PT-2024-15451 · Beijing Baichuo · Beijing Baichuo Smart S150 Management Platform

Name of the Vulnerable Software and Affected Versions: Beijing Baichuo Smart S150 Management Platform versions up to 20240101 Description: A critical issue affects some unknown functionality of the file /useratte/userattestation.php of the component HTTP POST Request Handler. The manipulation of...

PT-2024-15427 · Unknown · Kashipara Hotel Management System

Name of the Vulnerable Software and Affected Versions: Kashipara Hospital Management System versions up to 1.0 Description: A critical vulnerability was found in the Parameter Handler component of the file login.php. The manipulation of the email and password arguments leads to SQL injection. The...

GLSA-202401-06 : CUPS filters: Remote Code Execution

The remote host is affected by the vulnerability described in GLSA-202401-06 CUPS filters: Remote Code Execution - cups-filters contains backends, filters, and other software required to get the cups printing service working on operating systems other than macos. If you use the Backend Error...

PT-2024-13774 · Billing · Billing

Name of the Vulnerable Software and Affected Versions: Billing Software version 1.0 Description: The issue is related to multiple Unauthenticated SQL Injection vulnerabilities. The customer details parameter of the "buyer invoice submit.php" resource does not validate the characters received, and...

PT-2024-14303 · Tenda · Tenda Ax3

Name of the Vulnerable Software and Affected Versions: Tenda AX3 version 16.03.12.11 Description: A remote code execution issue was discovered via the list parameter at the "/goform/SetNetControlList" API endpoint. Recommendations: For Tenda AX3 version 16.03.12.11, as a temporary workaround,...

PT-2023-32928 · Unknown · 7-Card Fakabao

Name of the Vulnerable Software and Affected Versions: 7-card Fakabao versions up to 1.0 build20230805 Description: A critical issue has been found in the software, affecting an unknown functionality of the file shop/alipay notify.php. The manipulation of the out trade no argument leads to sql...

PT-2023-28110 · Unknown · Pandora Fms

Name of the Vulnerable Software and Affected Versions: Pandora FMS versions 700 through 774 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows an attacker to edit the Web Console user notification...

PT-2023-8254 · Poly · Edge E220 +36

Name of the Vulnerable Software and Affected Versions: Poly Trio 8300, Trio 8500, Trio 8800, Trio C60, CCX 350, CCX 400, CCX 500, CCX 505, CCX 600, CCX 700, EDGE E100, EDGE E220, EDGE E300, EDGE E320, EDGE E350, EDGE E400, EDGE E450, EDGE E500, EDGE E550, VVX 101, VVX 150, VVX 201, VVX 250, VVX...

PT-2023-28111 · Unknown · Pandora Fms

Name of the Vulnerable Software and Affected Versions: Pandora FMS versions 700 through 774 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows an attacker to carry out XSS attacks when a user opens...

PT-2023-8289 · Moxa · Oncell G3150A-Lte Series

Name of the Vulnerable Software and Affected Versions: OnCell G3150A-LTE Series firmware versions v1.3 and prior Description: A clickjacking vulnerability has been identified, caused by incorrectly restricting frame objects. This can lead to user confusion about which interface the user is...

PT-2023-32895 · Unknown · Sourcecodester Medicine Tracker System

Name of the Vulnerable Software and Affected Versions: SourceCodester Medicine Tracking System version 1.0 Description: A critical issue affects some unknown processing in the system. The manipulation of the page argument leads to path traversal, specifically '../filedir'. This can be initiated...

PT-2023-8288 · Sourcecodester · Sourcecodester Free/Open Source Inventory Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Free and Open Source Inventory Management System version 1.0 Description: The issue is related to the lack of protection against SQL query structure exploitation in the /ample/app/action/edit product.php file of the Free and Op...

PT-2023-32900 · Unknown · Code-Projects Client Details System

Name of the Vulnerable Software and Affected Versions: code-projects Client Details System version 1.0 Description: A vulnerability has been found in the code-projects Client Details System, affecting the file /admin/regester.php of the component HTTP POST Request Handler. The manipulation of the...

PT-2023-32907 · Gopeak · Gopeak Masterlab

Name of the Vulnerable Software and Affected Versions: gopeak MasterLab versions up to 3.3.10 Description: A critical issue has been found in the HTTP POST Request Handler component, specifically affecting the function sqlInjectDelete of the file app/ctrl/framework/Feature.php. The manipulation o...

PT-2023-31918 · Unknown · Resumable.Php

Name of the Vulnerable Software and Affected Versions: resumable.php versions 0.1.4 through 3c6dbf5 Description: The issue allows arbitrary file upload anywhere in the filesystem via ../ in multipart/form-data content to upload.php. It is noted that file overwrite has not been possible with the...

PT-2023-30369 · Growi · Growi

Name of the Vulnerable Software and Affected Versions: GROWI versions prior to v6.0.0 Description: A stored cross-site scripting vulnerability exists, exploiting a behavior of the XSS Filter. If this issue is exploited, an arbitrary script may be executed on the web browser of the user who access...

PT-2023-31169 · Wolters Kluwer · Wolters Kluwer B.Point

Name of the Vulnerable Software and Affected Versions: Wolters Kluwer B.POINT version 23.70.00 Description: The issue allows a validated system user to achieve remote code execution via Argument Injection in the server-to-server module during the authentication phase. Recommendations: For version...

PT-2023-30872 · Unknown · Concrete Cms

Name of the Vulnerable Software and Affected Versions: Concrete CMS versions prior to 9.2.3 Description: The issue is related to Cross Site Request Forgery CSRF at the "/ccm/system/dialogs/file/delete/1/submit" API endpoint. This allows for unauthorized actions to be performed. Recommendations: F...

PT-2023-20976 · Opencrx · Opencrx

Name of the Vulnerable Software and Affected Versions: openCRX version 5.2.0 Description: A cross-site scripting XSS issue was discovered in openCRX, which occurs via the Name field after creating a Tracker in Manage Activity. This allows for potential malicious script execution. Recommendations:...

PT-2023-31889 · Unknown · Microhttpserver

Name of the Vulnerable Software and Affected Versions: MicroHttpServer versions through a8ab029 Description: The issue allows a one-byte recv buffer overflow via a long URI in the ParseHeader function located in lib/server.c. Recommendations: For versions through a8ab029, consider restricting...