CVE Vulnerability Catalog

A weakness has been identified in kishan0725 Hospital Management System up to 777fda46b77a820977a5ba616283dbfbc40bf7e1. This affects the mysqli_query function of the admin-panel.php file of the Appointment Cancellation Handler component. Manipulation of the ID argument leads to SQL injection. The attack may be launched remotely, and the exploit has been made available to the public.

snac2 before 2.93 contains a heap-based buffer overflow vulnerability in _xs_json_load_lexer() that allows unauthenticated remote attackers to corrupt heap memory by sending JSON strings containing a \u0000 escape. A single crafted application/activity+json POST to activitypub_post_handler() is parsed before signature checks, overflowing heap allocations and crashing the server.

cgltf through 1.15 contains a heap out-of-bounds write vulnerability in cgltf_accessor_unpack_floats() that allows attackers to write outside the output buffer via unchecked sparse accessor indices. Supplying a crafted glTF or GLB file with large sparse indices can corrupt heap memory, crash applications, and potentially execute code when cgltf_validate() is not called.

Omnigent 0.3.0 before 0.14.0 contains a path traversal vulnerability that allows authenticated users to escape the workspace by setting os_env.cwd on nested sub-agents. Attackers can upload a bundle whose sub-agent uses an absolute or parent-traversing working directory, bypassing root-only validation in bundles.py, to read and write host files as the runner user.

WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write arbitrary host files by running DuckDB filesystem functions through the query editor. Attackers can log in to a DuckDB file without credentials and use read_text, read_blob, COPY ... TO or ATTACH to steal session.key and stored database credentials or overwrite files.

ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token holders to change the token owner's credentials via PATCH /api/v1/users/{user}. Attackers with a token limited to manage_users and edit_users can set a new owner password, clear two-factor authentication, and sign in interactively with the owner's full role permissions.

Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated user to call Subscribe, Ack, and unregistered methods without permission checks. Attackers can supply another tenant's subscription ID to Subscribe to hijack it, read and acknowledge its events, starve the legitimate consumer, and enumerate cluster users via ListUser.

Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers to publish events to any eventbus through the gateway CloudEvents HTTP receiver. Attackers can send forged CloudEvents to the /namespaces/{ns}/eventbus/{name}/events or legacy /gateway/{name} paths, bypassing token authentication and authPublish checks, so they are stored and delivered to subscription sinks.

The PowerPack Lite for Beaver Builder plugin (up to version 1.3.1) is vulnerable to stored XSS due to improper neutralization of input during web page generation. An attacker can inject a malicious script that gets stored and executed.

The Support Genix plugin (up to version 1.4.54) is vulnerable to SQL injection due to improper neutralization of special elements in SQL commands. An attacker can execute arbitrary SQL queries.

The Electronic Signature Add-on for Fluent Forms plugin (up to version 2.0.5) has an authorization bypass through user-controlled key vulnerability. This allows exploiting incorrectly configured access control security levels.

The Simply Schedule Appointments plugin (up to version 1.6.12.35) is vulnerable to stored XSS due to improper neutralization of input during web page generation. An attacker can inject a malicious script that gets stored and executed.

The Login with phone number plugin (up to version 1.8.77) has an incorrect privilege assignment vulnerability that allows privilege escalation. An attacker can exploit this to gain higher privileges.

The Booktics plugin (up to version 1.0.29) is vulnerable to DOM-Based XSS due to improper neutralization of input during web page generation. An attacker can inject a malicious script that gets executed in the victim's browser.

The eStore plugin for WordPress (up to version 1.6.13) is vulnerable to Reflected Cross-site Scripting due to improper neutralization of input during web page generation. An attacker can inject malicious JavaScript that executes in the victim's browser.

The Strong Testimonials plugin for WordPress (up to version 3.3.12) is vulnerable to deserialization of untrusted data, allowing Object Injection. An attacker can supply malicious data that gets deserialized by the application.

The Modern Events Calendar Lite and Modern Event Calendar Pro WordPress plugins before 7.37.0 do not sanitise and escape a parameter before using it in a SQL statement. This allows authenticated users with minimal privileges (Subscriber and above) to perform SQL injection attacks.

The WP Photo Album Plus WordPress plugin before 9.2.11.002 does not properly escape a category navigation value before reflecting it into a JavaScript event handler on its gallery breadcrumb links. This allows unauthenticated attackers to inject arbitrary script that executes in the browser of anyone who follows a crafted gallery link and clicks the breadcrumb, including a logged-in administrator.

The Salon Booking System WordPress plugin before 10.31.11 does not prevent users holding its custom salon staff role from assigning arbitrary capabilities to other accounts when editing a customer. This allows them to escalate any account to administrator and take over the site.

A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This impacts the function MySQLDB::topicslist of the file exammanger.php of the component AJAX Endpoint. The manipulation of the argument subject results in sql injection. The attack may be launched remotely. The exploit is now public and may be used. This product operates on a rolling release basis, ensuring continuous delivery. Consequently, there are no version details for either affected or updated releases. The project was informed of the problem early through an issue report but has not responded yet.