CVE Vulnerability Catalog

A vulnerability was found in KLiK SocialMediaWebsite 1.0 in the HTTP GET Request Parameter Handler component. Manipulation leads to injection.

A Cross-Site Scripting (XSS) vulnerability was found in code-projects Employee Management System 1.0 in an unknown function of /empproject.php via the ID argument. Remote attack is possible, and the exploit is public.

A Cross-Site Scripting (XSS) vulnerability was detected in code-projects Employee Management System 1.0 in an unknown function of /changepassemp.php via the ID argument. Remote attack is possible, and the exploit is public.

A Cross-Site Scripting (XSS) vulnerability was detected in code-projects Employee Management System 1.0 in an unknown function of /myprofileup.php via the ID argument. Remote attack is possible, and the exploit is public.

A cross-site scripting vulnerability exists in Aterm. Arbitrary scripts may be executed in the web browser of a user accessing the web management interface via adjacent network.

A Cross-Site Scripting (XSS) vulnerability was detected in code-projects Employee Management System 1.0 in an unknown function of /myprofile.php via the ID argument. Remote attack is possible, and the exploit is public.

A Cross-Site Scripting (XSS) vulnerability was identified in code-projects Employee Management System 1.0 in an unknown function of /eloginwel.php via the ID argument. Remote attack is possible, and the exploit is public.

A cross-site scripting vulnerability was found in SourceCodester Indian Invoicing System 1.0 in the file /Invoicing/category.php. Manipulation of the msg argument allows remote injection of malicious scripts. The exploit is publicly available.

A vulnerability was found in SourceCodester Indian Invoicing System 1.0 in an unknown function of the Backend Endpoint component. Manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been publicly disclosed and may be used. Multiple endpoints are affected.

A SQL Injection vulnerability has been found in SourceCodester Indian Invoicing System 1.0 in the file /Invoicing/IGST_Invoice.php of the Invoice Generation Handler component. Manipulation of the customer_name/category arguments leads to SQL injection. The attack can be initiated remotely, and the exploit has been made public.

A vulnerability was found in Sushmi-pal Invoice-System up to a0a3faa16dee2621b231ae227333f5761607283b in unknown code of the /profile file in the Profile Workflow component. Manipulation of the ID argument leads to improper authorization. The attack can be launched remotely. The exploit has been publicly disclosed. The vendor did not respond.

A vulnerability was found in Sushmi-pal Invoice-System up to a0a3faa16dee2621b231ae227333f5761607283b in an unknown part of the /user file in the User Management Handler component. Manipulation of the role argument leads to improper authorization. The attack can be launched remotely. The exploit has been published. The vendor did not respond.

A command injection vulnerability has been found in Edimax BR-6675nD version 1.12 in the formWlanMP function of the /goform/formWlanMP file. The attack can be launched remotely by manipulating multiple arguments.

A command injection vulnerability has been found in Edimax BR-6675nD version 1.12 in the formUSBStorage function of the /goform/formUSBStorage file. The attack can be launched remotely by manipulating the sub_dir argument.

A command injection vulnerability has been found in Edimax BR-6675nD version 1.12 in the formWpsStart function of the /goform/formWpsStart file. The attack can be launched remotely by manipulating the pinCode argument.

A vulnerability in Edimax BR-6675nD 1.12. The formHwSet function in /goform/formHwSet of the POST Request Handler component allows command injection via regDomain/ABandregDomain/nic0Addr/nic1Addr/wlanAddr/inicAddr arguments. Remote attack, exploit public.

An improper authorization vulnerability has been found in JPress up to version 1.0.3 in the UCenter Article Submission endpoint. Manipulation of id/userId arguments can lead to unauthorized access. The attack can be performed remotely and the exploit is publicly available.

A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2 in the FileUploadUtils.upload function in the /common/upload file of the Common Upload Endpoint component. Manipulation leads to unrestricted upload. The attack can be launched remotely. The vendor did not respond.

A missing authentication vulnerability was found in the API component of Vane up to version 1.12.1, specifically in the route.ts file. The attack can be performed remotely but is considered difficult. The exploit has been publicly disclosed.

In NousResearch hermes-agent version 2026.4.23, a flaw was found in the _discover_dashboard_plugins function of the hermes_cli/web_server.py file. Manipulation of the HERMES_ENABLE_PROJECT_PLUGINS argument leads to incorrect comparison. The attack requires local access and the exploit has been published.