PT-2025-15292 · Unknown · Xiaozhi-Esp32-Server-Java

Name of the Vulnerable Software and Affected Versions: joey-zhou xiaozhi-esp32-server-java up to a14fe8115842ee42ab5c7a51706b8a85db5200b7 Description: A critical issue has been found in the software, affecting the update function of the "/api/user/update" API endpoint. The manipulation of the sta...

CVE-2025-0452 Arbitrary File Deletion in eosphoros-ai/DB-GPT

eosphoros-ai/DB-GPT version latest is vulnerable to arbitrary file deletion on Windows systems via the '/v1/agent/hub/update' endpoint. The application fails to properly filter the '' character, which is commonly used as a separator in Windows paths. This vulnerability allows attackers to delete...

DB-GPT 安全漏洞

DB-GPT is an AWEL and agent-based AI native data application development framework open-sourced by eosphoros. A security vulnerability exists in DB-GPT that originates on Windows systems via the /v1/agent/hub/update endpoint that could lead to arbitrary file deletion...

CVE-2024-55064

Multiple cross-site scripting XSS vulnerabilities in EasyVirt DC NetScope = 8.6.4 allow remote attackers to inject arbitrary JavaScript or HTML code via the 1 smtpserver, 2 smtpaccount, 3 smtppassword, or 4 emailrecipients parameter to /smtp/update; the 5 ntp or 6 dns parameter to...

CVE-2025-27585

A stored cross-site scripting XSS vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System SIS EagleR v1.0.118 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Print Name parameter at /rest/staffResource/update...

PT-2025-9239

Name of the Vulnerable Software and Affected Versions Serosoft Solutions Pvt Ltd Academia Student Information System SIS EagleR version 1.0.118 Description A stored cross-site scripting issue allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the User ID...

Astra Linux – Vulnerability in Zabbix

A authenticated user with API access e.g., a user with the default User role can be added to any group e.g., Zabbix Administrators. Specifically, a user with access to the user.update API endpoint can be added to any group, except for groups that are disabled or have restricted GUI access...

PT-2024-17777 · Unknown · Code-Projects Online Exam Mastering System

Name of the Vulnerable Software and Affected Versions: code-projects Online Exam Mastering System version 1.0 Description: A critical issue affects some unknown processing of the file "/update.php?q=quiz&step=2". The manipulation of the argument eid leads to SQL injection. The attack may be...

Cross-site Scripting (XSS)

Overview pyspider is an A Powerful Spider System in Python Affected versions of this package are vulnerable to Cross-site Scripting XSS through the /update endpoint due to improper sanitization of the name parameter. Note: To successfully exploit this vulnerability in a real-life scenario, the...

PySpider 安全漏洞

pyspider is a powerful web crawler system open-sourced by Roy Binux. A security vulnerability exists in PySpider version 0.3.10 and earlier, which stems from a failure to properly clean up the name parameter, allowing cross-site scripting attacks via the /update endpoint...

PT-2024-28372

Name of the Vulnerable Software and Affected Versions pyspider versions 0.3.10 and earlier Description The issue allows for Cross Site Scripting XSS via the /update endpoint. This affects products that are no longer supported by the maintainer. Recommendations For versions 0.3.10 and earlier, as ...

CVE-2024-36467

An authenticated user with API access e.g.: user with default User role, more specifically a user with access to the user.update API endpoint is enough to be able to add themselves to any group e.g.: Zabbix Administrators, except to groups that are disabled or having restricted GUI access...

Attendance and Payroll System 代码问题漏洞

Attendance and Payroll System is a PHP/MySQLi source code Attendance and Payroll System by oretnom23. A code issue vulnerability exists in Attendance and Payroll System version 1.0, which stems from an unrestricted file upload vulnerability in the image parameter of the /marimar/guest/update.php...

CVE-2022-30357

OvalEdge 5.2.8.0 and earlier is affected by an Account Takeover vulnerability via a POST request to /profile/updateProfile via the userId and email parameters. Authentication is required...

PT-2024-11558 · Ovaledge · Ovaledge

Name of the Vulnerable Software and Affected Versions: OvalEdge versions 5.2.8.0 and earlier Description: The issue is related to multiple Stored XSS also known as Persistent or Type II vulnerabilities. These vulnerabilities can be exploited via a POST request to the "/profile/updateProfile" API...

PT-2024-11555 · Ovaledge · Ovaledge

Name of the Vulnerable Software and Affected Versions: OvalEdge versions 5.2.8.0 and earlier Description: The issue allows for an Account Takeover via a POST request to "/profile/updateProfile" using the userId and email parameters. Authentication is required to exploit this issue. Recommendation...

PT-2024-39385 · Unknown · Sourcecodester Best House Rental Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Best House Rental Management System version 1.0 Description: A critical issue has been found in the system, affecting the file /ajax.php?action=update account. The manipulation of the arguments firstname, lastname, or email lea...

PT-2024-39181 · Jfinalcms · Jfinalcms

Name of the Vulnerable Software and Affected Versions: JFinalCMS versions up to 20240903 Description: A problematic issue was found in JFinalCMS, affecting the update function of the /admin/template/update component, specifically the com.cms.controller.admin.TemplateController. The manipulation o...

PT-2024-39101 · Sourcecodester · Sourcecodester Php Crud

Name of the Vulnerable Software and Affected Versions: SourceCodester PHP CRUD version 1.0 Description: A critical issue has been identified, affecting the file /endpoint/update.php. The manipulation of the arguments tbl person id, first name, middle name, and last name can lead to SQL injection...

PT-2024-39100 · Sourcecodester · Sourcecodester Php Crud

Name of the Vulnerable Software and Affected Versions: SourceCodester PHP CRUD version 1.0 Description: A vulnerability was found in the software, classified as problematic. It affects the file /endpoint/update.php, where the manipulation of the first name, middle name, and last name arguments...