2173 matches found
CVE-2024-40477
A SQL injection vulnerability exists in the PHPGurukul Old Age Home Management System v1.0 within the /oahms/admin/forgot-password.php endpoint. An attacker can execute arbitrary SQL commands by providing malicious input through the email parameter. The impact includes unauthorized access to the ...
PT-2024-28870 · Unknown · Phpgurukul Old Age Home Management System
Name of the Vulnerable Software and Affected Versions: PHPGurukul Old Age Home Management System version 1.0 Description: A Reflected Cross Site Scripting XSS issue was found in the "/oahms/search.php" endpoint, which allows remote attackers to execute arbitrary code via the searchdata parameter...
CVE-2024-40481
A Stored Cross Site Scripting XSS vulnerability was found in "/admin/view-enquiry.php" in PHPGurukul Old Age Home Management System v1.0, which allows remote attackers to execute arbitrary code via the Contact Us page "message" parameter...
CVE-2024-40484
A Reflected Cross Site Scripting XSS vulnerability was found in "/oahms/search.php" in PHPGurukul Old Age Home Management System v1.0, which allows remote attackers to execute arbitrary code via the "searchdata" parameter...
CVE-2024-6651
The WordPress File Upload WordPress plugin before 4.24.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
Nuxt 安全漏洞
Nuxt is a free open source framework from Nuxt Open Source. A security vulnerability exists in Nuxt versions prior to 1.3.9 that stems from a lack of authentication and vulnerability to path traversal attacks...
haproxy: untrimmed URI fragments may lead to exposure of confidential data on static servers
HAProxy before 2.8.2 accepts as part of the URI component, which might allow remote attackers to obtain sensitive information or have unspecified other impact upon misinterpretation of a pathend rule, such as routing index.html.png to a static server...
CVE-2026-57433 affecting package perl for versions less than 5.38.2-514
CVE-2026-57433 affecting package perl for versions less than 5.38.2-514. A patched version of the package is available...
CVE-2024-6072: Improper Neutralization of Input During Web Page Generation
The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...
PT-2024-37090 · WordPress · If-So Dynamic Content Personalization
Name of the Vulnerable Software and Affected Versions: If-So Dynamic Content Personalization WordPress plugin versions prior to 1.8.0.4 Description: The issue is related to Reflected Cross-Site Scripting in old web browsers due to the failure to escape the $ SERVER'REQUEST URI' parameter before...
CVE-2024-5744: Improper Neutralization of Input During Web Page Generation
The wp-eMember WordPress plugin before 10.6.7 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...
CVE-2024-5713: Improper Neutralization of Input During Web Page Generation
The If-So Dynamic Content Personalization WordPress plugin before 1.8.0.4 does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers...
PT-2024-29138 · Linux +2 · Linux Kernel +2
Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue arises on an old x86 system with SRAT covering space above 4Gb, where the NUMA configuration is no longer refused by a CONFIG NUMA=y kernel. This is due to memblock validate...
SUSE CVE-2024-39329
An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14. The django.contrib.auth.backends.ModelBackend.authenticate method allows remote attackers to enumerate users via a timing attack involving login requests for users with an unusable password...
Google Android 安全漏洞
Google Android is a Linux-based open source operating system from Google. Google Android suffers from an authentication bypass vulnerability that stems from an incorrect protocol implementation in the smpprocrand method of the smpact.cc file, which can be exploited by an attacker to potentially...
UBUNTU-CVE-2024-39472
In the Linux kernel, the following vulnerability has been resolved: xfs: fix log recovery buffer allocation for the legacy hsize fixup Commit a70f9fe52daa "xfs: detect and handle invalid iclog size set by mkfs" added a fixup for incorrect hsize values used for the initial umount record in old...
WordPress Esteem theme <= 1.5.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Michael Patchstack Alliance in WordPress Theme Esteem versions = 1.5.0...
The vulnerability of the files_versions() function in cloud-based software for creating and using Nextcloud Server allows a hacker to restore older versions of documents.
The vulnerability of the filesversions function in cloud-based software for creating and using Nextcloud Server storage involves the ability to restore older versions of documents, if the filesversions function is enabled. Exploiting this vulnerability could allow a malicious actor to restore old...
The vulnerability of the Share component in the cloud software for creating and using Nextcloud Server’s data storage system allows a attacker to compromise the integrity of the data or cause service failures.
The vulnerability of the Share component in the cloud software for creating and using Nextcloud Server storage involves the sending of requests to delete old versions of files that could only be accessed with read permissions. Exploiting this vulnerability allows a malicious actor to compromise...
