Archive
December 2023
Vulnerabilities first published in this month (UTC), newest first.
2,697 results · Feed
-
Medium 4.0
Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged …
-
High 7.3
Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged …
-
Medium 6.3
gopeak MasterLab HTTP POST Request Framework.php sqlInject sql injection
A vulnerability classified as critical was found in gopeak MasterLab up to 3.3.10. This vulnerability affects the function sqlInject of the file app/ctrl/Framework.php of the component HTTP POST Request Handler. The manipulation of the argument pwd leads to s…
-
High 7.3
Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged …
-
Medium 6.3
gopeak MasterLab HTTP POST Request Feature.php sqlInject sql injection
A vulnerability classified as critical has been found in gopeak MasterLab up to 3.3.10. This affects the function sqlInject of the file app/ctrl/framework/Feature.php of the component HTTP POST Request Handler. The manipulation of the argument pwd leads to sq…
-
Low 2.4
code-projects Client Details System regester.php cross site scripting
A vulnerability was found in code-projects Client Details System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/regester.php. The manipulation of the argument fname/lname/email/contact leads to c…
-
Medium 4.3
code-projects Client Details System clientview.php sql injection
A vulnerability was found in code-projects Client Details System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/clientview.php. The manipulation of the argument ID leads to sql injection…
-
Low 3.3
Winter CMS Local File Inclusion through Server Side Template Injection
Winter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. Thi…
-
Medium 5.5
JLine vulnerable to out of memory error
An issue in the component GroovyEngine.execute of jline-groovy v3.24.1 allows attackers to cause an OOM (OutofMemory) error.
-
Unscored —
PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection on the Users login panel because of "password" parameter is dir…
-
High 8.8
Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?act…
-
Unscored —
WireMock with GUI versions 3.2.0.0 through 3.0.4.0 are vulnerable to stored cross-site scripting (SXSS) through the rec…
-
Unscored —CVE-2023-50070 Public exploit
Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?act…
-
High 7.8
easy-rules-mvel vulnerable to remote code execution
easy-rules-mvel v4.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component MVELRule.
-
Unscored —
An issue was discovered in XiangShan v2.1, allows local attackers to obtain sensitive information via the L1D cache.
-
Unscored —
An issue in the component IPAddressBitsDivision of IPAddress v5.1.0 leads to an infinite loop. This is disputed because…
-
Unscored —
An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718), allows remote attackers to ob…
-
Unscored —
Stored Cross Site Scripting (XSS) Vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718…
-
High 7.5
An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attacke…
-
Medium 5.3
CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows attackers …
-
Unscored —
Cross Site Scripting (XSS) vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allo…
-
Unscored —
Cross Site Scripting (XSS) vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allo…
-
Medium 5.5
An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718), allows local attackers to obt…
-
Unscored —
CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote att…
-
Unscored —
Cross Site Scripting (XSS) vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718), allows remot…
-
Unscored —
CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote att…
-
Unscored —
SQL Injection vulnerability in Documize version 5.4.2, allows remote attackers to execute arbitrary code via the user p…
-
Unscored —
XnView Classic before 2.51.3 on Windows has a Write Access Violation at xnview.exe+0x3125D6.
-
Unscored —
The Kantega SAML SSO OIDC Kerberos Single Sign-on apps before 6.20.0 for Atlassian products allow XSS if SAML POST Bind…
-
Unscored —
XnView Classic before 2.51.3 on Windows has a Write Access Violation at xnview.exe+0x3ADBD0.
-
Medium 4.3
code-projects Client Details System update-clients.php sql injection
A vulnerability was found in code-projects Client Details System 1.0. It has been classified as problematic. Affected is an unknown function of the file /admin/update-clients.php. The manipulation of the argument uid leads to sql injection. The exploit has be…
-
Medium 4.3
code-projects Client Details System manage-users.php sql injection
A vulnerability was found in code-projects Client Details System 1.0 and classified as problematic. This issue affects some unknown processing of the file /admin/manage-users.php. The manipulation of the argument id leads to sql injection. The exploit has bee…
-
Medium 4.3
code-projects Client Details System HTTP POST Request regester.php sql injection
A vulnerability has been found in code-projects Client Details System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/regester.php of the component HTTP POST Request Handler. The manipulation of the argument fname…
-
Low 2.0
Winter CMS Stored XSS through Backend ColorPicker FormWidget
Winter is a free, open-source content management system. Prior to 1.2.4, Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be rendered unescaped in the backend form, potentially allowing for a stored …
-
Low 2.0
Stored XSS through privileged upload of Media Manager file followed by renaming
Winter is a free, open-source content management system. Prior to 1.2.4, users with the `media.manage_media` permission can upload files to the Media Manager and rename them after uploading. Previously, media manager files were only sanitized on upload, not o…
-
Medium 6.3
code-projects Client Details System HTTP POST Request admin sql injection
A vulnerability, which was classified as critical, was found in code-projects Client Details System 1.0. This affects an unknown part of the file /admin of the component HTTP POST Request Handler. The manipulation of the argument username leads to sql injecti…
-
Medium 5.3
WordPress Booked Plugin < 2.4.4 is vulnerable to Sensitive Data Exposure
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BoxyStudio Booked - Appointment Booking for WordPress | Calendars.This issue affects Booked - Appointment Booking for WordPress | Calendars: from n/a before 2.4.4.
-
Medium 6.3CVE-2023-7137 EPSS 17%
code-projects Client Details System HTTP POST Request sql injection
A vulnerability, which was classified as critical, has been found in code-projects Client Details System 1.0. Affected by this issue is some unknown functionality of the component HTTP POST Request Handler. The manipulation of the argument uemail leads to sql…
-
Low 2.4
code-projects Record Management System Document Type doctype.php cross site scripting
A vulnerability classified as problematic was found in code-projects Record Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /main/doctype.php of the component Document Type Handler. The manipulation of the argumen…
-
Low 2.4
code-projects Record Management System Offices offices.php cross site scripting
A vulnerability classified as problematic has been found in code-projects Record Management System 1.0. Affected is an unknown function of the file /main/offices.php of the component Offices Handler. The manipulation of the argument officename with the input …