CVE Vulnerability Catalog

A SQL injection vulnerability was found in Hospital Management System 1.0 in the /patientlogin.php file. An attacker can remotely manipulate the loginid argument, leading to SQL injection. The exploit is publicly available.

A security vulnerability has been detected in GoClaw up to version 3.13.0-beta.2, affecting the MethodRouter.Handle function in the internal/gateway/router.go file of the WebSocket RPC Handler component. The flaw leads to incorrect authorization, potentially allowing unauthorized access.

A missing authentication vulnerability was found in the wx Endpoint component of zhayujie chatgpt-on-wechat CowAgent 2.1.0, specifically in the verify_server function of channel/wechatmp/common.py. The attack can be initiated remotely by manipulating the wechatmp_token argument, and the exploit is publicly available.

A SQL injection vulnerability was found in the Online Examination 1.0 system in the quiz creation feature. An attacker can remotely manipulate the name/total/right/wrong/time/tag/desc arguments in /update.php?q=addquiz, leading to SQL injection. The exploit is publicly available.

A vulnerability was found in bluebox up to version 4.5.12, allowing Cross-Site Scripting (XSS) via manipulation of the 'code' argument. The attack can be performed remotely and the exploit has been made public.

A SQL injection vulnerability has been found in itsourcecode Hospital Management System 1.0 in the file /patientorder.php. An unknown function allows manipulation of the editid argument, enabling remote SQL injection. The exploit has been publicly disclosed.

A SQL injection vulnerability was found in the Internship Management System 1.0 in the file employer/details/change_password.php. An attacker can remotely manipulate the Current argument, leading to SQL injection. The exploit is publicly available.

A security flaw has been discovered in SourceCodester Syllabus-Aligned Learning Management and Examination System 1.0. An unknown function in upload_files.php allows unrestricted file upload, which can be exploited remotely. The exploit has been publicly released and may be used in attacks.

A SQL injection vulnerability was found in the cancel_order function of classes/Master.php in SourceCodester Multi-Vendor Online Grocery Management System 1.0. An attacker can remotely manipulate the ID argument, leading to SQL injection.

A vulnerability has been found in SourceCodester Multi-Vendor Online Grocery Management System 1.0 in the cancel_order function of classes/Master.php. Manipulation of this function can lead to improper authorization. The attack can be performed remotely and the exploit has been published.

A SQL injection vulnerability was found in SourceCodester Multi-Vendor Online Grocery Management System 1.0/5.7.26. The issue affects the save_shop_type function in classes/Master.php, which improperly handles POST parameters. The attack can be performed remotely, and the exploit is publicly available.

A security vulnerability has been detected in SourceCodester Multi-Vendor Online Grocery Management System 1.0, involving code injection in the update_settings_info function of classes/SystemSettings.php. The attack can be executed remotely, and the exploit has been publicly disclosed.

A SQL injection vulnerability has been discovered in CodeAstro Apartment Visitor Management System 1.0 in the file /apartment-visitor/add-apartment.php. An attacker can remotely manipulate the apartmentno argument, leading to SQL injection. The exploit has been publicly released.

A vulnerability was found in the InsightEngine component of BettaFish up to version 1.2.1 in the _deduplicate_results function of InsightEngine/agent.py. Input manipulation can lead to partial string comparison, allowing remote attacks. The exploit has been publicly disclosed and may be used.

A SQL injection vulnerability has been found in itsourcecode Hospital Management System 1.0 in the file /patientappointment.php. An attacker can remotely manipulate the 'patiente' argument, leading to SQL injection. The exploit has been publicly disclosed.

A SQL injection vulnerability was found in Assessment Management 1.0 in the file /lecturer/marking-scheme.php. An attacker can remotely manipulate the smarksrange[] argument, leading to SQL injection. The exploit is publicly available.

A SQL injection vulnerability has been found in code-projects Assessment Management 1.0 in the file /lecturer/marking-scheme.php. An attacker can remotely manipulate the squestions[] argument, leading to unauthorized database access. The exploit has been published and may be used.

A cross-site scripting vulnerability has been found in Assessment Management 1.0 in the /admin/remove-user.php file. Manipulation of the ID argument allows remote script injection. The exploit is publicly available and may be used.

The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation when a federated user shares a username with a local user. This allows the provisioning process to overwrite existing roles of local users with roles assigned to the federated user.

A vulnerability has been identified in the onnxruntime component of the onnx library up to version 1.21.x, involving an out-of-bounds read in the convPoolShapeInference_opset19 function in onnx/defs/nn/old.cc. The attack can be initiated remotely, and the exploit has been made public.