Code-Projects Point of Sales and Inventory Management System 注入漏洞

Code-Projects Point of Sales and Inventory Management System is an open source point of sale and inventory management system from Code-Projects. An injection vulnerability exists in Code-Projects Point of Sales and Inventory Management System version 1.0, which originates from an SQL injection...

CVE-2024-56137

CVE-2024-56137 affects MaxKB (open source knowledge-base Q&A with LLM and RAG). Prior to version 1.9.0, a remote command execution vulnerability exists in the function library module, allowing privileged users to execute OS commands within custom scripts. The issue has been fixed in v1.9.0. Curre...

CVE-2024-56137 MaxKB RCE vulnerability in function library

MaxKB, which stands for Max Knowledge Base, is an open source knowledge base question-answering system based on a large language model and retrieval-augmented generation RAG. Prior to version 1.9.0, a remote command execution vulnerability exists in the module of function library. The vulnerabili...

Narayana 安全漏洞

Narayana is an open source transaction toolkit from JBossTM. A security vulnerability exists in Narayana that stems from the LRA Coordinator component causing the application to crash or hang indefinitely, resulting in a denial of service...

PT-2026-29081

Name of the Vulnerable Software and Affected Versions OpenSC versions prior to 0.27.0 Description OpenSC is an open source smart card tools and middleware. Prior to version 0.27.0, providing a crafted input to the fuzz pkcs15 reader harness results in an out-of-bounds heap read within the...

PT-2026-29080

Name of the Vulnerable Software and Affected Versions OpenSC versions prior to 0.27.0 Description OpenSC is a set of open source smart card tools and middleware. A stack-based buffer overflow can occur in the GET RESPONSE function when a user or administrator utilizes a token, allowing an attacke...

Code-Projects Job Recruitment 注入漏洞

Code-Projects Job Recruitment is an open source job portal from Code-Projects. An injection vulnerability exists in Code-Projects Job Recruitment version 1.0, which stems from an incorrect manipulation of the parameter person that can lead to SQL injection...

Ghostty 代码注入漏洞

Ghostty is a fast, native, feature-rich terminal emulator from the Ghostty open source. A code injection vulnerability exists in Ghostty version 1.0.0. An attacker can exploit this vulnerability to execute arbitrary commands...

CVE-2024-56800

Firecrawl is a web scraper that allows users to extract the content of a webpage for a large language model. Versions prior to 1.1.1 contain a server-side request forgery SSRF vulnerability. The scraping engine could be exploited by crafting a malicious site that redirects to a local IP address...

CVE-2024-56800 Firecrawl has SSRF Vulnerability via malicious scrape target

Firecrawl is a web scraper that allows users to extract the content of a webpage for a large language model. Versions prior to 1.1.1 contain a server-side request forgery SSRF vulnerability. The scraping engine could be exploited by crafting a malicious site that redirects to a local IP address...

CVE-2024-56800 Firecrawl has SSRF Vulnerability via malicious scrape target

Firecrawl is a web scraper that allows users to extract the content of a webpage for a large language model. Versions prior to 1.1.1 contain a server-side request forgery SSRF vulnerability. The scraping engine could be exploited by crafting a malicious site that redirects to a local IP address...

CVE-2024-56800

CVE-2024-56800 – Firecrawl SSRF vulnerability : Firecrawl (OSS) before v1.1.1 is affected by a server-side request forgery that can be triggered by a malicious scrape target redirecting to a local IP, enabling exfiltration of local network resources via the API. The cloud service was patched on 2...

TeamPass 安全漏洞

TeamPass is an open source password manager from the individual developer Nils Laumaillé. A security vulnerability exists in versions prior to TeamPass 3.1.3.1, which stems from an inability to properly prevent users from acting with different userid privileges...

Tecnick TCExam SQL注入漏洞

Tecnick TCExam is a Web-based open source e-exam system from Tecnick UK. The system is mainly used for online exams, etc. Element is a Matrix web collaboration client of Element open source. Tecnick TCExam suffers from a SQL injection vulnerability that stems from the improper neutralization of...

Tecnick TCExam 跨站脚本漏洞

Tecnick TCExam is a Web-based open source e-exam system from the UK company Tecnick. The system is mainly used for online exams and so on. Tecnick TCExam suffers from a cross-site scripting vulnerability that originates from improper input neutralization during web page generation, resulting in a...

1000 Projects Portfolio Management System MCA 注入漏洞

1000 Projects Portfolio Management System MCA is an open source portfolio management system from 1000 Projects. An injection vulnerability exists in 1000 Projects Portfolio Management System MCA version 1.0, which originates from an SQL injection vulnerability contained in the eid parameter of th...

1000 Projects Attendance Tracking Management System 注入漏洞

1000 Projects Attendance Tracking Management System is an open source attendance management system from 1000 Projects. An injection vulnerability exists in version 1.0 of 1000 Projects Attendance Tracking Management System, which originates from an SQL injection vulnerability in the attendanceid...

编号撤回

The Linux kernel is the kernel used by the Linux Foundation's open source operating system Linux in the United States. This CVE number has been withdrawn...

Ruifang-tech Rebuild 代码注入漏洞

Ruifang-tech Rebuild is a zero-code, open-source and free enterprise management system from China Ruifang Ruifang-tech. A code injection vulnerability exists in Ruifang-tech Rebuild version 3.8.6, which stems from a misuse of the parameter description that can lead to cross-site scripting...

CVE-2024-56509 changedetection.io has Improper Input Validation Leading to LFR/Path Traversal

changedetection.io is a free open source web page change detection, website watcher, restock monitor and notification service. Improper input validation in the application can allow attackers to perform local file read LFR or path traversal attacks. These vulnerabilities occur when user input is...