23 matches found
EUVD-2026-91118
infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/...
CVE-2026-51892
infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/...
CVE-2026-51892
infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/...
CVE-2026-51892
The software infiniflow ragflow version 0.24.0 is vulnerable to Incorrect Access Control via the /v1/document/get/ endpoint. This flaw allows for unauthorized access to documents. The vulnerability is associated with CWE-284 (Improper Access Control). While the CVSS v3.1 score indicates a Medium ...
CVE-2026-51892
infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/...
CVE-2026-85402
A vulnerability was detected in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient/booking.php. The manipulation of the argument docid results in sql injection. The attack may be launched remotely. The exploit is now public and may be used...
EUVD-2026-70873
A vulnerability was detected in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient/booking.php. The manipulation of the argument docid results in sql injection. The attack may be launched remotely. The exploit is now public and may be used...
CVE-2026-85402 code-projects Doctor Appointment System booking.php sql injection
A vulnerability was detected in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient/booking.php. The manipulation of the argument docid results in sql injection. The attack may be launched remotely. The exploit is now public and may be used...
CVE-2026-85402
A SQL injection vulnerability exists in the code-projects Doctor Appointment System 1.0 , specifically in the file /patient/booking.php . The root cause is the unsanitized manipulation of the doc_id argument, allowing a remote attacker to inject SQL commands without requiring authentication or us...
CVE-2026-85402 code-projects Doctor Appointment System booking.php sql injection
A vulnerability was detected in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient/booking.php. The manipulation of the argument docid results in sql injection. The attack may be launched remotely. The exploit is now public and may be used...
CVE-2026-85402: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability was detected in code-projects Doctor Appointment System 1.0. This vulnerability affects unknown code of the file /patient/booking.php. The manipulation of the argument docid results in sql injection. The attack may be launched remotely. The exploit is now public and may be used...
CVE-2026-25927: Authorization Bypass Through User-Controlled Key
OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the DICOM viewer state API e.g. upload or state save/load accepts a document ID docid without verifying that the document belongs to the current user’s authorized patie...
CVE-2025-4034: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical was found in projectworlds Online Examination System 1.0. Affected by this vulnerability is an unknown functionality of the file /inserdocprocess.php. The manipulation of the argument DocID leads to sql injection. The attack can be launched remotely. The...
CVE-2019-3964
In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the docid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...
Cross site scripting
In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the docid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...
CVE-2019-3964
In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the docid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...
CVE-2019-3964
OpenEMR 5.0.1 and earlier are affected by a reflected XSS in controller.php, triggered via the doc_id parameter. The Red Hat, CNVD, CVE, NVD and OSV entries corroborate that this allows an attacker to execute arbitrary code in the context of a user session. Concrete exploit details, affected subv...
CVE-2019-3964: Improper Neutralization of Input During Web Page Generation
In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the docid parameter. This could allow an attacker to execute arbitrary code in the context of a user's session...