n8n 跨站脚本漏洞

n8n is a scalable workflow automation tool from n8n open source. A cross-site scripting vulnerability exists in n8n versions prior to 1.90.0, which stems from the presence of a stored cross-site scripting attack on an attachment view endpoint...

CVE-2024-12882 SSRF in comfyanonymous/comfyui

comfyanonymous/comfyui version v0.2.4 suffers from a non-blind Server-Side Request Forgery SSRF vulnerability. This vulnerability can be exploited by combining the REST APIs POST /internal/models/download and GET /view, allowing attackers to abuse the victim server's credentials to access...

CVE-2024-10099 Stored XSS in comfyanonymous/comfyui

A stored cross-site scripting XSS vulnerability exists in comfyanonymous/comfyui version 0.2.2 and possibly earlier. The vulnerability occurs when an attacker uploads an HTML file containing a malicious XSS payload via the /api/upload/image endpoint. The payload is executed when the file is viewe...

PT-2024-39929 · Unknown · Sourcecodester Online Eyewear Shop

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Eyewear Shop version 1.0 Description: A critical issue has been found in the processing of the file "/admin/?page=inventory/view inventory&id=2". The manipulation of the id argument leads to SQL injection. The attack may...

PT-2024-39930 · Unknown · Sourcecodester Online Eyewear Shop

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Eyewear Shop version 1.0 Description: A vulnerability was found in the software, affecting an unknown function of the file "/admin/?page=inventory/view inventory&id=2". The manipulation of the Code argument leads to...

PT-2024-38754 · Genexis · Genexis Tilgin Home Gateway

Name of the Vulnerable Software and Affected Versions: Genexis Tilgin Home Gateway version 322 AS0500-03 05 13 05 Description: This issue affects some unknown processing of the file "/vood/cgi-bin/vood view.cgi?lang=EN&act=user/spec...

PT-2024-30559 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions prior to 14.10.21 XWiki Platform versions prior to 15.5.5 XWiki Platform versions prior to 15.10.6 XWiki Platform versions prior to 16.0.0 Description: The issue allows a user without Script or Programming rights to...

PT-2024-29323 · Unknown · Kashipara Responsive School Management System

Name of the Vulnerable Software and Affected Versions: Kashipara Responsive School Management System version 3.2.0 Description: An issue was found in the /smsa/view teachers.php endpoint, allowing remote unauthenticated attackers to view teacher details due to incorrect access control...

PT-2024-29328 · Unknown · Kashipara Responsive School Management System

Name of the Vulnerable Software and Affected Versions: Kashipara Responsive School Management System version 3.2.0 Description: An issue was found in the /smsa/view students.php endpoint, allowing remote unauthenticated attackers to view student details. This issue affects the ability to control...

PT-2024-37361 · Unknown · Sourcecodester Music Class Enrollment System

Name of the Vulnerable Software and Affected Versions: SourceCodester Music Class Enrollment System version 1.0 Description: A critical issue was found in the SourceCodester Music Class Enrollment System, affecting an unknown functionality of the file "/mces/?p=class/view class". The manipulation...

PT-2024-27677 · Phpvod · Phpvod

Name of the Vulnerable Software and Affected Versions: PHPVOD version 4.0 Description: A reflected cross-site scripting XSS issue was found in PHPVOD. The issue is related to the id parameter at the "/view/admin/view.php" API endpoint. Recommendations: For PHPVOD version 4.0, avoid using the id...

PT-2024-24134 · Unknown · Computer Laboratory Management System

Name of the Vulnerable Software and Affected Versions: Computer Laboratory Management System version 1.0 Description: The issue concerns SQL Injection via the id parameter of the "/admin/damage/view damage.php" API endpoint. Recommendations: For Computer Laboratory Management System version 1.0,...

PT-2024-24627 · Sourcecodester · Sourcecodester Computer Laboratory Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Computer Laboratory Management System version 1.0 Description: A critical issue affects some unknown functionality of the file "/admin/?page=borrow/view borrow". The manipulation of the id argument leads to SQL injection. The...

PT-2024-11734 · Unknown · Hospital Management System

Name of the Vulnerable Software and Affected Versions: Hospital Management System version 1.0 Description: A SQL injection issue was found in the Hospital Management System. The vulnerability can be exploited via the pat number parameter at the "his doc view single patien.php" endpoint...

PT-2024-12436

Name of the Vulnerable Software and Affected Versions Sourcecodester Lost and Found Information System version 1.0 Description The issue is related to unauthenticated SQL Injection. The vulnerability can be exploited at the API endpoint "?page=items/view&id=". This allows for potential manipulati...

PT-2024-20827 · Unknown · Online Medicine Ordering System

Name of the Vulnerable Software and Affected Versions: Online Medicine Ordering System version 1.0 Description: The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the id parameter at the "/omos/?p=products/view product" API endpoint. Recommendations: Fo...

PT-2023-32656 · Unknown · Bigprof Online Invoicing System

Name of the Vulnerable Software and Affected Versions: BigProf Online Invoicing System version 2.6 Description: A vulnerability has been discovered in the BigProf Online Invoicing System, which does not sufficiently encode user-controlled input, resulting in persistent XSS through the...

PT-2023-32659 · Unknown · Bigprof Online Invoicing System

Name of the Vulnerable Software and Affected Versions: BigProf Online Invoicing System version 2.6 Description: A vulnerability has been discovered in the system, which does not sufficiently encode user-controlled input, resulting in persistent XSS through the "/invoicing/app/clients view.php"...

PT-2023-32658 · Unknown · Bigprof Online Invoicing System

Name of the Vulnerable Software and Affected Versions: BigProf Online Invoicing System version 2.6 Description: A vulnerability has been discovered in the BigProf Online Invoicing System, which does not sufficiently encode user-controlled input, resulting in persistent XSS through the...

PT-2023-28092 · Unknown · Sourcecodester Free Hospital Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Free Hospital Management System for Small Practices version 1.0 Description: A critical issue has been discovered, affecting an unknown function of the file /vm/doctor/doctors.php?action=view. The manipulation of the id argumen...