2284 matches found
CVE-2024-7036
Open WebUI vulnerability CVE-2024-7036 is described in connected advisories as Open WebUI 0.3.8 containing an uncontrolled resource consumption flaw. An unauthenticated attacker can sign up with excessively large text in the name field, causing the Admin panel to become unresponsive and blocking ...
CVE-2024-7036 Denial of Service in open-webui/open-webui
A vulnerability in open-webui/open-webui v0.3.8 allows an unauthenticated attacker to sign up with excessively large text in the 'name' field, causing the Admin panel to become unresponsive. This prevents administrators from performing essential user management actions such as deleting, editing, ...
CVE-2024-41975
An unauthenticated remote attacker can gain limited information of the PLC network but the user management of the PLCs prevents the actual access to the PLCs...
CVE-2024-41975
CVE-2024-41975 concerns the CODESYS Edge Gateway for Windows with insecure defaults. Public sources converge on an unauthenticated remote attacker being able to obtain limited information about the PLC network; however, careful access controls in PLC user management appear to prevent actual contr...
CVE-2024-41975 CODESYS (Edge) Gateway for Windows insecure default
An unauthenticated remote attacker can gain limited information of the PLC network but the user management of the PLCs prevents the actual access to the PLCs...
CVE-2024-7266
Incorrect User Management vulnerability in Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP allows logged-in user to list all users in the system, including those from other organizations. This issue affects EZD RP: from 15 before 15.84, from 16 before 16.15, from 17...
CVE-2024-7265
Incorrect User Management vulnerability in Naukowa i Akademicka Sieć Komputerowa - Państwowy Instytut Badawczy EZD RP allows logged-in user to change the password of any user, including root user, which could lead to privilege escalation. This issue affects EZD RP: from 15 before 15.84, from 16...
CVE-2025-28011
A SQL Injection was found in loginsystem/change-password.php in PHPGurukul User Registration & Login and User Management System v3.3 allows remote attackers to execute arbitrary code via the currentpassword POST request parameter...
CVE-2025-28015
A HTML Injection vulnerability was found in loginsystem/edit-profile.php of the PHPGurukul User Registration & Login and User Management System V3.3. This vulnerability allows remote attackers to execute arbitrary HTML code via the fname, lname, and contact parameters...
CVE-2025-27431
User management functionality in SAP NetWeaver Application Server Java is vulnerable to Stored Cross-Site Scripting XSS. This could enable an attacker to inject malicious payload that gets stored and executed when a user accesses the functionality, hence leading to information disclosure or...
CVE-2025-28011
A SQL Injection was found in loginsystem/change-password.php in PHPGurukul User Registration & Login and User Management System v3.3 allows remote attackers to execute arbitrary code via the currentpassword POST request parameter...
CVE-2025-28015
A HTML Injection vulnerability was found in loginsystem/edit-profile.php of the PHPGurukul User Registration & Login and User Management System V3.3. This vulnerability allows remote attackers to execute arbitrary HTML code via the fname, lname, and contact parameters...
CVE-2025-28015
A HTML Injection vulnerability was found in loginsystem/edit-profile.php of the PHPGurukul User Registration & Login and User Management System V3.3. This vulnerability allows remote attackers to execute arbitrary HTML code via the fname, lname, and contact parameters...
CVE-2025-28011
A SQL Injection was found in loginsystem/change-password.php in PHPGurukul User Registration & Login and User Management System v3.3 allows remote attackers to execute arbitrary code via the currentpassword POST request parameter...
CVE-2025-28015
A HTML Injection vulnerability was found in loginsystem/edit-profile.php of the PHPGurukul User Registration & Login and User Management System V3.3. This vulnerability allows remote attackers to execute arbitrary HTML code via the fname, lname, and contact parameters...
CVE-2025-28011
A SQL Injection was found in loginsystem/change-password.php in PHPGurukul User Registration & Login and User Management System v3.3 allows remote attackers to execute arbitrary code via the currentpassword POST request parameter...
CVE-2025-28011
CVE-2025-28011 affects PHPGurukul’s User Registration & Login and User Management System v3.3. The vulnerability is in loginsystem/change-password.php where the currentpassword POST parameter is mishandled, enabling a SQL injection that can allow remote attackers to execute arbitrary code. The do...
CVE-2025-28015
CVE-2025-28015 describes an HTML Injection in loginsystem/edit-profile.php of the PHPGurukul User Registration & Login and User Management System V3.3. The vulnerability allows an attacker to inject HTML via the fname, lname, and contact parameters, with a local attack vector, requiring user inte...
CVE-2025-27431
User management functionality in SAP NetWeaver Application Server Java is vulnerable to Stored Cross-Site Scripting XSS. This could enable an attacker to inject malicious payload that gets stored and executed when a user accesses the functionality, hence leading to information disclosure or...