PT-2022-18093 · Sourcecodester · Sourcecodester Apartment Visitor Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Apartment Visitor Management System version 1.0 Description: A problematic issue has been found, affecting the /manage-apartment.php file. The manipulation of the Apartment Number argument with the input alert1 leads to...

PT-2022-22248 · Mealie · Mealie

Name of the Vulnerable Software and Affected Versions: Mealie version 0.5.5 Description: A stored cross-site scripting XSS vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Shopping Lists item names text field. This enables attackers t...

PT-2022-17517 · Sourcecodester · Sourcecodester Garage Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Garage Management System version 1.0 Description: A problematic issue was found in the software, affecting an unknown function of the file /php action/createUser.php. The manipulation of the userName argument with a specific...

PT-2022-20003 · Unknown · Elliegrid Android Application

Name of the Vulnerable Software and Affected Versions: EllieGrid Android Application version 3.4.1 Description: The EllieGrid Android Application is vulnerable to Code Injection. The application evaluates user input as code, allowing for remote exploitation. Recommendations: For EllieGrid Android...

PT-2022-23239 · Unknown · Orange Station

Name of the Vulnerable Software and Affected Versions: Orange Station version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the username parameter. Recommendations: For Orange Station version 1.0, update to a version that includes ...

PT-2022-8076 · Codecov +1 · Codecov +1

Name of the Vulnerable Software and Affected Versions: codecov versions prior to 2.0.16 Description: The issue arises from the failure to sanitize gcov arguments before they are provided to the popen method. This lack of sanitization can lead to potential exploitation. Recommendations: For versio...

PT-2022-20361 · Unknown · Nukeviet Cms

Name of the Vulnerable Software and Affected Versions: NukeViet CMS versions prior to 4.5.02 Description: The issue is related to a Cross Site Scripting Stored XSS vulnerability. This means that an attacker can inject malicious scripts into the website, which can then be executed by other users. ...

PT-2022-14867 · Inventree · Inventree

Name of the Vulnerable Software and Affected Versions: inventree versions prior to 0.7.2 Description: The issue is related to Cross-site Scripting XSS - Stored, which affects the GitHub repository inventree/inventree. This type of attack occurs when an application stores user input and later...

PT-2022-14807 · Dolibarr · Dolibarr

Name of the Vulnerable Software and Affected Versions: dolibarr/dolibarr versions prior to 16.0 Description: The issue is related to a Cross-site Scripting XSS - Stored vulnerability. It affects the admin/accountant.php file, where the fields town, name, and Accountant code can be used to escape...

Authentication Bypass

ngxhttpluamodule is vulnerable to authentication bypass. The vulnerability exists because it doesn't properly restrict the user inputs which allows an attacker to insert unsafe characters in an argument when using the API to mutate a URI, or a request or response header...

PT-2022-17205 · Cerebrate · Cerebrate

Name of the Vulnerable Software and Affected Versions: Cerebrate versions through 1.4 Description: An issue was discovered that allows reflected XSS in form descriptions via a user-controlled description. This occurs in the genericForm component. Recommendations: For versions through 1.4, as a...

PT-2022-11876 · Codex · Codex

Name of the Vulnerable Software and Affected Versions: Codex versions prior to 1.4.0 Description: A Cross Site Scripting XSS issue exists via the Notebook/Page name field, allowing malicious users to execute arbitrary code through a crafted http code in a .json file. Recommendations: For versions...

CVE-2021-42838

Grand Vice info Co. webopac7 book search field parameter does not properly restrict the input of special characters, thus unauthenticated attackers can inject JavaScript syntax remotely, and further perform reflective XSS attacks...

CVE-2021-41565

TadTools special page parameter does not properly restrict the input of specific characters, thus remote attackers can inject JavaScript syntax without logging in, and further perform reflective XSS attacks...

CVE-2021-41565

CVE-2021-41565 affects Tad Tools TadTools. The issue is a cross-site scripting vulnerability caused by insufficient validation of input on a special page parameter, enabling remote attackers to inject JavaScript without logging in and potentially perform reflective XSS. Primary impact is client-s...

PT-2021-10319 · Dhcms · Dhcms

Name of the Vulnerable Software and Affected Versions: dhcms version 2017-09-18 Description: An Information Disclosure issue exists when entering invalid characters after the normal interface, causing an error that leaks the physical path. Recommendations: For dhcms version 2017-09-18, consider...

PT-2021-13868 · Privoxy +4 · Privoxy +4

Name of the Vulnerable Software and Affected Versions: privoxy versions prior to 3.0.32 Description: A flaw was found in the software, where invalid memory access with an invalid pattern passed to the pcre compile function may lead to denial of service. Recommendations: For versions prior to...

PT-2021-14383 · Unknown · Angular-Expressions

Name of the Vulnerable Software and Affected Versions: angular-expressions versions prior to 1.1.2 Description: The issue allows Remote Code Execution if expressions.compileuserControlledInput is called where userControlledInput is text that comes from user input. The security of the package coul...

PT-2021-3609 · Pypi +9 · Pygments +9

Name of the Vulnerable Software and Affected Versions: Pygments versions 1.1 through 2.7.3 Description: The issue is related to the use of regular expressions in the Pygments syntax highlighting program. Some of the regular expressions have exponential or cubic worst-case complexity and are...

PT-2020-6194 · Openjpeg +9 · Openjpeg +9

Name of the Vulnerable Software and Affected Versions: openjpeg versions prior to 2.4.0 Description: The issue is related to an out-of-bounds read in the src/lib/openjp2/pi.c component of the openjpeg library. This occurs when an attacker provides untrusted input to openjpeg's conversion or...