Archive
30 December 2023
Vulnerabilities first published on this day (UTC), newest first.
36 results · Feed
-
High 7.7
Lockscreen bypass in eWeLink App
Improper privilege management vulnerability in CoolKit Technology eWeLink on Android and iOS allows application lockscreen bypass.This issue affects eWeLink before 5.2.0.
-
Medium 4.7
Muyun DedeBIZ Add Attachment unrestricted upload
A vulnerability was found in Muyun DedeBIZ up to 6.2.12 and classified as critical. Affected by this issue is some unknown functionality of the component Add Attachment Handler. The manipulation leads to unrestricted upload. The attack may be launched remotel…
-
Medium 5.5
Tongda OA 2017 delete.php sql injection
A vulnerability has been found in Tongda OA 2017 up to 11.9 and classified as critical. Affected by this vulnerability is an unknown functionality of the file general/project/proj/delete.php. The manipulation of the argument PROJ_ID_STR leads to sql injection…
-
Medium 4.7
Campcodes Online College Library System HTTP POST Request category_row.php sql injection
A vulnerability, which was classified as critical, was found in Campcodes Online College Library System 1.0. Affected is an unknown function of the file /admin/category_row.php of the component HTTP POST Request Handler. The manipulation of the argument id le…
-
Medium 4.7
Campcodes Online College Library System HTTP POST Request book_row.php sql injection
A vulnerability, which was classified as critical, has been found in Campcodes Online College Library System 1.0. This issue affects some unknown processing of the file /admin/book_row.php of the component HTTP POST Request Handler. The manipulation of the ar…
-
High 8.8
Apache DolphinScheduler: Arbitrary js execute as root for authenticated users
Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server.This issue affects Apache DolphinScheduler: until 3.1.9. Users are recommended to upgrade to ver…
-
Medium 4.7
Campcodes Online College Library System HTTP POST Request book_add.php sql injection
A vulnerability classified as critical was found in Campcodes Online College Library System 1.0. This vulnerability affects unknown code of the file /admin/book_add.php of the component HTTP POST Request Handler. The manipulation of the argument category lead…
-
Medium 4.7
Campcodes Online College Library System HTTP POST Request return_add.php sql injection
A vulnerability classified as critical has been found in Campcodes Online College Library System 1.0. This affects an unknown part of the file /admin/return_add.php of the component HTTP POST Request Handler. The manipulation of the argument student leads to …
-
Medium 4.7
Campcodes Online College Library System HTTP POST Request borrow_add.php sql injection
A vulnerability was found in Campcodes Online College Library System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/borrow_add.php of the component HTTP POST Request Handler. The manipulation of the…
-
Medium 4.3CVE-2023-7173 Public exploit
PHPGurukul Hospital Management System registration.php cross site scripting
A vulnerability, which was classified as problematic, was found in PHPGurukul Hospital Management System 1.0. This affects an unknown part of the file registration.php. The manipulation of the argument First Name leads to cross site scripting. It is possible …
-
Medium 4.3
MdAlAmin-aol Own Health Record logout.php cross-site request forgery
A vulnerability was found in MdAlAmin-aol Own Health Record 0.1-alpha/0.2-alpha/0.3-alpha/0.3.1-alpha. It has been rated as problematic. This issue affects some unknown processing of the file includes/logout.php. The manipulation leads to cross-site request f…
-
High 7.3CVE-2023-7172 Public exploit
PHPGurukul Hospital Management System Admin Dashboard sql injection
A vulnerability, which was classified as critical, has been found in PHPGurukul Hospital Management System 1.0. Affected by this issue is some unknown functionality of the component Admin Dashboard. The manipulation leads to sql injection. The attack may be l…
-
Critical 9.8
TOTOLINK X6000R v9.4.0cu.852_B20230719 was discovered to contain a remote command execution (RCE) vulnerability via the…
-
Critical 9.8CVE-2023-50578 Scanner template
Mingsoft MCMS SQL injection
Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do.
-
Medium 5.4
Layui cross-site scripting (XSS) vulnerability
layui up to v2.74 was discovered to contain a cross-site scripting (XSS) vulnerability via the data-content parameter.
-
Unscored —
TestLink through 1.9.20 allows type juggling for authentication bypass because === is not used.
-
Unscored —
Grupo Embras GEOSIAP ERP v2.2.167.02 was discovered to contain a SQL injection vulnerability via the codLogin parameter…
-
Unscored —
An issue was discovered in Fortanix EnclaveOS Confidential Computing Manager (CCM) Platform before 3.32 for Intel SGX. …
-
Unscored —
An issue was discovered in SCONE Confidential Computing Platform before 5.8.0 for Intel SGX. Lack of pointer-alignment …
-
Unscored —
An issue was discovered in Fortanix EnclaveOS Confidential Computing Manager (CCM) Platform before 3.29 for Intel SGX. …
-
Critical 9.8
Jeecg Boot SQL Injection
SQL injection vulnerability in jeecg-boot v3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the component /sys/replicate/check.
-
Critical 9.8
Jeecg Boot SQL injection vulnerability
SQL injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the jmreport/qurestSql component.
-
Critical 9.1
JeecgBoot server-side template injection
SSTI injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to execute arbitrary code via crafted HTTP request to the /jmreport/loadTableData component.
-
Unscored —
Unified Remote 3.13.0 allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allo…
-
Medium 5.4
IDURAR (aka idurar-erp-crm) through 2.0.1 allows stored XSS via a PATCH request with a crafted JSON email template in t…
-
Unscored —
Brave Browser before 1.59.40 does not properly restrict the schema for WebUI factory and redirect. This is related to b…
-
Unscored —
The beesblog (aka Bees Blog) component before 1.6.2 for thirty bees allows Reflected XSS because controllers/front/post…
-
High 7.5
ehttp 1.0.6 before 17405b9 has an epoll_socket.cpp read_func use-after-free. An attacker can make many connections over…
-
Unscored —
LogoBee 0.2 allows updates.php?id= XSS.
-
Unscored —
outdoorbits little-backup-box (aka Little Backup Box) before f39f91c allows remote attackers to execute arbitrary code …
-
Unscored —
ehttp 1.0.6 before 17405b9 has a simple_log.cpp _log out-of-bounds-read during error logging for long strings.
-
Unscored —
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formRebootSche…
-
Unscored —
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formPasswordSe…
-
Unscored —
TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formRoute.
-
High 7.8
Improper initialization of x87 and SSE floating-point configuration registers in the __scone_entry component of SCONE b…
-
Unscored —
A lack of pointer-validation logic in the __scone_dispatch component of SCONE before v5.8.0 for Intel SGX allows attack…