CVE-2023-1826 SourceCodester Online Computer and Laptop Store index.php unrestricted upload

A vulnerability, which was classified as critical, was found in SourceCodester Online Computer and Laptop Store 1.0. This affects an unknown part of the file php-ocls\admin\systeminfo\index.php. The manipulation of the argument img leads to unrestricted upload. It is possible to initiate the atta...

CVE-2023-1826

CVE-2023-1826 concerns SourceCodester Online Computer and Laptop Store 1.0. The vulnerability affects an unknown portion of php-ocls\admin\system_info\index.php where the attacker can manipulate the non-sanitized img parameter to upload arbitrary files, enabling remote code execution. Public writ...

PT-2023-17265 · Unknown · Sourcecodester Online Computer/Laptop Store

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Computer and Laptop Store version 1.0 Description: A critical vulnerability was found in the software, affecting an unknown part of the file php-oclsadminsystem infoindex.php. The manipulation of the img argument leads t...

Online Computer and Laptop Store 代码问题漏洞

Online Computer and Laptop Store is an online computer and laptop store from Carlo Montero's personal developer. Online Computer and Laptop Store v1.0 is vulnerable to arbitrary file uploads. The vulnerability stems from a lack of validation of uploaded files in the...

CVE-2023-1124

CVE-2023-1124 affects the Shopping Cart & eCommerce Store WordPress plugin (versions before 5.4.3). The vulnerability arises from not validating HTTP requests, allowing authenticated administrators to perform Local File Inclusion (LFI) attacks. Impact is high for confidentiality, integrity, and a...

CVE-2023-1124 Shopping Cart & eCommerce Store < 5.4.3 - Admin+ LFI

The Shopping Cart & eCommerce Store WordPress plugin before 5.4.3 does not validate HTTP requests, allowing authenticated users with admin privileges to perform LFI attacks...

WordPress plugin Shopping Cart & eCommerce Store 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A path traversal vulnerability exists in th...

Fedora 38 : dino (2023-ea6b94395f)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-ea6b94395f advisory. Maintenance release with fix for CVE-2023-28686 and bug fixes. Tenable has extracted the preceding description block directly from the Fedora security...

ASB-A-237766679

In startInstrumentation of ActivityManagerService.java, there is a possible way to keep the foreground service alive while the app is in the background. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

DEBIAN-CVE-2023-28862

An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the AuthBasic handler and incorrect failure handling during a password check allow attackers to bypass 2FA verification. Any plugin that tries to deny session creation after the store step does not deny an...

UBUNTU-CVE-2023-28862

An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the AuthBasic handler and incorrect failure handling during a password check allow attackers to bypass 2FA verification. Any plugin that tries to deny session creation after the store step does not deny an...

MGASA-2023-0122 Updated dino packages fix security vulnerability

When a Dino client receives a specifically crafted message from an unauthorized sender, it would use information from that message to add, update or remove entries in the user’s personal bookmark store without requiring further user interaction. CVE-2023-28686...

Fedora: Security Advisory for redis (FEDORA-2023-86068d1187)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Information Disclosure

dino is vulnerable to Information Disclosure. The attacker can modify the personal bookmark store, change the display of group chats, or force a victim to join a group chat, which can lead to the victim disclosing sensitive information...

Book Store Management System 1.0.0 Cross Site Scripting

Exploit Title: Book Store Management System 1.0.0 - Stored Cross-Site Scripting XSS Date: 2022-11-08 Exploit Author: Rajeshwar Singh Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/bsmsci.zip Tested on:...

Helmet Store Showroom v1.0 - SQL Injection Vulnerability

Exploit Title: Helmet Store Showroom v1.0 - SQL Injection Exploit Author: Ameer Hamza Vendor Homepage: https://www.sourcecodester.com/php/15851/helmet-store-showroom-site-php-and-mysql-free-source-code.html Software Link:...

Helmet Store Showroom v1.0 - SQL Injection

Exploit Title: Helmet Store Showroom v1.0 - SQL Injection Exploit Author: Ameer Hamza Date: November 15, 2022 Vendor Homepage: https://www.sourcecodester.com/php/15851/helmet-store-showroom-site-php-and-mysql-free-source-code.html Software Link:...

Book Store Management System 1.0.0 - Stored Cross-Site Scripting (XSS)

Exploit Title: Book Store Management System 1.0.0 - Stored Cross-Site Scripting XSS Date: 2022-11-08 Exploit Author: Rajeshwar Singh Vendor Homepage: https://www.sourcecodester.com/ Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/bsmsci.zip Tested on:...

CVE-2022-3683

A vulnerability exists in the SDM600 API web services authorization validation implementation. An attacker who successfully exploits the vulnerability could read data directly from a data store that is not restricted, or insufficiently protected, having access to sensitive data. This issue...

CVE-2022-3683 SDM600 API web services authorization validation

A vulnerability exists in the SDM600 API web services authorization validation implementation. An attacker who successfully exploits the vulnerability could read data directly from a data store that is not restricted, or insufficiently protected, having access to sensitive data. This issue...