Unspecified vulnerability in Tenda W9 (CNVD-2024-23316)

Tenda W9 is a wireless in-wall access point from Tenda, China. A security vulnerability exists in Tenda W9 version 1.0.0.74456, which stems from an incorrect operation of the parameter ssidIndex that can cause a stack-based buffer overflow. No details of the vulnerability are provided at this tim...

WBSAirback Cross-Site Request Forgery Vulnerability

WBSAirback is a next generation storage and backup system from WBSAirback. A cross-site request forgery vulnerability exists in WBSAirback version 21.02.04, which can be exploited by an attacker to forge a malicious request to trick a victim into clicking on it to perform a sensitive operation...

PT-2024-25872 · Sourcecodester · Sourcecodester Prison Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Prison Management System version 1.0 Description: A critical issue has been found in the SourceCodester Prison Management System, affecting the file /Employee/delete leave.php. This issue leads to sql injection and can be...

71cms 安全漏洞

71CMS is a smart party building system open source by xiaocheng-keji. A security vulnerability exists in 71cms v1.0.0, which stems from the presence of a Server Request Forgery SSRF vulnerability...

FAQ Management System 安全漏洞

FAQ Management System is a Frequently Asked Questions Management System by Remy Andrade Personal Developer. A security vulnerability exists in FAQ Management System version v.1.0, which stems from a cross-site scripting XSS vulnerability that could allow a remote attacker to obtain sensitive...

Online Book System SQL注入漏洞

Online Book System is an online booking system. A SQL injection vulnerability exists in code-projects Online Book System version 1.0, which originates from a SQL injection vulnerability in the value parameter of the /Product.php file...

Online Book System SQL注入漏洞

Online Book System is an online booking system. A SQL injection vulnerability exists in Online Book System version 1.0, which originates from a lack of validation of externally entered SQL statements in the ID parameter of the /description.php file. An attacker can exploit this vulnerability to...

Campcodes Online Job Finder System SQL Injection Vulnerability

Campcodes Online Job Finder System is an online job finder system from Campcodes, Inc. A SQL injection vulnerability exists in version 1.0 of the Campcodes Online Job Finder System, which originates from a SQL injection vulnerability in the id parameter of the /admin/employee/index.php file...

PT-2024-21121 · Sourcecodester · Sourcecodester Employee Task Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Employee Task Management System version 1.0 Description: A critical vulnerability was found in the SourceCodester Employee Task Management System, affecting an unknown functionality of the file /edit-task.php. The manipulation ...

PT-2024-19807 · Unknown · Sourcecodester Online Mobile Management Store

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Mobile Management Store version 1.0 Description: A critical issue affects the processing of the file /admin/maintenance/manage category.php in the HTTP GET Request Handler component. The manipulation of the id argument...

Flashcard Quiz App Cross-Site Scripting Vulnerability

Flashcard Quiz App is a dynamic tool for rems individual developers designed to promote interactive learning and knowledge retention. A cross-site scripting vulnerability exists in Flashcard Quiz App version 1.0, which stems from the parameter question/answer in the file...

PT-2024-2171 · Unknown · F-Logic Datacube3

Name of the Vulnerable Software and Affected Versions: F-logic DataCube3 version 1.0 Description: The issue is related to unrestricted file upload, which could allow an authenticated malicious actor to upload a file of a dangerous type by manipulating the filename extension. This could potentiall...

CVE-2024-25213

Employee Managment System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /edit.php...

lambda-middleware Security Vulnerabilities

lambda-middleware is a collection of middleware for AWS lambda functions. A security vulnerability exists in dbartholomae lambda-middleware frameguard version 1.0.4 and earlier, which stems from a security vulnerability in the component JSON Mime-Type Handler...

CVE-2024-25305

Code-projects Simple School Managment System 1.0 allows Authentication Bypass via the username and password parameters at School/index.php...

PT-2024-20423 · Unknown · Employee Management System

Name of the Vulnerable Software and Affected Versions: Employee Management System version 1.0 Description: The issue allows a remote attacker to execute arbitrary code via the "edit-photo.php" component. This is due to an Unrestricted File Upload vulnerability. Recommendations: For Employee...

CVE-2024-24945

A stored cross-site scripting XSS vulnerability in Travel Journal Using PHP and MySQL with Source Code v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Share Your Moments parameter at /travel-journal/write-journal.php...

CVE-2024-23860 Cross-Site Scripting (XSS) vulnerability in Cups Easy

A vulnerability has been reported in Cups Easy Purchase & Inventory, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting XSS vulnerability via /cupseasylive/currencylist.php, in the description parameter. Exploitation of this vulnerability...

PT-2024-20123 · Cups Easy · Cups Easy

Name of the Vulnerable Software and Affected Versions: Cups Easy Purchase & Inventory version 1.0 Description: A vulnerability has been reported in Cups Easy Purchase & Inventory whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting XSS vulnerability via...

CVE-2024-0891

A vulnerability was found in hongmaple octopus 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument description with the input alertdocument.cookie leads to cross site scripting. The attack can be launched remotely...