Archive
May 2022
Vulnerabilities first published in this month (UTC), newest first.
2,175 results · Feed
-
Unscored —
Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/classes/Master.php?f=delete_product.
-
Unscored —
Automotive Shop Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via /asms/classes/Master.php?f=save_…
-
Unscored —
Simple Social Networking Site v1.0 is vulnerable to Cross Site Scripting (XSS) via /sns/classes/Users.php?f=save, first…
-
Medium 5.4
Cross site scripting in SiteServer CMS
SiteServer CMS V6.15.51 is affected by a Cross Site Scripting (XSS) vulnerability.
-
Unscored —
Badminton Center Management System 1.0 is vulnerable to SQL Injection via /bcms/classes/Master.php?f=delete_court_renta…
-
Unscored —
Badminton Center Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via /bcms/classes/Master.php?f=save_…
-
High 8.8
SQL injection in SiteServer CMS
SiteServer CMS V6.15.51 is affected by a SQL injection vulnerability.
-
Unscored —
Merchandise Online Store 1.0 is vulnerable to SQL Injection via /vloggers_merch/classes/Master.php?f=delete_product.
-
Unscored —
SiteServer CMS < V5.1 is affected by an unrestricted upload of a file with dangerous type (getshell), which could be us…
-
Medium 5.4
Path Traversal in filegator/filegator
Path Traversal in GitHub repository filegator/filegator prior to 7.8.0.
-
Medium 4.3
Session Fixation in filegator/filegator
Session Fixation in GitHub repository filegator/filegator prior to 7.8.0.
-
Unscored —
There is a buffer overflow vulnerability in the Web server httpd of the router in Tenda router devices such as Tenda AC…
-
Critical 9.0
Business Logic Errors in erudika/para
Business Logic Errors in GitHub repository erudika/para prior to 1.45.11.
-
Low 2.4
Home Clean Services Management System cross site scripting
A vulnerability, which was classified as problematic, has been found in Home Clean Services Management System 1.0. This issue affects register.php?link=registerand. The manipulation with the input <script>alert(1)</script> leads to cross site scripting. The a…
-
Medium 6.3
Home Clean Services Management System login.php sql injection
A vulnerability classified as critical was found in Home Clean Services Management System 1.0. This vulnerability affects the file login.php. The manipulation of the argument email with the input admin%'/**/AND/**/(SELECT/**/5383/**/FROM/**/(SELECT(SLEEP(2)))…
-
Medium 4.7
Home Clean Services Management System login.php sql injection
A vulnerability classified as critical has been found in Home Clean Services Management System 1.0. This affects an unknown part of admin/login.php. The manipulation of the argument username with the input admin%'/**/AND/**/(SELECT/**/5383/**/FROM/**/(SELECT(…
-
Medium 4.7
Home Clean Services Management System unrestricted upload
A vulnerability was found in Home Clean Services Management System 1.0. It has been rated as critical. Affected by this issue is register.php?link=registerand. The manipulation with the input <?php phpinfo();?> leads to code execution. The attack may be launc…
-
Low 2.4
Student Information System Student Roll Module cross site scripting
A vulnerability, which was classified as problematic, was found in Student Information System 1.0. Affected is admin/?page=students of the Student Roll module. The manipulation with the input <script>alert(1)</script> leads to authenticated cross site scripti…
-
High 7.8
A argument injection vulnerability in the 'packet-trace' CLI command of Zyxel USG/ZyWALL series firmware versions 4.09 …
-
Unscored —
app/models/user.rb in Mastodon before 3.5.0 allows a bypass of e-mail restrictions.
-
Medium 6.5
A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/Z…
-
Unscored —
mysiteforme v2.2.1 was discovered to contain a Server-Side Request Forgery.
-
Medium 5.8
A cross-site scripting vulnerability was identified in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.3…
-
High 8.1
SQL injection in helloxz/imgurl
imgurl v2.31 was discovered to contain a Blind SQL injection vulnerability via /upload/localhost.
-
Unscored —
Totolink A3600R V4.1.2cu.5182_B20201102 was discovered to contain a stacker overflow in the fread function at infostat.…
-
High 8.8CVE-2022-29221 Public exploit
PHP Code Injection by malicious block or filename in Smarty
Smarty is a template engine for PHP, facilitating the separation of presentation (HTML/CSS) from application logic. Prior to versions 3.1.45 and 4.1.1, template authors could inject php code by choosing a malicious {block} name or {include} file name. Sites t…
-
Medium 6.1
Multiple improper input validation flaws were identified in some CLI commands of Zyxel USG/ZyWALL series firmware versi…
-
High 8.8
Cross-Site Request Forgery in XXL-Job
A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via the component /gaia-job-admin/user/add.
-
Unscored —
In Simple Food Website 1.0, a moderation can put the Cross Site Scripting Payload in any of the fields on http://127.0.…
-
Unscored —
Xampp for Windows v8.1.4 and below was discovered to contain insecure permissions for its install directory, allowing a…
-
Unscored —
Insecure permissions in the install directories and binaries of Dev-CPP v4.9.9.2 allows attackers to execute arbitrary …
-
Unscored —
Inout Blockchain AltExchanger 1.2.1 and Inout Blockchain FiatExchanger 2.2.1 allow Chart/TradingView/chart_content/mast…
-
Unscored —
Inout Blockchain AltExchanger 1.2.1 allows index.php/coins/update_marketboxslider marketcurrency SQL injection.
-
Unscored —
Inout Blockchain AltExchanger 1.2.1 allows index.php/home/about inoutio_language cookie SQL injection.
-
Medium 5.5
Claroty Secure Remote Access Site - Authentication Bypass Using an Alternate Path or Channel
Successful exploitation of this vulnerability on Claroty Secure Remote Access (SRA) Site versions 3.0 through 3.2 allows an attacker with local command line interface access to gain the secret key, subsequently allowing them to generate valid session tokens f…
-
High 7.4
AVEVA InTouch Access Anywhere Exposure of Resource to Wrong Sphere
Windows OS can be configured to overlay a “language bar” on top of any application. When this OS functionality is enabled, the OS language bar UI will be viewable in the browser alongside the AVEVA InTouch Access Anywhere and Plant SCADA Access Anywhere appli…
-
Critical 9.4CVE-2021-32941 EPSS 15%
Annke Network Video Recorder - Stack-based Buffer Overflow
Annke N48PBB (Network Video Recorder) products of version 3.4.106 build 200422 and prior are vulnerable to a stack-based buffer overflow, which allows an unauthorized remote attacker to execute arbitrary code with the same privileges as the server user (root).
-
High 8.8
Cognex In-Sight OPC Server - Deserialization of Untrusted Data
The affected Cognex product, the In-Sight OPC Server versions v5.7.4 (96) and prior, deserializes untrusted data, which could allow a remote attacker access to system level permission commands and local privilege escalation.
-
High 7.9
TOCTOU Vulnerability in Quick Heal Total Security
Time of Check - Time of Use (TOCTOU) vulnerability in Quick Heal Total Security prior to 12.1.1.27 allows a local attacker to achieve privilege escalation, potentially leading to deletion of system files. This is achieved through exploiting the time between d…
-
High 7.9
DLL Hijacking Vulnerability in Quick Heal Total Security
A DLL hijacking vulnerability in the installed for Quick Heal Total Security prior to 12.1.1.27 allows a local attacker to achieve privilege escalation, leading to execution of arbitrary code, via the installer not restricting the search path for required DLL…