231584 matches found
Command injection
OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent attacker with an administrative privilege to execute arbitrary OS commands by sending a specially crafted request to the product. Affected products and versions are as follows: WRC-1167GS2-B v1.67 and...
Information disclosure
An issue in uverif v.2.0 allows a remote attacker to obtain sensitive information...
Sql injection
SQL Injection vulnerability in SEMCMS v.4.8 allows a remote attacker to execute arbitrary code and obtain sensitive information via the SEMCMSMenu.php component...
CVE-2024-23910
CVE-2024-23910 describes a CSRF vulnerability in ELECOM wireless LAN routers and repeaters, allowing remote unauthenticated attackers to hijack administrator sessions and perform unintended operations. Affected products include models such as WMC-X1800GST-B and WSC-X1800GS-B (also part of the e-M...
CVE-2024-21798
The CVE-2024-21798 issue affects ELECOM wireless LAN routers and repeater families. A cross-site scripting (XSS) vulnerability can be triggered when a malicious administrative user configures crafted content; when another admin logs in and operates the device, an arbitrary script may execute in t...
Design/Logic Flaw
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 247632...
Design/Logic Flaw
IBM Security Guardium Key Lifecycle Manager 3.0, 3.0.1, 4.0, 4.1, and 4.1.1 allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 247621...
Sql injection
SQL Injection vulnerability in /zms/admin/changeimage.php in PHPGurukul Zoo Management System 1.0 allows attackers to run arbitrary SQL commands via the editid parameter...
Unrestricted file upload
An Unrestricted File Upload vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary code via upload of a crafted php file in the settings.php component...
Sql injection
SQL Injection vulnerability in /zms/admin/edit-ticket.php in PHPGurukul Zoo Management System 1.0 via tickettype and tprice parameters...
Cross site scripting
A vulnerability was found in SourceCodester Online Job Portal 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /Employer/EditProfile.php. The manipulation of the argument Address leads to cross site scripting. The attack may be launched remotely...
CVE-2023-25925
CVE-2023-25925 affects IBM Security Guardium Key Lifecycle Manager (GKLM) across multiple releases (3.0, 3.0.1, 4.0, 4.1, 4.1.1). A remote authenticated attacker can execute arbitrary commands on the system by sending a specially crafted request, as documented by IBM and Red Hat in their vendor a...
CVE-2023-25922
Summary of CVE-2023-25922 (IBM Security Guardium Key Lifecycle Manager): This vulnerability affects GKLM versions 3.0, 3.0.1, 4.0, 4.1, and 4.1.1, where an attacker can upload or transfer files of dangerous types that can be automatically processed within the product’s environment. The IBM bullet...
CVE-2024-1971
CVE-2024-1971 affects Surya2Developer Online Shopping System 1.0. The vulnerability is a SQL injection in the POST Parameter Handler’s file login.php, triggered by manipulating the password parameter (example payload: nochizplz'+or+1%3d1+limit+1%23). The attack can be launched remotely, and publi...
CVE-2024-1970
CVE-2024-1970 affects SourceCodester Online Learning System V2.1.0 (and V2.0 in various records) with a cross-site scripting vulnerability in an unknown function of /index.php. The issue arises from manipulation of the page parameter, enabling remote exploitation and providing the attacker with a...
Cross site scripting
YARD is a Ruby Documentation tool. The "frames.html" file within the Yard Doc's generated documentation is vulnerable to Cross-Site Scripting XSS attacks due to inadequate sanitization of user input within the JavaScript segment of the "frames.erb" template file. This vulnerability is fixed in...
CVE-2024-27285
CVE-2024-27285 affects YARD, a Ruby documentation generator. The vulnerability lies in the generated frames.html, where inadequate sanitization in the JavaScript of the frames.erb template allowed Cross-Site Scripting (XSS). Public advisories (Debian, Fedora, Ubuntu, NVD) attribute the issue to Y...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in Ecwid Ecommerce Ecwid Ecommerce Shopping Cart.This issue affects Ecwid Ecommerce Shopping Cart: from n/a through 6.12.4...