CVE Vulnerability Catalog

The LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname. Despite certificate chain validation, the absence of endpoint identification allows a valid certificate issued for an entirely unrelated host to be improperly accepted. An attacker with MITM capability on the network can impersonate the LDAP server.

A SQL injection vulnerability was found in raisulislamg4 student_management_system_by_php (up to version 310d950e09013d5133c6b9210aff9444382d16d1) in the file add_user_check.php of the User Creation Handler component. Manipulating the role argument can lead to unauthorized database access. The attack can be performed remotely and the exploit is publicly available. The project has not responded to the issue report.

A SQL injection vulnerability was found in raisulislamg4 student_management_system_by_php (up to version 310d950e09013d5133c6b9210aff9444382d16d1) in the file delete.php. Manipulating the user_id/course_id/teacher_id/student_id/application_id arguments can lead to unauthorized database access. The attack can be performed remotely and the exploit is publicly available. The project has not responded to the issue report.

A SQL injection vulnerability was found in raisulislamg4 student_management_system_by_php (up to version 310d950e09013d5133c6b9210aff9444382d16d1) in the file login_check.php of the Login component. Manipulating the Username argument can lead to unauthorized database access. The attack can be performed remotely and the exploit is publicly available. The project has not responded to the issue report.

An improper neutralization of user-controllable input in OTRS and ((OTRS)) Community Edition ticket handling allows authenticated attackers to perform reflected XSS attacks via crafted request parameters. Malicious JavaScript can be executed in the context of an authenticated agent session when the crafted link is opened.

In geniezone, a missing bounds check allows out-of-bounds write, potentially leading to local privilege escalation if the attacker already has System privilege. User interaction is not required.

In the WLAN AP driver, there is a possible memory corruption due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code execution with User execution privileges needed. User interaction is not needed for exploitation.

In NousResearch hermes-agent up to version 0.12.0, an injection vulnerability exists in the _compress_context function of run_agent.py. The attack can be performed remotely and the exploit is publicly available.

In NousResearch hermes-agent up to version 2026.4.30, an injection vulnerability exists in the _serve_plugin_skill/skill_view function of tools/skills_tool.py. The attack can be performed remotely and the exploit is publicly available.

A vulnerability in GoClaw up to version 3.11.3, in the FsBridge.WriteFile function of internal/sandbox/fsbridge.go, allows remote OS command injection via the write_file tool.

A vulnerability in chatgpt-on-wechat up to version 2.0.8, in the _get_safety_warning function of agent/tools/bash/bash.py, allows remote OS command injection via the Bash tool.

A SQL injection vulnerability was found in code-projects Online Hospital Management System 1.php in the file login_1.php in the login_user function. Manipulating the Username argument can lead to unauthorized database access. The attack can be performed remotely and the exploit is publicly available.

In D-Link DI-8400 up to version 16.07.26A1, a stack-based buffer overflow exists in /dbsrv.asp when manipulating the str argument. Remote exploitation is possible. The exploit is public. The researcher noted conflicting parameter names.

Sereal::Decoder versions before 5.005 for Perl allow heap out-of-bounds read via crafted input. Functions srl_read_object() and srl_read_hash() mishandle the COPY tag, allowing an attacker to read up to 31 bytes from the heap as a class name or hash key.

In Tenda W12 version 3.0.0.7(4763), a stack-based buffer overflow exists in the set_local_time_0 function in /bin/httpd when manipulating the Time argument. Remote exploitation is possible. The exploit is public.

In Tenda W12 version 3.0.0.7(4763), a vulnerability exists in the cgiWifiMacFilterSet function of the /bin/httpd file. Manipulation of the wifiMacFilterSet.macList.mac argument leads to a stack-based buffer overflow, which can be exploited remotely. The exploit has been publicly disclosed.

A stack-based buffer overflow vulnerability was found in the cgiSysTimeInfoSet function in /bin/httpd of Tenda W12 router version 3.0.0.7(4763). Remote attack is possible by manipulating the sec argument. The exploit has been publicly disclosed.

In Tenda W12 version 3.0.0.7(4763), a vulnerability exists in the cgistaKickOff function of the /bin/httpd file. Manipulation of the staMac argument leads to a stack-based buffer overflow, which can be exploited remotely. The exploit has been publicly disclosed.

An SQL injection vulnerability was found in code-projects Online Hospital Management System 1.0 in the file /patient.php via the editid argument. The attack can be executed remotely and the exploit is publicly available.

An SQL injection vulnerability was found in SourceCodester Hospitals Patient Records Management System 1.0 in the file /classes/Users.php?f=save via the ID argument. The attack can be executed remotely and the exploit is publicly available.