10497 matches found
CVE-2023-51079: Undefined Security Weakness
A long execution time can occur in the ParseTools.subCompileExpression method in MVEL 2.5.0.Final because of many Java class lookups. NOTE: the vendor disputes this because "the only thing that you could expect is that the parser will take a crazy amount of time to complete its task."...
PT-2023-31756 · Mvel2 · Mvel2
Name of the Vulnerable Software and Affected Versions: mvel2 version 2.5.0 Final Description: A TimeOut error exists in the ParseTools.subCompileExpression method due to many Java class lookups, potentially causing a long execution time. The vendor disputes the significance of this issue, stating...
OESA-2023-1944 hsqldb1 security update
HSQLdb is a relational database engine written in JavaTM , with a JDBC driver, supporting a subset of ANSI-92 SQL. It offers a small about 100k, fast database engine which offers both in memory and disk based tables. Embedded and server modes are available. Additionally, it includes tools such as...
CVE-2023-48722
Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'classname' parameter of the addresults.php resource does not validate the characters received and they are sent unfiltered to the database...
CVE-2023-48716
Student Result Management System v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The 'classid' parameter of the addclasses.php resource does not validate the characters received and they are sent unfiltered to the database...
Projectworlds Student Result Management System SQL Injection Vulnerability
Projectworlds Student Result Management System is a student result management system from Projectworlds India. A SQL injection vulnerability exists in Projectworlds Student Result Management System v1.0, which stems from the "classname" parameter of addresults.php not validating the received...
PT-2023-30921 · Unknown · Student Result Management System
Name of the Vulnerable Software and Affected Versions: Student Result Management System version 1.0 Description: The issue concerns multiple Unauthenticated SQL Injection vulnerabilities. The class name parameter of the "add students.php" resource does not validate the characters received, and th...
Projectworlds Student Result Management System SQL Injection Vulnerability
Projectworlds Student Result Management System is a student result management system from Projectworlds India. Projectworlds Student Result Management System v1.0 suffers from a SQL injection vulnerability, which stems from the fact that the "classname" parameter of addstudents.php does not...
Projectworlds Student Result Management System SQL Injection Vulnerability
Projectworlds Student Result Management System is a student result management system from Projectworlds India. A SQL injection vulnerability exists in Projectworlds Student Result Management System v1.0, which stems from the fact that the "classid" parameter of addclasses.php does not validate th...
PT-2023-30919 · Unknown · Student Result Management System
Name of the Vulnerable Software and Affected Versions: Student Result Management System version 1.0 Description: The issue concerns multiple Unauthenticated SQL Injection vulnerabilities. The class id parameter of the "add classes.php" resource does not validate the characters received, and they...
PT-2023-31444 · Unknown · School Management System
Name of the Vulnerable Software and Affected Versions: School Fees Management System version 1.0 Description: A cross-site scripting issue in the /management/class component allows attackers to execute arbitrary web scripts or HTML by injecting a crafted payload into the cname parameter...
(0Day) Voltronic Power ViewPower MonitorConsole Exposed Dangerous Method Denial-of-Service Vulnerability
This vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Voltronic Power ViewPower. Authentication is not required to exploit this vulnerability. The specific flaw exists within the MonitorConsole class. The issue results from an exposed...
PT-2023-31442 · Unknown · School Management System
Name of the Vulnerable Software and Affected Versions: School Fees Management System version 1.0 Description: A cross-site scripting XSS issue in the /management/class component allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter...
PT-2023-8155 · Voltronic Power · Voltronic Power Viewpower
Name of the Vulnerable Software and Affected Versions: Voltronic Power ViewPower versions affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower. Authentication is not required to exploit thi...
PT-2023-32789 · Kodbox · Kodbox
Name of the Vulnerable Software and Affected Versions: kalcaddle kodbox versions up to 1.48 Description: A critical issue has been found, affecting the function check of the file plugins/officeViewer/controller/libreOffice/index.class.php. The manipulation of the soffice argument leads to command...
PT-2023-32771 · Sourcecodester · Sourcecodester Simple Student Attendance System
Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Student Attendance System version 1.0 Description: A critical issue has been found in the save attendance function of the actions.class.php file. The manipulation of the sid argument leads to SQL injection...
Microsoft Windows USB Mass Storage Class Driver Security Vulnerability
Microsoft Windows is a suite of operating systems used by Microsoft Corporation USA for personal devices. A security vulnerability exists in the Microsoft Windows USB Mass Storage Class Driver. An attacker could exploit the vulnerability to remotely execute code. The following products and editio...
CVE-2023-6658
A vulnerability classified as critical was found in SourceCodester Simple Student Attendance System 1.0. This vulnerability affects unknown code of the file ajax-api.php?action=saveattendance. The manipulation of the argument classid leads to sql injection. The exploit has been disclosed to the...
PHPEMS code-related vulnerabilities
PHPEMS is a PHP online mock exam system. PHPEMS suffers from a deserialization vulnerability that stems from unsafe deserialization processing of lib/session.cls.php when receiving serialized data submitted by a user, which can be exploited by an attacker to cause code execution...
