CVE-2024-37136

Dell Path to PowerProtect, versions 1.1, 1.2, contains an Exposure of Private Personal Information to an Unauthorized Actor vulnerability. A remote high privileged attacker could potentially exploit this vulnerability, leading to information exposure...

camera-pi 安全漏洞

camera-pi is a camera module by Michael Horne Personal Developer. A security vulnerability exists in camera-pi version 1.0, which stems from the mishandling of user input passed to the position GET parameter in the tilt.php script, which could allow an attacker to execute arbitrary commands by...

PT-2024-31262 · Unknown · Online Complaint Site

Name of the Vulnerable Software and Affected Versions: Online Complaint Site version 1.0 Description: The issue allows a remote attacker to escalate privileges via the username and password parameters in the "/admin.index.php" API endpoint. Recommendations: For Online Complaint Site version 1.0,...

Computer Laboratory Management System SQL注入漏洞

Computer Laboratory Management System is an open source computer laboratory management system from SourceCodester. A SQL injection vulnerability exists in Computer Laboratory Management System version 1.0, which originates from a SQL injection vulnerability in the id parameter of the...

WordPress Opor Ayam theme <= 1.8 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by justakazh Patchstack Alliance in WordPress Theme Opor Ayam versions = 1.8...

phpIPAM 安全漏洞

phpIPAM is the phpIPAM open source suite of open source PHP and MySQL based IP address management applications IPAM. A security vulnerability exists in phpIPAM version 1.6, which stems from the presence of a cross-site scripting XSS vulnerability via appadminimport-exportimport-load-data.php...

PT-2024-29378 · Organizr · Organizr

Name of the Vulnerable Software and Affected Versions: Organizr version 1.90 Description: The issue is a SQL injection problem. It occurs via the chat/setlike.php file. Recommendations: For Organizr version 1.90, consider restricting access to the chat/setlike.php file until a patch is available...

PT-2024-29371

Name of the Vulnerable Software and Affected Versions phpipam version 1.6 Description The issue is a Cross Site Scripting XSS vulnerability. It occurs through the appadminimport-exportimport-load-data.php file. This allows for potential malicious script execution. Recommendations For phpipam...

PT-2024-30783 · Nitropack · Nitropack

Name of the Vulnerable Software and Affected Versions: NitroPack versions 1.16.7 and earlier Description: The issue is related to improper control of code generation, allowing code injection. This is due to a Code Injection vulnerability in NitroPack Inc.'s NitroPack. Recommendations: For version...

Organizr 安全漏洞

Organizr is a tab management system for causefx individual developers. It is intended to be a one-stop store on the front end of the server. A security vulnerability exists in Organizr v1.90, which stems from a SQL injection vulnerability via chat/settyping.php...

Kashipara Music Management System 安全漏洞

Kashipara Music Management System is a music management system from Kashipara. Kashipara Music Management System v1.0 has a cross-site request forgery vulnerability, which originates from the /music/ajax.php?action=saveuser page does not adequately verify whether the request is from a trusted use...

PT-2024-30166 · Unknown · Kashipara Music Management System

Name of the Vulnerable Software and Affected Versions: Kashipara Music Management System version 1.0 Description: A Cross-Site Request Forgery CSRF issue was found in the system. This can be exploited through a crafted request to the "/music/ajax.php?action=save user" page. Recommendations: For...

Insurance Management System 跨站脚本漏洞

Insurance Management System is an insurance management system from the individual developer Angel Jude Reyes Suarez. A cross-site scripting vulnerability exists in Insurance Management System version 1.0, which stems from an incorrect manipulation of the parameter AGENT ID that results in...

Insurance Management System 安全漏洞

Insurance Management System is an insurance management system by the individual developer Angel Jude Reyes Suarez. A security vulnerability exists in Insurance Management System version 1.0, which stems from the manipulation of the parameter CLIENT ID in the file addClient.php that can lead to...

Music Gallery Site SQL注入漏洞

Music Gallery Site is a music gallery site by Carlo Montero's personal developer. A SQL injection vulnerability exists in Music Gallery Site version 1.0, which stems from the manipulation of the parameter id in the file /admin/?page=musics/managemusic that can lead to SQL injection...

PT-2024-38877 · Unknown · Code-Projects Online Quiz Site

Name of the Vulnerable Software and Affected Versions: code-projects Online Quiz Site version 1.0 Description: A critical issue affects the processing of the file index.php, where the manipulation of the loginid argument leads to SQL injection. The attack can be initiated remotely. The exploit ha...

log4j: Remote code execution in Log4j 1.x when application is configured to use JMSAppender

A flaw was found in the Java logging library Apache Log4j in version 1.x. JMSAppender in Log4j 1.x is vulnerable to deserialization of untrusted data. This allows a remote attacker to execute code on the server if the deployed application is configured to use JMSAppender and to the attacker's JND...

log4j: Unsafe deserialization flaw in Chainsaw log viewer

A flaw was found in the log4j 1.x chainsaw component, where the contents of certain log entries are deserialized and possibly permit code execution. This flaw allows an attacker to send a malicious request with serialized data to the server to be deserialized when the chainsaw component is run...

log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender

A flaw was found in the Java logging library Apache Log4j in version 1.x. JDBCAppender in Log4j 1.x is vulnerable to SQL injection in untrusted data. This allows a remote attacker to run SQL statements in the database if the deployed application is configured to use JDBCAppender with certain...

PT-2024-30164 · Unknown · Kashipara Music Management System

Name of the Vulnerable Software and Affected Versions: Kashipara Music Management System version 1.0 Description: A Cross-Site Request Forgery CSRF vulnerability was found in the Kashipara Music Management System via the /music/ajax.php endpoint, specifically with the action=delete genre paramete...