CVE Vulnerability Catalog

SIM-PKH 2.4.1 contains an SQL injection vulnerability in the 'id' parameter of /admin/media.php. Authenticated attackers can send GET requests with module=pengurus and act=editpengurus parameters containing SQL UNION statements to extract database information including usernames and database versions.

SIM-PKH 2.4.1 contains an arbitrary file upload vulnerability that allows authenticated attackers to upload malicious files by submitting PHP code through the fupload parameter. Attackers can upload PHP files via the aksi_pengurus.php endpoint with module=pengurus and act=update parameters, which are stored in the foto directory and executed as web scripts.

Open ISES Project 3.30A has a path traversal vulnerability in the ajax/download.php endpoint. An unauthenticated attacker can download arbitrary files by manipulating the filename parameter with ../ sequences.

eNdonesia Portal 8.7 contains multiple SQL injection vulnerabilities that allow unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through parameters in mod.php. Attackers can inject SQL through the artid, cid, did, contid, and aboutid parameters across publisher, diskusi, galeri, content, and about modules to extract database information including usernames, database names, and version details.

eNdonesia Portal 8.7 contains multiple SQL injection vulnerabilities in the artid, cid, did, contid, and aboutid parameters in mod.php. Unauthenticated attackers can send crafted requests to execute arbitrary SQL queries and extract database credentials, usernames, and version information.

eNdonesia Portal 8.7 contains multiple SQL injection vulnerabilities in the artid, cid, did, contid, and aboutid parameters in mod.php. Unauthenticated attackers can send crafted requests to execute arbitrary SQL queries and extract sensitive data such as usernames, database names, and version details.

A vulnerability was found in TRENDnet TEW-432BRP 3.10B20 in the formSetFirewallRule function. Manipulating the firewall_name argument causes a stack-based buffer overflow. The attack is remotely exploitable and the exploit is public. The vendor states the product is EOL since 2009 and will not be fixed.

A stack-based buffer overflow vulnerability was found in the TRENDnet TEW-432BRP router version 3.10B20 in the formSetMACFilter function of the /goform/formSetMACFilter file. Remote attack is possible by manipulating the filter_name argument. The vendor states the product has been EOL for 15 years and will not be fixed.

A use-after-free (UAF) vulnerability was found in the Linux kernel's eventpoll (epoll) mechanism. The bug occurs in ep_remove() which, after clearing the file->f_ep pointer, may still use the file structure while a concurrent __fput() can free it, leading to writes into freed memory. An attacker can exploit this to trigger a controlled kmem_cache_free() on the wrong slab cache.

The GEO my WP plugin for WordPress up to version 4.5.5 contains an SQL injection vulnerability via the 'swlatlng' and 'nelatlng' parameters, allowing unauthenticated attackers to append additional SQL queries and extract sensitive data. Exploitation requires a public page with the location search results shortcode.

A vulnerability in the Spectra Gutenberg Blocks plugin for WordPress up to version 2.19.25 allows authenticated attackers with Contributor-level access and above to execute remote code on the server via a two-block payload in post content.

Account takeover vulnerability in the Simple History plugin for WordPress. An authenticated user (Subscriber+) can read full event context, including password reset keys, via event reaction endpoints.

In sambitraj STUDENT-MANAGEMENT-SYSTEM 1.0, an SQL injection vulnerability was found in the Login Page component. Manipulating the email argument leads to SQL injection. The attack can be performed remotely, and an exploit has been published. The project was informed early but has not responded.

The Student Details Management System 1.0 by code-projects is vulnerable to SQL injection in the /index.php file via manipulation of the roll argument. The attack can be launched remotely, and the exploit is publicly available.

Spatie Laravel Media Library before version 11.23.0 has a file upload restriction bypass in FileAdder::defaultSanitizer(). The sanitizer checks only the final filename suffix, allowing double-extension filenames such as shell.php.jpg to bypass the blocklist, with pathinfo() preserving inner .php stems in saved filenames. The blocklist also omits executable extensions including .php6, .shtml, and .htaccess. The double-extension bypass requires a legacy Apache AddHandler configuration to achieve PHP execution; the incomplete blocklist bypass does not.

Spatie Laravel Media Library before version 11.23.0 contains a server-side request forgery (SSRF) vulnerability. A remote attacker can force the server to issue arbitrary outbound HTTP requests by passing user-controlled URLs to the addMediaFromUrl() method in InteractsWithMedia.php.

The Formie plugin for Craft CMS before versions 2.2.21 and 3.1.26 allowed unauthenticated users to modify existing submissions by posting a known or guessed submission ID to the formie/submissions/save-submission endpoint.

FreeScout prior to 1.8.220 has a vulnerability in the email processing pipeline where thread and user IDs are extracted from Message-ID without HMAC verification. An attacker can spoof an agent's address and inject messages treated as agent replies, which are automatically forwarded to customers.

The TIFF decoder does not limit the size of PackBits-compressed data. A maliciously crafted image can cause the decoder to decompress large amounts of data, even though the image is small in dimensions and encoded size.

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.44.0, when the server has called Server::set_trusted_proxies() with a non-empty trusted-proxy list, an attacker can send an HTTP request that includes an X-Forwarded-For header whose value parses to no valid IP segments. The code path then executes get_client_ip(), which calls front() on an empty std::vector—undefined behavior in C++. On typical implementations this manifests as abnormal process termination (denial of service).