CVE-2025-22145

Carbon is an international PHP extension for DateTime. Application passing unsanitized user input to Carbon::setLocale are at risk of arbitrary file include, if the application allows users to upload files with .php extension in an folder that allows include or require to read it, then they are a...

CVE-2024-52803 LLama Factory Remote OS Command Injection Vulnerability

LLama Factory enables fine-tuning of large language models. A critical remote OS command injection vulnerability has been identified in the LLama Factory training process. This vulnerability arises from improper handling of user input, allowing malicious actors to execute arbitrary OS commands on...

Reflected Cross-Site Scripting (Reflected XSS)

OctoPrint is vulnerable to Reflected Cross-Site Scripting Reflected XSS. The vulnerability is due to unescaped user inputs in OctoPrint’s login dialog and standalone application key confirmation dialog, allows attackers to inject malicious scripts that get reflected back to the user's browser...

Arbitrary Argument Injection

ggit is vulnerable to Arbitrary Argument Injection. The vulnerability is due to the failure to sanitize user input and improper handling of command-line flags and doesn't validate the URL scheme or properly pass arguments to the git binary using the necessary -- POSIX characters, allowing attacke...

Online Blood Bank Management System user parameter cross-site scripting vulnerability

Online Blood Bank Management System is an online blood bank management system. Online Blood Bank Management System version 1.0 suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data by parameter user, which can be...

CVE-2024-41116

CVE-2024-41116 affects streamlit-geospatial. Prior to commit c4f81d9616d40c60584e36abb15300853a66e489, the vis_params variable in pages/1_📷_Timelapse.py accepts user input and is subsequently used in eval(), enabling remote code execution. The commit cited fixes this issue. Several records (NVD, ...

Exploit for SQL Injection in Valvepress Automatic

CVE-2024-27956-RCE A PoC for CVE-2024-27956, a SQL Injection i...

TOTOLINK AC1200 Buffer Overflow Vulnerability

TOTOLINK AC1200 is a dual-band Wi-Fi router from China's Gion Electronics TOTOLINK. The TOTOLINK AC1200 suffers from a buffer overflow vulnerability that originates from the cgi function setNoticeCfg in /lib/cstemodules/system.so that does not check the length of the user input string NoticeUrl,...

CVE-2024-5165 Eclipse Ditto User Interface vulnerable to XSS due to Improper Neutralization of Input

In Eclipse Ditto versions 3.0.0 to 3.5.5, the user input of several input fields of the Eclipse Ditto Explorer User Interface https://eclipse.dev/ditto/user-interface.html was not properly neutralized and thus vulnerable to both Reflected and Stored XSS Cross Site Scripting. Several inputs were n...

PT-2024-7005

Name of the Vulnerable Software and Affected Versions Grafana versions prior to v11.0.6+security-01 Grafana versions prior to v11.1.7+security-01 Grafana versions prior to v11.2.2+security-01 Description The SQL Expressions experimental feature of Grafana allows for the evaluation of duckdb queri...

CVE-2024-23866 Cross-Site Scripting (XSS) vulnerability in Cups Easy

A vulnerability has been reported in Cups Easy Purchase & Inventory, version 1.0, whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting XSS vulnerability via /cupseasylive/countrycreate.php, in the countryid parameter. Exploitation of this vulnerability...

Kashipara Food Management System Cross-Site Scripting Vulnerability

Kashipara Food Management System is a food management system from Kashipara. A cross-site scripting vulnerability exists in version 1.0 of the Kashipara Food Management System, which stems from a lack of effective filtering and escaping of user-supplied data in the parameter tin of the...

Design/Logic Flaw

TestingPlatform is a testing platform for Internet Security Standards. Prior to version 2.1.1, user input is not filtered correctly. Nmap options are accepted. In this particular case, the option to create log files is accepted in addition to a host name and even without. A log file is created at...

WordPress Plugin Interact: Embed A Quiz On Your Site Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2023-4999 Horizontal scrolling announcement <= 9.2 - Authenticated (Subscriber+) SQL Injection via Shortcode

The Horizontal scrolling announcement plugin for WordPress is vulnerable to SQL Injection via the plugin's horizontal-scrolling shortcode in versions up to, and including, 9.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query...

PT-2023-29320 · Unknown · Easy Chat Server

Name of the Vulnerable Software and Affected Versions: Easy Chat Server versions 3.1 and earlier Description: The issue arises from insufficient encryption of user-controlled inputs, leading to a Cross-Site Scripting XSS vulnerability. This vulnerability is stored via the "POST" method at the...

Cross Site Scripting (XSS)

Decidim is vulnerable to Cross Site Scripting XSS vulnerability. The vulnerability is due to not sanitising user input correctly while processing proposals leading to attacker make other users endorse or support proposals they have no intention of supporting or endorsing...

Design/Logic Flaw

Part-DB is an open source inventory management system for your electronic components. User input was found not being properly escaped, which allowed malicious users to inject arbitrary HTML into the pages. The Content-Security-Policy forbids inline and external scripts so it is not possible to...

CVE-2023-24493

A formula injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. An authenticated attacker could leverage the reporting system to export reports containing formulas, which would then require a victim to approve and execute on a...

CVE-2022-45051

A reflected XSS vulnerability has been found in Axiell Iguana CMS, allowing an attacker to execute code in a victim's browser. The module parameter on the Service.template.cls endpoint does not properly neutralise user input, resulting in the vulnerability...