CVE Vulnerability Catalog

In SourceCodester Barangay Resident Profiling and Information Management System 1.0, a vulnerability involving a hard-coded password was found. An attacker can remotely manipulate the new_password argument in passsword_reset.php, leading to use of a default password. The exploit is publicly available.

SQL injection vulnerability in /addpatient.php of itsourcecode Hospital Management System 1.0 via the admissiontme argument allows remote SQL injection.

SQL injection vulnerability in /adminaccount.php of itsourcecode Hospital Management System 1.0 via the Date argument allows remote SQL injection.

In Hospital Management System 1.0 by itsourcecode, an XSS vulnerability exists in /billing.php via manipulation of the patientid argument. The attack can be performed remotely, and exploit is publicly available.

The Recipe Card Blocks Lite plugin for WordPress up to version 3.4.13 is vulnerable to Stored Cross-Site Scripting via the 'summary' and 'notes' attributes of the recipe block. The WPZOOM_Helpers::deserialize_block_attributes method converts unicode sequences back to HTML characters after sanitization, allowing authenticated attackers with Author-level access or higher to inject arbitrary scripts.

In Quay, the filedrop endpoint accepts any mime type without validation, allowing an authenticated user with repository write access to upload a malicious SVG file containing JavaScript. The file is stored and served inline via CDN, enabling stored XSS.

SQL injection vulnerability in /admin/add_leave.php of CodeAstro Leave Management System 1.0 via the type_of_leave argument allows remote SQL injection.

CodeAstro Leave Management System 1.0 has a SQL Injection vulnerability in the file /admin/search_staff_for_updation.php via manipulation of the Name argument. The attack can be performed remotely.

SQL injection vulnerability in /admin/search_staff_to_assign_pc.php of CodeAstro Leave Management System 1.0 via the Name argument allows remote SQL injection.

SQL injection vulnerability in /admin/delete_leave_type.php of CodeAstro Leave Management System 1.0 via the leave_type argument allows remote SQL injection.

SQL injection vulnerability in /admin/search_staff_for_deletion.php of CodeAstro Leave Management System 1.0 via the Name argument allows remote SQL injection.

Use of a hard-coded cryptographic key in the glnassys component of GL.iNet routers (multiple models) with firmware 4.8.x allows remote attacks, though exploitation is difficult.

In Weaviate up to version 1.37.7, a vulnerability was found in the validateConfig function in usecases/auth/authentication/apikey/client.go. Manipulation of the StaticApiKey argument leads to authorization bypass. The attack is remote but difficult. The exploit is publicly available. A fix is available in version 1.38.0-rc.0.

In D-Link DCS-5615 version 1.01.00, a least privilege violation exists in the file /etc/conf.d/boa/boa.conf of the Boa Webserver component. The attack can be performed remotely.

SQL injection vulnerability in /Ingredients-Stock/add_stock.php of CodeAstro Ingredients Stock Management System 1.0 via the ID argument allows remote SQL injection.

A vulnerability was found in TOTOLINK AC1200 T8 firmware version 4.1.5cu.8611 in the vsftpd component. Manipulation of the /etc/vsftpd.conf file leads to a least privilege violation. The attack can be initiated remotely, and the exploit is publicly available.

A weakness was identified in Tenda AC15 firmware version 15.03.05.19 in the Samba component. Manipulation of the /etc_ro/smb.conf file leads to weak password requirements. The attack is only possible within the local network, has high complexity, and is difficult to exploit, but the exploit is publicly available.

A flaw in D-Link DIR-823G 1.0.2B05 in the vsftpd component allows remote violation of the least privilege principle.

In Neovim up to version 0.12.2, the M.read function in runtime/lua/vim/secure.lua of the View Branch component is vulnerable to command injection via manipulation of the path argument. The attack can be launched locally and an exploit has been published.

In BeikeShop up to version 1.6.0.22, an SQL injection vulnerability was found in the file beike/Admin/Routes/admin.php within the Admin Design Builder Endpoint. Manipulating the settings.value argument allows remote attack. The exploit is publicly available.