Sql injection

SQL Injection vulnerability in Employee Management System v.1.0 allows a remote attacker to execute arbitrary SQL commands via the txtfullname and txtphone parameters in the editprofile.php component...

Sql injection

SQL Injection vulnerability in delete-tracker.php in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via crafted GET request...

Unrestricted file upload

Unrestricted File Upload vulnerability in Employee Management System 1.0 allows a remote attacker to execute arbitrary code via the edit-photo.php component...

CVE-2024-1314

The connected documents describe a vulnerability in Kinto-Attachment where an existing record’s attachment can be replaced when a user has read permission on a parent collection or bucket. Impact occurs if read access exists on a parent (and can be exploited anonymously if system.Everyone has rea...

Cross site scripting

A stored cross-site scripting XSS vulnerability in the Edit Page function of Cotonti CMS v0.9.24 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload...

Design/Logic Flaw

Under certain circumstances IQ Panel4 and IQ4 Hub panel software prior to version 4.4.2 could allow unauthorized access to settings...

CVE-2024-0242

CVE-2024-0242 affects Qolsys IQ Panel 4 and IQ4 Hub prior to firmware 4.4.2. The vulnerability could allow an unauthorized actor to access panel settings under certain conditions, exposing sensitive information (impact: high for confidentiality and integrity, per CVSS 3.1). Affected products: Qol...

CVE-2024-1329

CVE-2024-1329 affects HashiCorp Nomad and Nomad Enterprise (1.5.13 up to 1.6.6, and 1.7.3) where the template renderer allows arbitrary file write on the host via symlink attacks, executable by the Nomad client user. Root cause is a symlink/templating path exposure enabling host file writes. Impa...

Design/Logic Flaw

Insecure Permissions vulnerability in Forescout SecureConnector v.11.3.06.0063 allows a local attacker to escalate privileges via the Recheck Compliance Status component...

Design/Logic Flaw

An issue in Dlink DIR-816A2 v.1.10CNB05 allows a remote attacker to execute arbitrary code via the wizardstep4ssid2 parameter in the sub42DA54 function...

Sql injection

PrestaShop Op'art Easy Redirect = 1.3.8 and = 1.3.12 is vulnerable to SQL Injection via Oparteasyredirect::hookActionDispatcher...

Sql injection

Supabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the component /pgmeta/default/query. NOTE: the vendor's position is that this is an intended feature; also, it exists in the Supabase dashboard product, not the Supabase PostgreSQL product. Specifically,...

Information disclosure

Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on MacOS, Snow Software Inventory Agent on Windows, Snow Software Inventory Agent on Linux allows File Manipulation through Snow Update Packages.This issue affects Inventory Agent: through 6.12.0;...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Audrasjb GDPR Data Request Form allows Stored XSS.This issue affects GDPR Data Request Form: from n/a through 1.6...

Design/Logic Flaw

Authentication Bypass by Spoofing vulnerability in Snow Software Snow Inventory Agent on Windows allows Signature Spoof.This issue affects Snow Inventory Agent: through 6.14.5. Customers advised to upgrade to version 7.0...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Magic Hills Pty Ltd Wonder Slider Lite allows Reflected XSS.This issue affects Wonder Slider Lite: from n/a through 13.9...

Information disclosure

Improper Verification of Cryptographic Signature vulnerability in Snow Software Inventory Agent on Unix allows File Manipulation through Snow Update Packages.This issue affects Inventory Agent: through 7.3.1...

Server side request forgery (ssrf)

xxl-job = 2.4.1 has a Server-Side Request Forgery SSRF vulnerability, which causes low-privileged users to control executor to RCE...

CVE-2024-24836

CVE-2024-24836 is a stored XSS vulnerability in the Audrasjb GDPR Data Request Form WordPress plugin, affecting versions up to 1.6. The root cause is improper input neutralization during web page generation, enabling insertion of malicious scripts that are stored and later rendered to users. Mult...

CVE-2024-1150

CVE-2024-1150 : Snow Software Inventory Agent on Unix (versions through 7.3.1) suffers from improper verification of cryptographic signatures in Snow Update Packages, enabling file manipulation via update packages. Root cause: insufficient/incorrect signature validation. Impact: integrity of upda...