Archive
10 January 2024
Vulnerabilities first published on this day (UTC), newest first.
83 results · Clear filters · Feed
-
Medium 4.3
A unrestricted php file upload vulnerability exists in the import.json.php temporary copy functionality of WWBN AVideo …
-
Medium 5.3
WWBN AVideo recovery notification bypass vulnerability
A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master commit 15fed957fb. A specially crafted HTTP request can lead to the silent creation of a recovery pass code for any user.
-
Medium 6.5
EventON - WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Missing Authorization to Arbitrary Post Meta Update via evo_eventpost_update_meta
The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the evo_eventpost_update_meta function in all versions up to, and including, 4.…
-
Medium 6.3
SourceCodester Student Attendance System attendance_report.php sql injection
A vulnerability, which was classified as critical, was found in SourceCodester Student Attendance System 1.0. Affected is an unknown function of the file attendance_report.php. The manipulation of the argument class_id leads to sql injection. The exploit has …
-
Medium 5.3
The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a craf…
-
Medium 5.3
The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a craf…
-
Medium 5.3
The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a craf…
-
Medium 5.5
The vulnerability allows a remote attacker to delete arbitrary files on the file system via a crafted URL or HTTP reque…
-
Medium 5.3
The vulnerability allows a remote attacker to inject arbitrary HTTP response headers or manipulate HTTP response bodies…
-
Medium 6.3
The vulnerability allows an unauthenticated remote attacker to send malicious network requests containing arbitrary cli…
-
Medium 5.3
The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s se…
-
Medium 6.5
Ipa: invalid csrf protection
A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confident…
-
Medium 5.5
Adobe Substance 3D Stager v2.1.1 Vulnerability VII
Adobe Substance 3D Stager versions 2.1.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this …
-
Medium 5.5
Adobe Substance 3D Stager v2.1.1 Vulnerability III
Adobe Substance 3D Stager versions 2.1.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this …
-
Medium 5.5
Adobe Substance 3D Stager v2.1.1 Vulnerability IV
Adobe Substance 3D Stager versions 2.1.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this …
-
Medium 5.5
Adobe Substance 3D Stager v2.1.1 Vulnerability V
Adobe Substance 3D Stager versions 2.1.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this …
-
Medium 5.5
Adobe Substance 3D Stager v2.1.1 Vulnerability VIII
Adobe Substance 3D Stager versions 2.1.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this …
-
Medium 5.5
Adobe Substance 3D Stager v2.1.1 Vulnerability I
Adobe Substance 3D Stager versions 2.1.3 and earlier are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this …
-
Medium 6.1
A content-security-policy vulnerability in ENS Control browser extension prior to 10.7.0 Update 15 allows a remote atta…
-
Medium 6.5
The vulnerability allows an authenticated remote attacker to list arbitrary folders in all paths of the system under th…
-
Medium 5.5
The vulnerability allows an authenticated remote attacker to upload a malicious file to the SD card containing arbitrar…
-
Medium 5.3
The vulnerability allows an unauthenticated remote attacker to read arbitrary files under the context of the applicatio…
-
Medium 6.5
The vulnerability allows a remote attacker to download arbitrary files in all paths of the system under the context of …
-
Medium 6.5
The vulnerability allows an unauthenticated remote attacker to upload arbitrary files under the context of the applicat…
-
Medium 5.3
The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s se…
-
Medium 6.5
The vulnerability allows an authenticated remote attacker to download arbitrary files in all paths of the system under …
-
Medium 5.7
XSS Vulnerability in ZTE MF258 Products
There is a Cross-site scripting (XSS) vulnerability in ZTE MF258. Due to insufficient input validation of SMS interface parameter, an XSS attack will be triggered.
-
Medium 5.5
PHPGurukul Hospital Management System query-details.php sql injection
A vulnerability, which was classified as critical, was found in PHPGurukul Hospital Management System 1.0. This affects an unknown part of the file admin/query-details.php. The manipulation of the argument adminremark leads to sql injection. The exploit has b…
-
Medium 5.5
PHPGurukul Hospital Management System patient-search.php sql injection
A vulnerability, which was classified as critical, has been found in PHPGurukul Hospital Management System 1.0. Affected by this issue is some unknown functionality of the file admin/patient-search.php. The manipulation of the argument searchdata leads to sql…
-
Medium 5.5
PHPGurukul Hospital Management System change-password.php sql injection
A vulnerability classified as critical was found in PHPGurukul Hospital Management System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/change-password.php. The manipulation of the argument cpass leads to sql injection. The…
-
Medium 5.5
PHPGurukul Hospital Management System contact.php sql injection
A vulnerability classified as critical has been found in PHPGurukul Hospital Management System 1.0. Affected is an unknown function of the file admin/contact.php. The manipulation of the argument mobnum leads to sql injection. The exploit has been disclosed t…
-
Medium 5.5
PHPGurukul Hospital Management System edit-doctor-specialization.php sql injection
A vulnerability was found in PHPGurukul Hospital Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file admin/edit-doctor-specialization.php. The manipulation of the argument doctorspecilization leads to s…
-
Medium 5.3
DeShang DSO2O install.php access control
A vulnerability was found in DeShang DSO2O up to 4.1.0. It has been classified as critical. This affects an unknown part of the file /install/install.php. The manipulation leads to improper access controls. It is possible to initiate the attack remotely. The …
-
Medium 5.5
coderd-repos Eva HTTP POST Request page sql injection
A vulnerability was found in coderd-repos Eva 1.0.0 and classified as critical. Affected by this issue is some unknown functionality of the file /system/traceLog/page of the component HTTP POST Request Handler. The manipulation of the argument property leads …
-
Medium 4.3
Mandelo ssm_shiro_blog Backend updateRoles access control
A vulnerability has been found in Mandelo ssm_shiro_blog 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file updateRoles of the component Backend. The manipulation leads to improper access controls. The ex…
-
Medium 6.1
A Cross-Site Scripting (XSS) vulnerability was discovered in Hospital Management System V4.0 which allows an attacker t…
-
Medium 4.9
A Time-Based SQL Injection vulnerability was discovered in Hospital Management System V4.0 which can allow an attacker …
-
Medium 4.9
A Time-Based SQL Injection vulnerability was discovered in Hospital Management System V4.0 which can allow an attacker …
-
Medium 5.5
MP4Box GPAC version 2.3-DEV-rev636-gfbd7e13aa-master was discovered to contain an infinite loop in the function av1_uvl…
-
Medium 5.3
D-Link R15 before v1.08.02 was discovered to contain no firewall restrictions for IPv6 traffic. This allows attackers t…