CVE-2021-46067

In Vehicle Service Management System 1.0 an attacker can steal the cookies leading to Full Account Takeover...

CVE-2021-46080

A Cross Site Request Forgery CSRF vulnerability exists in Vehicle Service Management System 1.0. An successful CSRF attacks leads to Stored Cross Site Scripting Vulnerability...

Sourcecodester Vehicle Service Management System 跨站脚本漏洞

Sourcecodester Vehicle Service Management System is an open source PHP project. A simple Web application for automotive repair/service stores or businesses. sourcecodester Vehicle Service Management System version 1.0 has a cross-site scripting vulnerability that stems from a lack of valid...

Sourcecodester Vehicle Service Management System 跨站脚本漏洞

Sourcecodester Vehicle Service Management System is an open source PHP project. A simple Web application for automotive repair/service stores or businesses. sourcecodester Vehicle Service Management System version 1.0 has a cross-site scripting vulnerability that stems from a lack of valid...

Sourcecodester Vehicle Service Management System 跨站脚本漏洞

Sourcecodester Vehicle Service Management System is an open source PHP project. A simple Web application for automotive repair/service stores or businesses. sourcecodester Vehicle Service Management System version 1.0 has a cross-site scripting vulnerability that stems from a lack of effective...

AZL-43909 CVE-2021-44716 affecting package buildah 1.18.0-29

net/http in Go before 1.16.12 and 1.17.x before 1.17.5 allows uncontrolled memory consumption in the header canonicalization cache via HTTP/2 requests...

Iball WRD12EN 跨站请求伪造漏洞

The Iball WRD12EN is a router from iBall Iball India. The iBall WRD12EN version 1.0.0 suffers from a cross-site request forgery vulnerability that stems from a software request that lacks cross-site request forgery token validation, which can be exploited by an attacker to enable DNS settings or...

CVE-2021-45907

An issue was discovered in gif2apng 1.9. There is a stack-based buffer overflow involving a for loop. An attacker has little influence over the data written to the stack, making it unlikely that the flow of control can be subverted...

CVE-2021-43631

Projectworlds Hospital Management System v1.0 is vulnerable to SQL injection via the appointmentno parameter in payment.php...

CVE-2021-43155

Projectsworlds Online Book Store PHP v1.0 is vulnerable to SQL injection via the "bookisbn" parameter in cart.php...

Projectworlds Online Book Store Project In Php 跨站请求伪造漏洞

Projectworlds Online Book Store Project In Php is a Php-based online bookstore system from the Austrian company Projectworlds. A security vulnerability exists in Projectworlds Online Book Store Project In Php version 1.0, which can be exploited by an attacker to delete any book from the system...

Cold Store Management System SQL注入漏洞

Simple Cold Storage Management System is a powerful and flexible ERP system that includes all the complex processing functionality required for cold storage. simple Cold Storage Management System is vulnerable in v1.0 due to a SQL injection vulnerability in the system's view The vulnerability is...

CVE-2021-43441

An HTML Injection Vulnerability in iOrder 1.0 allows the remote attacker to execute Malicious HTML codes via the signup form...

MartDevelopers iResturant 跨站脚本漏洞

MartDevelopers iResturant is an open source lightweight restaurant Erp from MartDevelopers Kenya. for integrating social restaurant operations into one system. A cross-site scripting vulnerability exists in MartDevelopers iResturant version 1.0, which stems from a lack of effective filtering and...

CVE-2021-44655

Online Pre-owned/Used Car Showroom Management System 1.0 contains a SQL injection authentication bypass vulnerability. Admin panel authentication can be bypassed due to SQL injection vulnerability in the login form allowing attacker to get admin access on the application...

XStream: allow a remote attacker to cause DoS only by manipulating the processed input stream

XStream is a Java library to serialize objects to XML and back again. In XStream before version 1.4.16, there is vulnerability which may allow a remote attacker to allocate 100% CPU time on the target system depending on CPU type or parallel execution of such a payload resulting in a denial of...

CVE-2021-39314

The WooCommerce EnvioPack WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the dataid parameter found in the /includes/functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2...

samba: SMB1 client connections can be downgraded to plaintext authentication

A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even if Kerberos authentication was required...

WordPress 插件跨站请求伪造漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WP Admin Logo Changer plugin is a WordPress open source application plugin. WordPress WP Admin Logo Changer plugin in version 1.0 and earlier has a cross-site request forgery vulnerability, which...

PT-2021-5597

Name of the Vulnerable Software and Affected Versions Log4j version 1.2 Description The issue is related to the JMSAppender in Log4j 1.2, which is vulnerable to deserialization of untrusted data. An attacker with write access to the Log4j configuration can provide TopicBindingName and...