CVE Vulnerability Catalog

A SQL injection vulnerability has been found in CodeAstro Ecommerce Website 1.0 in the file /ecommerce-website-php/customer/my_account.php?edit_account. The attack involves manipulating the c_name argument, allowing remote SQL injection. The exploit has been publicly disclosed.

A SQL injection vulnerability has been found in itsourcecode Hospital Management System 1.0 in the /patient.php file. An attacker can remotely manipulate the editid argument, leading to unauthorized database access. The exploit has been published and may be used.

A path traversal vulnerability has been identified in the Vendor Image Manager component of Ecommerce-CodeIgniter-Bootstrap. The do_upload_others_images function in AddProduct.php allows manipulation of the folder argument, enabling remote file access outside the intended directory.

A vulnerability was found in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to version 213babdbaa949e94557246414db0130e01394517. The checkForPostRequests function in application/core/MY_Controller.php is affected by cross-site scripting via the User-Agent argument, allowing remote attacks.

A cross-site scripting vulnerability was found in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to commit 49b20f53. The hidden REST API endpoint at /index.php/api/product/set allows remote XSS via the title/description parameters.

A vulnerability was found in Ecommerce-CodeIgniter-Bootstrap up to commit 95dfa8cebbb87ab46ae450643a07241274a74dce. The setReferrer function in application/core/MY_Controller.php is affected, and manipulation of the href argument leads to an open redirect that can be exploited remotely.

A flaw in RT-Thread up to version 5.2.2 affects the read/write/sys_ioctl functions in components/lwp/lwp_syscall.c. Parameter manipulation can cause a divide-by-zero error, allowing remote attacks. The exploit is published and may be used.

A path traversal vulnerability was found in the Live Webhook Endpoint component of NousResearch hermes-agent up to version 2026.5.16. The extract_media function in gateway/platforms/base.py allows path manipulation, enabling remote attacks.

A security vulnerability was found in NousResearch hermes-agent up to version 0.15.2. The issue affects the DiscordAdapter._is_allowed_user function in the gateway/platforms/discord.py file, leading to improper authentication. The attack can be launched remotely but is difficult to exploit.

A weakness has been identified in NousResearch hermes-agent up to version 2026.4.30 in the function AIAgent.run_conversation of the file run_agent.py of the HTTP API component. Manipulation of the argument todos causes denial of service. The attack can be initiated remotely, and the exploit is publicly available.

A security vulnerability has been found in NousResearch hermes-agent up to version 0.15.2 in the shell.exec function of tui_gateway/server.py. It allows remote bypass of protection mechanisms. The exploit is public and the vendor did not respond.

A vulnerability was found in omec-project amf up to version 2.0.2/2.1.1 in the NGSetupRequest handler function within handler.go. Manipulation of this function allows a remote denial of service (DoS) attack.

A vulnerability was found in omec-project amf up to version 2.1.1 in the RRCInactiveTransitionReport function of the NGAP Message Handler. Remote manipulation can lead to denial of service (DoS). The exploit has been publicly disclosed and may be used.

A SQL injection vulnerability has been found in itsourcecode Hospital Management System 1.0 in the /medicine.php file. An attacker can remotely manipulate the editid argument, leading to unauthorized database access. The exploit has been published and may be used.

A denial of service vulnerability was found in the AMF component of Open5GS up to version 2.7.7. The function amf_nnrf_handle_nf_discover in src/amf/nnrf-handler.c can be exploited remotely to cause a crash. The exploit is publicly available.

An improper access control vulnerability in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over a network.

Insufficient UI warning of dangerous operations in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

A Cross-Site Scripting (XSS) vulnerability in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. The flaw is due to improper neutralization of input during web page generation.

A Relative Path Traversal vulnerability in Microsoft Edge for Android allows an unauthorized attacker to disclose information locally.

SSRF (Server-Side Request Forgery) vulnerability occurs during repository migration when the application follows HTTP redirects. An attacker can exploit this flaw to send requests to internal network resources.