CVE-2024-34230

A cross-site scripting XSS vulnerability in Sourcecodester Laboratory Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the System Information parameter...

CVE-2024-34225

Cross Site Scripting vulnerability in php-lms/admin/?page=systeminfo in Computer Laboratory Management System using PHP and MySQL 1.0 allow remote attackers to inject arbitrary web script or HTML via the name, shortname parameters...

CVE-2024-34230

Sourcecodester Laboratory Management System v1.0 is affected by a cross-site scripting (XSS) vulnerability in the System Information parameter. The root cause is improper handling/sanitization of user-supplied input, allowing attackers to inject arbitrary web scripts or HTML. Impact disclosed in ...

PT-2024-25755 · Unknown · Computer Laboratory Management System

Name of the Vulnerable Software and Affected Versions: Computer Laboratory Management System version 1.0 Description: The issue concerns a Cross Site Scripting vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the name and shortname parameters in the...

Malicious code in hw-transition-animation (npm)

The package hw-transition-animation npm version 66.6.9 contains malicious code. The malicious code is designed exfiltrate system information potentially for malicious purpose...

MAL-2024-1321 Malicious code in hw-transition-animation (npm)

The package hw-transition-animation npm version 66.6.9 contains malicious code. The malicious code is designed exfiltrate system information potentially for malicious purpose...

CVE-2024-3682

The WP STAGING and WP STAGING Pro plugins for WordPress are vulnerable to Sensitive Information Exposure in versions up to, and including, 3.4.3, and versions up to, and including, 5.4.3, respectively, via the ajaxSendReport function. This makes it possible for unauthenticated attackers to extrac...

CVE-2023-4857

An authentication bypass vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute certain IPMI calls that could lead to exposure of limited system information...

CVE-2023-4857

An authentication bypass vulnerability was identified in SMM/SMM2 and FPC that could allow an authenticated user to execute certain IPMI calls that could lead to exposure of limited system information...

CVE-2023-4857

Summary: A concrete authentication-bypass issue affects Lenovo SMM/SMM2 and Fan Power Controller (FPC) firmware in Lenovo ThinkSystem, ThinkAgile, NeXtScale, and CP-CB-10 platforms. Affected components: System Management Module/SMM2 and Fan Power Controller firmware. Root cause (as described): La...

CVE-2024-25646

Due to improper validation, SAP BusinessObject Business Intelligence Launch Pad allows an authenticated attacker to access operating system information using crafted document. On successful exploitation there could be a considerable impact on confidentiality of the application...

CVE-2024-25646 Information Disclosure vulnerability in SAP BusinessObjects Web Intelligence

Due to improper validation, SAP BusinessObject Business Intelligence Launch Pad allows an authenticated attacker to access operating system information using crafted document. On successful exploitation there could be a considerable impact on confidentiality of the application...

SAP BusinessObject Business Intelligence Launch Pad 信息泄露漏洞

SAP BusinessObject Business Intelligence Launch Pad is a web control panel for the Business Intelligence platform from SAP, Germany. An information disclosure vulnerability exists in SAP BusinessObject Business Intelligence Launch Pad versions 4.2 and 4.3, which arises from improper authenticatio...

PT-2024-2972 · Sap · Sap Businessobject Business Intelligence Launch Pad

Name of the Vulnerable Software and Affected Versions: SAP BusinessObject Business Intelligence Launch Pad affected versions not specified Description: The issue is related to improper validation in SAP BusinessObject Business Intelligence Launch Pad, allowing an authenticated attacker to access...

UP-RESULT 0.1 2024 SQL Injection

Title: upresult0.1-2024 Multiple-SQLi Author: nu11secur1ty Date: 04/08/2024 Vendor: https://www.mayurik.com/ Software: https://www.sourcecodester.com/php/15653/best-student-result-management-system-project-source-code-php-and-mysql-free-download Reference:...

JVN#82074338: Multiple vulnerabilities in NEC Aterm series

Aterm series provided by NEC Corporation contains multiple vulnerabilities listed below. Incorrect Permission Assignment for Critical Resource CWE-732 CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Base Score 8.0 CVE-2024-28005 Exposure of Sensitive System Information to an Unauthorized Control...

LMS PHP 1.0 SQL Injection

Title: LMS-PHP-byoretnom23-v1.0 Multiple-SQLi Author: nu11secur1ty Date: 03/28/2024 Vendor: https://github.com/oretnom23 Software: https://www.sourcecodester.com/php/17268/computer-laboratory-management-system-using-php-and-mysql.htmlcomment-104400 Reference:...

CVE-2023-47438

SQL Injection vulnerability in Reportico Till 8.1.0 allows attackers to obtain sensitive information or other system information via the project parameter...

Docassemble Information Disclosure Vulnerability

Docassemble is a free, open source expert system for guided interviews and document assembly. An information disclosure vulnerability exists in Docassemble versions 1.4.53 through 1.4.96, which can be exploited by an attacker to gain unauthorized access to system information by manipulating a URL...

Dell Grab 安全漏洞

Dell Grab is a configuration technology from Dell, Inc. It is used to collect data on hosts connected to Dell EMC storage devices. A security vulnerability exists in Dell Grab version 5.0.4 and earlier, which stems from a system containing an incorrect file permission vulnerability that results i...