CVE-2024-48744

A Reflected Cross Site Scripting XSS vulnerability was found in /trms/listed- teachers.php in PHPGurukul Teachers Record Management System v2.1, which allows remote attackers to execute arbitrary code via "searchinput" POST request parameter...

CVE-2024-48744

CVE-2024-48744 affects PHPGurukul Teachers Record Management System v2.1. A reflected Cross-Site Scripting (XSS) vulnerability exists in the /trms/listed-teachers.php endpoint (and variant listed- teachers.php) where an attacker can supply input via the POST parameter “searchinput” to trigger cod...

CVE-2024-48744

A Reflected Cross Site Scripting XSS vulnerability was found in /trms/listed- teachers.php in PHPGurukul Teachers Record Management System v2.1, which allows remote attackers to execute arbitrary code via "searchinput" POST request parameter...

GHSA-2234-FMW7-43WR Hono allows bypass of CSRF Middleware by a request without Content-Type header.

Summary Bypass CSRF Middleware by a request without Content-Type herader. Details Although the csrf middleware verifies the Content-Type Header, Hono always considers a request without a Content-Type header to be safe...

CVE-2024-48279

A HTML Injection vulnerability was found in /search-result.php of PHPGurukul User Registration & Login and User Management System 3.2. This vulnerability allows remote attackers to execute arbitrary HTML code via the searchkey parameter in a POST HTTP request...

CVE-2024-48279

A HTML Injection vulnerability was found in /search-result.php of PHPGurukul User Registration & Login and User Management System 3.2. This vulnerability allows remote attackers to execute arbitrary HTML code via the searchkey parameter in a POST HTTP request...

CVE-2024-9974

A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file classes/Master.php?f=addtocard of the component POST Request Handler. The manipulation of the argument productid leads to s...

CVE-2024-9974 SourceCodester Online Eyewear Shop POST Request Master.php sql injection

A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file classes/Master.php?f=addtocard of the component POST Request Handler. The manipulation of the argument productid leads to s...

CVE-2024-9974 SourceCodester Online Eyewear Shop POST Request Master.php sql injection

A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file classes/Master.php?f=addtocard of the component POST Request Handler. The manipulation of the argument productid leads to s...

CVE-2024-9974

The CVE-2024-9974 entry concerns SourceCodester Online Eyewear Shop 1.0. Affected functionality is in the POST Request Handler, specifically the file classes/Master.php?f=add_to_card, where manipulating the product_id parameter leads to SQL injection. Remote exploitation is possible and public ex...

PT-2024-39972 · Unknown · Sourcecodester Online Eyewear Shop

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Eyewear Shop version 1.0 Description: A critical issue has been found in the software, affecting an unknown functionality of the file classes/Master.php?f=add to card of the component POST Request Handler. The manipulati...

CVE-2024-48279

A HTML Injection vulnerability was found in /search-result.php of PHPGurukul User Registration & Login and User Management System 3.2. This vulnerability allows remote attackers to execute arbitrary HTML code via the searchkey parameter in a POST HTTP request...

ABB Cylon Aspect 3.07.02 sshUpdate.php Unauthenticated Remote SSH Service Control

ABB Cylon Aspect 3.07.02 sshUpdate.php Unauthenticated Remote SSH Service Control Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio Firmware: =3.07.02 Summary: ASPECT is an award-winning scalable building...

The vulnerability of the formSafeEmailFilter() function (/goform/SafeEmailFilte) in the Tenda FH1206 router software allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the formSafeEmailFilter function /goform/SafeEmailFilte in the Tenda FH1206 router software is related to the issue of the operation going out of the buffer in memory when processing the page parameter. Exploiting this vulnerability can allow an attacker to compromise the...

The vulnerability of the formWifiBasicSet() function (/goform/SetOnlineDevName) in the Tenda A301 router software allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the formWifiBasicSet function /goform/SetOnlineDevName of the Tenda A301 router’s software lies in the fact that the operation may go beyond the buffer in memory when processing the devName parameter. Exploiting this vulnerability could allow an attacker to compromise the...

CVE-2024-8925

In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to...

CVE-2024-8925

CVE-2024-8925 affects PHP multipart form data parsing via HTTP POST. Affected: PHP 8.1.x before 8.1.30, 8.2.x before 8.2.24, and 8.3.x before 8.3.12. The issue is an erroneous parsing of multipart form data that could cause the application to exhibit incorrect behavior due to data handling incons...

CVE-2024-8925

In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to...

CVE-2024-8925 Erroneous parsing of multipart form data

In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to...

PT-2024-7094 · D Link · D-Link Dir-878 +1

Name of the Vulnerable Software and Affected Versions: D-Link DIR-882 versions FW130B06 D-Link DIR-878 version FW130B08 Description: A command injection issue exists in the SetVLANSettings function due to insufficient neutralization of special elements used in an OS command. This allows attackers...