PT-2024-37622 · Devika · Devika

Name of the Vulnerable Software and Affected Versions: devika versions prior to the fixed version Description: The issue allows an attacker to read arbitrary files on the system by providing a crafted path. This can be exploited by sending a request to the application with a malicious snapshot pa...

PT-2024-37779

Name of the Vulnerable Software and Affected Versions itsourcecode Gym Management System version 1.0 Description A critical issue has been found in the itsourcecode Gym Management System, affecting the file manage member.php. The manipulation of the id argument leads to SQL injection. This issue...

PT-2024-28298 · Vaethink · Vaethink

Name of the Vulnerable Software and Affected Versions: vaeThink version 1.0.2 Description: The issue is related to stored Cross Site Scripting XSS in the system backend. This means that an attacker can inject malicious scripts into the system, which can then be executed by other users, potentiall...

PT-2024-27653 · Zealousweb · Zealousweb Generate Pdf Using Contact Form 7

Name of the Vulnerable Software and Affected Versions: ZealousWeb Generate PDF using Contact Form 7 versions 4.0.6 and earlier Description: The issue is related to an Unrestricted Upload of File with Dangerous Type, which affects ZealousWeb Generate PDF using Contact Form 7. Recommendations: For...

CVE-2024-37145

Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the /api/v1/chatflows-streaming/id endpoint. If the default configuration is used unauthenticated, an attacker may be able...

CVE-2024-37145 GHSL-2023-247: Flowise xss in /api/v1/chatflows-streaming/id

Flowise is a drag & drop user interface to build a customized large language model flow. In version 1.4.3 of Flowise, a reflected cross-site scripting vulnerability occurs in the /api/v1/chatflows-streaming/id endpoint. If the default configuration is used unauthenticated, an attacker may be able...

CVE-2024-36423

Flowise 1.4.3 has a reflected cross-site scripting (XSS) vulnerability in the endpoint /api/v1/public-chatflows/id. When configured unauthenticated, an attacker can craft a URL that injects JavaScript into user sessions, potentially stealing information, creating false popups, or redirecting user...

PT-2024-37577 · Unknown · Sourcecodester Online Food Ordering System

Name of the Vulnerable Software and Affected Versions: itsourcecode Online Food Ordering System version 1.0 Description: A critical issue has been found in the itsourcecode Online Food Ordering System, affecting the file /addproduct.php. The manipulation of the photo argument leads to unrestricte...

PT-2024-37354

Name of the Vulnerable Software and Affected Versions: Phloc Webscopes version 7.0.0 Description: An information disclosure issue allows local attackers with access to the log files to view logged HTTP requests that contain user passwords or other sensitive information. Recommendations: For Phloc...

PT-2024-25209 · H3C · H3C Seasql Dws

Name of the Vulnerable Software and Affected Versions: H3C SeaSQL DWS version 2.0 Description: The issue allows a remote attacker to execute arbitrary code via a crafted file. This is a result of a SQL Injection vulnerability in the H3C SeaSQL DWS product. Recommendations: For H3C SeaSQL DWS...

PT-2024-4675 · Huawei · Huawei Ws7206-10 +3

Name of the Vulnerable Software and Affected Versions: Huawei home routers affected versions not specified Huawei TC7001-10, WS7200-10, and WS7206-10 affected versions not specified Description: The issue is related to a connection hijacking vulnerability in some Huawei home routers. This...

PT-2024-37291 · Unknown · Itsourcecode Online House Rental System

Name of the Vulnerable Software and Affected Versions: itsourcecode Online House Rental System version 1.0 Description: A critical issue has been found in the itsourcecode Online House Rental System, affecting an unknown function of the file manage user.php. The manipulation of the id argument...

document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injection

Impact What kind of vulnerability is it? Who is impacted? A remote code execution RCE via server-side template injection SSTI allows for user supplied code to be executed in the server's context where it is executed as the document-merge-server user with the UID 901 thus giving an attacker...

PT-2024-4270

Name of the Vulnerable Software and Affected Versions Microsoft Streaming Service affected versions not specified Windows affected versions not specified Description The issue is related to a use-after-free vulnerability in the Microsoft Streaming Service of Windows operating systems, which can...

PT-2024-37140 · Unknown · Sourcecodester Stock Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Stock Management System version 1.0 Description: A critical vulnerability has been found in the SourceCodester Stock Management System, affecting an unknown functionality of the file index.php of the component Login. The...

PT-2024-27066 · Idccms · Idccms

Name of the Vulnerable Software and Affected Versions: idccms version 1.35 Description: The issue is related to a Cross-Site Request Forgery CSRF that was discovered in idccms. This CSRF is accessible via the "admin/vpsCompany deal.php?mudi=del" endpoint. Recommendations: For idccms version 1.35,...

PT-2024-26498 · Zkteco · Zkbio Cvsecurity

Name of the Vulnerable Software and Affected Versions: ZKTeco ZKBio CVSecurity version 6.1.1 Description: The issue concerns a Directory Traversal vulnerability via the eventRecord. Recommendations: For ZKTeco ZKBio CVSecurity version 6.1.1, consider restricting access to the eventRecord to...

PT-2024-36487 · Unknown · Itsourcecode Online Blood Bank Management System

Name of the Vulnerable Software and Affected Versions: itsourcecode Online Blood Bank Management System version 1.0 Description: A critical issue was found in the itsourcecode Online Blood Bank Management System, affecting an unknown functionality of the file massage.php. The manipulation of the...

PT-2024-3879 · Automationdirect · Automationdirect P3-550E

Name of the Vulnerable Software and Affected Versions: AutomationDirect P3-550E version 1.2.10.9 Description: Several out-of-bounds write vulnerabilities exist in the Programming Software Connection FileSystem API functionality. Specially crafted network packets can lead to heap-based memory...

PT-2024-26557 · Tenda · Tenda Ax1806

Name of the Vulnerable Software and Affected Versions: Tenda AX1806 version 1.0.0.1 Description: The issue is related to a stack overflow that can occur via the adv.iptv.stbpvid parameter in the formSetIptv function. Recommendations: For Tenda AX1806 version 1.0.0.1, as a temporary workaround,...