CVE-2024-42571: Improper Neutralization of Special Elements used in an SQL Command

School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at insertattendance.php...

CVE-2024-42570: Improper Neutralization of Special Elements used in an SQL Command

School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at admininsert.php...

CVE-2024-42569: Improper Neutralization of Special Elements used in an SQL Command

School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at paidclass.php...

CVE-2024-42571

The School Management System (specifically commit bae5aa ) contains a SQL injection vulnerability. The flaw exists in the medium parameter at the insertattendance.php endpoint. Exploitation of this vulnerability could lead to unauthorized database access or manipulation. No specific fix or newer ...

CVE-2024-42575

CVE-2024-42575 affects School Management System. A SQL injection flaw is present in the substaff.php endpoint, exploitable via the medium parameter. CVSS v3.1 metrics indicate a Base Score of 9.8 (CRITICAL) with Network attack vector, Low attack complexity, no privileges required, no user interac...

CVE-2024-42575: Improper Neutralization of Special Elements used in an SQL Command

School Management System commit bae5aa was discovered to contain a SQL injection vulnerability via the medium parameter at substaff.php...

BIT-PYTHON-2024-6923 Email header injection due to unquoted newlines

There is a MEDIUM severity vulnerability affecting CPython. The email module didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized...

Ewon Cosy+ Hardcoded Key

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Advisory ID: SYSS-2024-032 Product: Ewon Cosy+ Manufacturer: HMS Industrial Networks AB Affected Versions: Firmware Versions: 21.2s10 and 22.1s3 Tested Versions: Firmware Version: 21.2s7 Vulnerability Type: Use of Hard-coded Cryptographic Key CWE-32...

WordPress ARMember Plugin <= 4.0.37 is vulnerable to Cross Site Scripting (XSS)

Software ARMember Type Plugin Vulnerable versions = 4.0.37 Fixed in 4.0.38 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-7703 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID ae57ddd8d872 Credits wesley wcraft Required...

WordPress Skitter Slideshow Plugin <= 2.5.2 is vulnerable to Server Side Request Forgery (SSRF)

Software Skitter Slideshow Type Plugin Vulnerable versions = 2.5.2 Fixed in N/A OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2022-1751 Patch priority Medium CVSS severity Medium 7.2 Developer Claim ownership PSID 248ddea6bcba Credits Bartu Utku SARP Required...

WordPress SmartSearch WP Plugin <= 2.4.4 is vulnerable to Cross Site Scripting (XSS)

Software SmartSearch WP Type Plugin Vulnerable versions = 2.4.4 Fixed in 2.4.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-6843 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 29f289a57217 Credits Karolis Narvilas...

WordPress Admission AppManager Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Admission AppManager Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-4507 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 138041d75b79 Credits zulu caPWN...

ffmpeg:ffmpeg_AV_CODEC_ID_NOTCHLC_fuzzer: Use-of-uninitialized-value in decode_frame

Project: https://git.ffmpeg.org/ffmpeg.git Detailed Report: https://oss-fuzz.com/testcase?key=4624502095413248 Project: ffmpeg Fuzzing Engine: libFuzzer Fuzz Target: ffmpegAVCODECIDNOTCHLCfuzzer Job Type: libfuzzermsanffmpeg Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address:...

libjpeg-turbo:compress12_fuzzer: Use-of-uninitialized-value in encode_mcu_AC_first

Detailed Report: https://oss-fuzz.com/testcase?key=5071676943958016 Project: libjpeg-turbo Fuzzing Engine: libFuzzer Fuzz Target: compress12fuzzer Job Type: libfuzzermsanlibjpeg-turbo Platform Id: linux Crash Type: Use-of-uninitialized-value Crash Address: Crash State: encodemcuACfirst...

libyang:lys_parse_mem: Crash in lysc_update_path

Detailed Report: https://oss-fuzz.com/testcase?key=5084602044055552 Project: libyang Fuzzing Engine: centipede Fuzz Target: lysparsemem Job Type: centipedeasanlibyang Platform Id: linux Crash Type: UNKNOWN READ Crash Address: 0x7b61c387a0cf Crash State: lyscupdatepath lyscompilenode lyscompile...

WordPress White Label CMS Plugin <= 2.7.4 is vulnerable to Cross Site Scripting (XSS)

Software White Label CMS Type Plugin Vulnerable versions = 2.7.4 Fixed in 2.7.5 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43303 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c731ad649acb Credits Rafie Muhammad Patchstack Requir...

WordPress Invite Anyone Plugin <= 1.4.7 is vulnerable to Cross Site Scripting (XSS)

Software Invite Anyone Type Plugin Vulnerable versions = 1.4.7 Fixed in 1.4.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43327 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e990de812727 Credits Dimas Maulana Required privilege...

WordPress Hello Agency Theme <= 1.0.5 is vulnerable to Broken Access Control

Software Hello Agency Type Theme Vulnerable versions = 1.0.5 Fixed in 1.0.6 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43341 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID dad92fd9c880 Credits Fariq Fadillah Gusti Insani...

WordPress Print Barcode Labels for your WooCommerce products/orders Plugin <= 3.4.9 is vulnerable to Broken Access Control

Software Print Barcode Labels for your WooCommerce products/orders Type Plugin Vulnerable versions = 3.4.9 Fixed in 3.4.10 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-43310 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID...

WordPress Purity Of Soul Theme <= 1.9 is vulnerable to Cross Site Scripting (XSS)

Software Purity Of Soul Type Theme Vulnerable versions = 1.9 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43348 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2e3680e055fd Credits justakazh Required privilege...