery System 1.0 in the Employee::employeeAuthentication function of /rider/login.php, part of the Login Interface. Manipulation of the emp_email argument results in SQL injection. The attack can be launched remotely, and the exploit has been released publicly.

A vulnerability in ash_admin allows any client that can reach the admin LiveView to exhaust the BEAM atom table and crash the entire node. Two LiveView event handlers intern atoms from unvalidated client input, and atoms are never garbage collected, leading to a crash.

A Path Traversal vulnerability in ash_admin allows writing attacker-controlled bytes to arbitrary paths on the server. The browser-supplied filename is not sanitized, allowing writes outside the temporary directory.

A vulnerability in Kamailio up to 5.5.0/6.0.7 in the get_4bytes function of the cxdx_avp.c file in the AVP Handler component leads to an out-of-bounds read. The attack can be performed remotely, and the exploit is publicly disclosed.

A vulnerability in the Profile Builder plugin up to 3.16.1 on WordPress in the wppb_ajax_simple_avatar function of /wp-admin/admin-ajax.php allows unrestricted file upload. The attack can be performed remotely, and the exploit is public.

A Stored Cross-site Scripting vulnerability in ash_admin executes attacker-supplied record content as script in an administrator's browser. The RelationshipField and ManagedRelationshipSelectField components render labels without proper escaping.

A vulnerability in ash_admin relying on cookies without validation and integrity checking allows an attacker controlling a sibling subdomain to rebind an admin's session to a different actor, tenant, or authorization mode. Cookies are matched using an unanchored regular expression.

A vulnerability in SeaCMS up to 13.6 in the file /zyapi.php?ac=videolist allows SQL injection through the ids argument. The attack can be initiated remotely, and the exploit is public.

An authorization bypass through user-controlled key vulnerability in ash_ai allows a caller to update or destroy records it never identified, including every row in the table. The identity filter is built directly from raw tool arguments.

A vulnerability in ash_ai discloses provider request state and credentials in a user-facing validation error. When the embedding provider call fails, the error contains the raw error term, which may include the URL, response body, and Authorization header with the API key.

A vulnerability in SeaCMS up to 13.6 in the parseIf function of the search.php file in the Template Engine component allows code injection through the searchtype argument. The attack can be initiated remotely, and the exploit is public.