CVE-2024-52294 khoj has an IDOR in subscription management that allows unauthorized subscription modifications

Khoj is a self-hostable artificial intelligence app. Prior to version 1.29.10, an Insecure Direct Object Reference IDOR vulnerability in the updatesubscription endpoint allows any authenticated user to manipulate other users' Stripe subscriptions by simply modifying the email parameter in the...

khoj has an IDOR in subscription management allows unauthorized subscription modifications

Summary An Insecure Direct Object Reference IDOR vulnerability in the updatesubscription endpoint allows any authenticated user to manipulate other users' Stripe subscriptions by simply modifying the email parameter in the request. Details The vulnerability exists in the subscription endpoint at...

Simple Chat System 安全漏洞

Simple Chat System is a simple chat system by the individual developer nurhodelta17. A security vulnerability exists in Simple Chat System version 1.0, which stems from an incorrect manipulation of the parameters name/email/password/number that can lead to SQL injection...

PT-2024-17839 · Unknown · Phpgurukul Complaint Management System

Name of the Vulnerable Software and Affected Versions: PHPGurukul Complaint Management System version 1.0 Description: A critical issue has been found in the PHPGurukul Complaint Management System. This issue affects an unknown part of the /admin/state.php file. The manipulation of the state...

1000 Projects Portfolio Management System MCA 安全漏洞

1000 Projects Portfolio Management System MCA is an open source portfolio management system from 1000 Projects. A security vulnerability exists in 1000 Projects Portfolio Management System MCA version 1.0, which stems from an incorrect manipulation of the parameter profile that can lead to...

1000 Projects Portfolio Management System MCA 安全漏洞

1000 Projects Portfolio Management System MCA is an open source portfolio management system from 1000 Projects. A security vulnerability exists in 1000 Projects Portfolio Management System MCA version 1.0, which stems from an incorrect manipulation of the parameter profile that can lead to...

CVE-2024-7875

CVE-2024-7875 affects Tungsten Automation (Kofax) TotalAgility up to version 7.9.0.25.0.954. The vulnerability is a Reflected XSS in the ScanFront.aspx endpoints where mfpScreenResolutionWidth is manipulated via POST data. An attacker can inject JavaScript code, leading to information disclosure,...

CVE-2024-7875 XSS in Tungsten Automation TotalAgility

Tungsten Automation Kofax TotalAgility in versions all through 7.9.0.25.0.954 is vulnerable to a Reflected XSS attacks through mfpScreenResolutionWidth parameter manipulation in a form sent to an endpoint /TotalAgility/Kofax/BrowserDevice/ScanFront.aspx This allows for injection of a malicious...

CVE-2024-7874 XSS in Tungsten Automation TotalAgility

Tungsten Automation Kofax TotalAgility in versions all through 7.9.0.25.0.954 is vulnerable to a Reflected XSS attacks through mfpConnectionId parameter manipulation in a form sent to endpoints "/TotalAgility/Kofax/BrowserDevice/ScanFront.aspx"...

PHPGurukul Complaint Management System 注入漏洞

Complaint Management System is a complaint management system. Complaint Management System suffers from a SQL injection vulnerability, which stems from an incorrect manipulation of the parameter search in the file /admin/complaint-search.php that can lead to SQL injection. No details of the...

CodeAstro Hospital Management System 安全漏洞

CodeAstro Hospital Management System is a hospital management system from CodeAstro, Inc. A security vulnerability exists in CodeAstro Hospital Management System version 1.0 that stems from incorrect manipulation of the parameters eqpcode, eqpname, eqpvendor, eqpdesc, eqpdept, eqpstatus, and eqpq...

CVE-2024-11660 code-projects Farmacia usuario.php cross site scripting

A vulnerability was found in code-projects Farmacia 1.0. It has been classified as problematic. This affects an unknown part of the file usuario.php. The manipulation of the argument name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed...

CVE-2024-11660

CVE-2024-11660 affects code-projects Farmacia (version 1.0). The vulnerability resides in the file usuario.php, where manipulation of the name argument leads to cross-site scripting (XSS). It can be triggered remotely and exploitation has been disclosed publicly; other parameters may also be affe...

CVE-2024-45876

The login form of baltic-it TOPqw Webportal v1.35.283.2 fixed in version 1.35.283.4 at /Apps/TOPqw/Login.aspx is vulnerable to SQL injection. The vulnerability exists in the POST parameter txtUsername, which allows for manipulation of SQL queries...

CVE-2024-45876

The login form of baltic-it TOPqw Webportal v1.35.283.2 fixed in version 1.35.283.4 at /Apps/TOPqw/Login.aspx is vulnerable to SQL injection. The vulnerability exists in the POST parameter txtUsername, which allows for manipulation of SQL queries...

CVE-2024-10987

A vulnerability was found in code-projects E-Health Care System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /Doctor/userappointment.php. The manipulation of the argument scheduleid/scheduledate/scheduleday/starttime/endtime/booking...

PT-2024-34702 · Wave · Wave

Name of the Vulnerable Software and Affected Versions: Wave version 2.0 Description: This issue is caused by improper or missing authorization checks on certain API endpoints. An authenticated remote attacker could exploit this by manipulating API input parameters to gain unauthorized access and...

CVE-2024-49359 ZimaOS vulnerable to Directory Listing via Parameter Manipulation

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint http:///v21/file in ZimaOS is vulnerable to a directory traversal attack, allowing authenticated users to list the contents of any directory on...

CVE-2024-49359 ZimaOS vulnerable to Directory Listing via Parameter Manipulation

ZimaOS is a fork of CasaOS, an operating system for Zima devices and x86-64 systems with UEFI. In version 1.2.4 and all prior versions, the API endpoint http:///v21/file in ZimaOS is vulnerable to a directory traversal attack, allowing authenticated users to list the contents of any directory on...

CVE-2024-10024

A vulnerability, which was classified as critical, has been found in code-projects Pharmacy Management System 1.0. This issue affects some unknown processing of the file /php/managemedicinestock.php. The manipulation of the argument name/packing/genericname/suppliersname leads to sql injection. T...