markdown-it-decorate vulnerable to cross-site scripting (XSS)

markdown-it-decorate adds attributes, IDs and classes to Markdown, and the most recent version 1.2.2 was published in 2017. All versions are currently vulnerable to cross-site scripting XSS and there is no fixed version at this time...

CVE-2022-35904

An issue was discovered in Bentley MicroStation before 10.17.0.x and Bentley View before 10.17.0.x. Using an affected version of MicroStation or MicroStation-based application to open an IFC file containing crafted data can force an out-of-bounds read. Exploitation of these vulnerabilities within...

PT-2022-21310

Name of the Vulnerable Software and Affected Versions Product Show Room Site version 1.0 Description The issue is related to SQL Injection via the /psrs/classes/Master.php?f=delete product API endpoint. This allows for potential manipulation of database queries. No information is provided about t...

CVE-2022-32318: Improper Neutralization of Input During Web Page Generation

Fast Food Ordering System v1.0 was discovered to contain a persistent cross-site scripting XSS vulnerability via the component /ffos/classes/Master.php?f=savecategory...

CVE-2022-32416: Improper Neutralization of Special Elements used in an SQL Command

Product Show Room Site v1.0 is vulnerable to SQL Injection via /psrs/classes/Master.php?f=deleteproduct...

Possible RCE escalation bug with Serialized Columns in Active Record

There is a possible escalation to RCE when using YAML serialized columns in Active Record. This vulnerability has been assigned the CVE identifier CVE-2022-32224. Versions Affected: All. Not affected: None Fixed Versions: 7.0.3.1, 6.1.6.1, 6.0.5.1, 5.2.8.1 Impact ------ When serialized columns th...

manchesterdanceclasses.co.uk Cross Site Scripting vulnerability OBB-2751921

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

h2: Loading of custom classes from remote servers through JNDI

A flaw was found in the H2 Console. This flaw allows remote attackers to execute arbitrary code via a JDBC URL, concatenating with a substring that allows remote code execution by using a script...

Remote Code Execution

ldap-account-manager is vulnerable to remote code execution. An attacker is able to inject the first constructor argument leading to code execution if non-LAM classes are instantiated during object creation...

CVE-2022-32310: Incorrect Authorization

An access control issue in Ingredient Stock Management System v1.0 allows attackers to take over user accounts via a crafted POST request to /isms/classes/Users.php...

PT-2022-21674

Name of the Vulnerable Software and Affected Versions Online Railway Reservation System version 1.0 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/classes/Master.php?f=delete service" API endpoint. Recommendatio...

PT-2022-21671

Name of the Vulnerable Software and Affected Versions Online Railway Reservation System version 1.0 Description The issue is related to a SQL injection vulnerability. It can be exploited via the id parameter at the "/classes/Master.php?f=delete message" endpoint. Recommendations For Online Railwa...

CVE-2022-33059: Improper Neutralization of Special Elements used in an SQL Command

Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=deletetrain...

CVE-2022-33061: Improper Neutralization of Special Elements used in an SQL Command

Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=deleteservice...

PT-2022-21672

Name of the Vulnerable Software and Affected Versions Online Railway Reservation System version 1.0 Description The issue is related to a SQL injection vulnerability. It can be exploited via the id parameter at the "/classes/Master.php?f=delete train" endpoint. Recommendations For Online Railway...

PT-2022-21670

Name of the Vulnerable Software and Affected Versions Online Railway Reservation System version 1.0 Description A SQL injection issue was found in the Online Railway Reservation System. The vulnerability can be exploited via the id parameter at the "/classes/Master.php?f=delete reservation"...

CVE-2022-33058: Improper Neutralization of Special Elements used in an SQL Command

Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=deletemessage...

CVE-2022-33057: Improper Neutralization of Special Elements used in an SQL Command

Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=deletereservation...

PT-2022-21673

Name of the Vulnerable Software and Affected Versions Online Railway Reservation System version 1.0 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/classes/Master.php?f=delete schedule" endpoint. Recommendations...

Input validation

Pimcore is an Open Source Data & Experience Management Platform. Pimcore offers developers listing classes to make querying data easier. This listing classes also allow to order or group the results based on one or more columns which should be quoted by default. The actual issue is that quoting i...