231583 matches found
CVE-2024-1771
CVE-2024-1771 affects the WordPress Total theme up to version 2.1.59. Root cause: missing capability check in total_order_sections(), enabling authenticated users with subscriber+ access to modify homepage sections. Impact: unauthorized modification of data on the homepage. Mitigation: upgrade to...
Cross site scripting
A cross-site scripting XSS vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the address parameter at /customersupport/index.php?page=newcustomer...
Cross site scripting
A cross-site scripting XSS vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the email parameter at /customersupport/index.php?page=customerlist...
Cross site scripting
A cross-site scripting XSS vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the contact parameter at /customersupport/index.php?page=customerlist...
Sql injection
Sourcecodester Lost and Found Information System's Version 1.0 is vulnerable to unauthenticated SQL Injection at "?page=items/view&id="...
Improper access control
Multilaser RE160 v5.07.51ptMTL01 and v5.07.52ptMTL01, Multilaser RE160V v12.03.01.08pt and V12.03.01.09pt, and Multilaser RE163V v12.03.01.08pt allows attackers to bypass the access control and gain complete access to the application via supplying a crafted URL...
CVE-2023-49984
The CVE-2023-49984 entry affects School Fees Management System v1.0, with an XSS vulnerability in the /management/settings component. The issue allows attackers to inject arbitrary web scripts or HTML via the name parameter, enabling potential script execution. The vulnerability is documented acr...
CVE-2023-38825
Summary: CVE-2023-38825 is a SQL injection vulnerability in Vanderbilt REDCap prior to v13.8.0, exposed via the MyCapMobileApp/update.php password-reset endpoint. Affected software: Vanderbilt REDCap (pre-13.8.0). Root cause/impact: improper input handling in the password-reset path allows a remo...
CVE-2023-49971
CVE-2023-49971 describes a cross-site scripting (XSS) vulnerability in the Customer Support System v1, exploitable via a crafted payload injected into the firstname parameter at /customer_support/index.php?page=customer_list. Multiple connected sources (NVD, Red Hat, CNVD, CVE List, CNVD CNVD, PR...
CVE-2023-49979
CVE-2023-49979 concerns a directory listing vulnerability in the Customer Support System v1, allowing unauthenticated attackers to enumerate directories and sensitive files. The issue affects the web application’s handling of directory access (no auth required) and is described consistently acros...
CVE-2023-49980
CVE-2023-49980 applies to the Best Student Result Management System v1.0 and describes a directory listing vulnerability that allows unauthenticated attackers to enumerate directories and sensitive files. The root cause is a failure in access controls that permits directory listing; impact is lim...
CVE-2023-49977
CVE-2023-49977 is an XSS vulnerability in Customer Support System v1. A crafted payload injected into the address parameter at /customer_support/index.php?page=new_customer can cause arbitrary web scripts/HTML to execute due to insufficient input filtering/escaping. The affected software is the C...
CVE-2024-25359
CVE-2024-25359 affects zuoxingdong lagom v0.1.2. The issue allows a local attacker to execute arbitrary code via the pickle_load function in serialize.py. CVSS v3.1 metrics indicate Local attack vector, Low attack complexity, Privileges Required Low, with High confidentiality impact and Moderate ...
CVE-2023-33677
CVE-2023-33677 affects Sourcecodester Lost and Found Information System v1.0. The vulnerability is an unauthenticated SQL Injection exposed at the API endpoint ?page=items/view&id=. The root cause is improper input handling for the id parameter, allowing crafted input to influence database querie...
CVE-2023-49985
The CVE-2023-49985 entry concerns a cross-site scripting (XSS) flaw in the School Fees Management System v1.0, specifically in the /management/class component, where an attacker can inject arbitrary web scripts via the cname parameter. The Red Hat/NVD/CNNVD/PRION and related entries confirm the v...
CVE-2023-49974
CVE-2023-49974 concerns a cross-site scripting (XSS) vulnerability in the proprietary product Customer Support System v1 . The issue arises from insufficient input filtering/escaping, enabling an attacker to inject arbitrary web scripts or HTML via the crafted payload placed in the contact parame...
CVE-2024-27278
OpenPNE plugin opTimelinePlugin (version 1.2.11 and earlier) contains a stored cross-site scripting (CWE-79) vulnerability in the Edit Profile page. When a user configures their profile with malicious content, an arbitrary script may execute in other users’ browsers. Affected product: OpenPNE opT...
Design/Logic Flaw
Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for...
Cross site scripting
Cross Site Scripting vulnerability in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information via a crafted payload to the global search function...