Archive
July 2024
Vulnerabilities first published in this month (UTC), newest first.
3,139 results · Feed
-
High 7.2
Lifetime free Drag & Drop Contact Form Builder for WordPress VForm <= 2.1.5 - Unauthenticated Stored Cross-Site Scripting
The Lifetime free Drag & Drop Contact Form Builder for WordPress VForm plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.1.5 due to insufficient input sanitization and output escaping. This makes it poss…
-
Medium 6.3
SourceCodester Establishment Billing Management System sql injection
A vulnerability was found in SourceCodester Establishment Billing Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /ajax.php?action=delete_block. The manipulation of the argument i…
-
Medium 6.3
SourceCodester Establishment Billing Management System manage_user.php sql injection
A vulnerability was found in SourceCodester Establishment Billing Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /manage_user.php. The manipulation of the argument id leads to sql injection. It is possib…
-
High 7.3
SourceCodester Establishment Billing Management System Login sql injection
A vulnerability was found in SourceCodester Establishment Billing Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/ajax.php?action=login of the component Login. The manipulation of the argument us…
-
High 8.6
A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface wi…
-
High 7.5
A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface wi…
-
High 7.5
A vulnerability has been found in Dahua products. Attackers can send carefully crafted data packets to the interface wi…
-
Low 3.5
SourceCodester Establishment Billing Management System cross site scripting
A vulnerability has been found in SourceCodester Establishment Billing Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/ajax.php?action=save_settings. The manipulation of the argument name leads t…
-
Medium 6.5
A vulnerability has been found in Dahua products.After obtaining the ordinary user's username and password, the attacke…
-
Medium 6.0
A vulnerability has been found in Dahua products.After obtaining the administrator's username and password, the attacke…
-
Medium 4.9
A vulnerability has been found in Dahua products. After obtaining the administrator's username and password, the attac…
-
High 7.5
A vulnerability has been found in Dahua products.Attackers can send carefully crafted data packets to the interface wit…
-
Low 3.5
SourceCodester Lot Reservation Management System cross site scripting
A vulnerability, which was classified as problematic, was found in SourceCodester Lot Reservation Management System 1.0. This affects an unknown part of the file /admin/ajax.php?action=save_settings. The manipulation of the argument about leads to cross site …
-
Medium 6.3
SourceCodester Lot Reservation Management System manage_user.php sql injection
A vulnerability, which was classified as critical, has been found in SourceCodester Lot Reservation Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/manage_user.php. The manipulation of the argument id leads to sq…
-
Medium 6.3
SourceCodester Lot Reservation Management System manage_model.php sql injection
A vulnerability classified as critical was found in SourceCodester Lot Reservation Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/manage_model.php. The manipulation of the argument id leads to sql injectio…
-
Medium 6.3
SourceCodester Lot Reservation Management System sql injection
A vulnerability classified as critical has been found in SourceCodester Lot Reservation Management System 1.0. Affected is an unknown function of the file /admin/index.php?page=manage_lot. The manipulation of the argument id leads to sql injection. It is poss…
-
Medium 6.3
SourceCodester Lot Reservation Management System view_reserved.php sql injection
A vulnerability was found in SourceCodester Lot Reservation Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/view_reserved.php. The manipulation of the argument id leads to sql injection. The …
-
High 7.3
SourceCodester Lot Reservation Management System sql injection
A vulnerability was found in SourceCodester Lot Reservation Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /admin/ajax.php?action=login. The manipulation of the argument username leads to sql injec…
-
High 8.2CVE-2024-6255 EPSS 14%
Path Traversal in gaizhenbiao/chuanhuchatgpt
A vulnerability in the JSON file handling of gaizhenbiao/chuanhuchatgpt version 20240410 allows any user to delete any JSON file on the server, including critical configuration files such as `config.json` and `ds_config_chatbot.json`. This issue arises due to…
-
Medium 4.7
itsourcecode Alton Management System team_save.php sql injection
A vulnerability was found in itsourcecode Alton Management System 1.0. It has been classified as critical. This affects an unknown part of the file /admin/team_save.php. The manipulation of the argument team leads to sql injection. It is possible to initiate …
-
Medium 6.1
An issue was discovered in the IhisiServiceSmm module in Insyde InsydeH2O with kernel 5.2 before 05.28.42, 5.3 before 0…
-
High 8.8
Beego privilege escalation vulnerability
An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the sendMail function located in beego/core/logs/smtp.go file
-
High 8.8
Beego privilege escalation vulnerability
An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the getCacheFileName function in file.go file
-
High 7.6
Stack-based buffer overflow vulnerability in Tenda AC18 V15.03.3.10_EN allows a remote attacker to execute arbitrary co…
-
Medium 5.3
An issue was discovered in litestream v0.3.13. The usage of the ssh.InsecureIgnoreHostKey() disables host key verificat…
-
High 7.4
mmudb v1.9.3 was discovered to use the HTTP protocol in the ShowMetricsRaw and ShowMetricsAsText functions, possibly al…
-
Medium 5.3
An issue was discovered in filestash v0.4. The usage of the ssh.InsecureIgnoreHostKey() disables host key verification,…
-
High 7.1
goframe v2.7.2 is configured to skip TLS certificate verification, possibly allowing attackers to execute a man-in-the-…
-
Medium 5.9
Filestash skips TLS certificate verification process when sending out email verification codes
Default configurations in the ShareProofVerifier function of filestash v0.4 causes the application to skip the TLS certificate verification process when sending out email verification codes, possibly allowing attackers to access sensitive data via a man-in-th…
-
High 7.5
Filestash configured to skip TLS certificate verification when using the FTPS protocol
filestash v0.4 is configured to skip TLS certificate verification when using the FTPS protocol, possibly allowing attackers to execute a man-in-the-middle attack via the Init function of index.go.
-
High 8.3
os/linux/elf.rb in Homebrew brew before 4.2.20 uses ldd to load ELF files obtained from untrusted sources, which allows…
-
Medium 4.7
itsourcecode Alton Management System Add a Menu menu.php unrestricted upload
A vulnerability was found in itsourcecode Alton Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/menu.php of the component Add a Menu. The manipulation of the argument image leads to unr…
-
Medium 4.7
itsourcecode Alton Management System member_save.php sql injection
A vulnerability has been found in itsourcecode Alton Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /admin/member_save.php. The manipulation of the argument last/first leads to sql inje…
-
Medium 4.7
itsourcecode Alton Management System category_save.php sql injection
A vulnerability, which was classified as critical, was found in itsourcecode Alton Management System 1.0. Affected is an unknown function of the file /admin/category_save.php. The manipulation of the argument category leads to sql injection. It is possible to…
-
Medium 6.5
Kibana Denial of Service issue
An issue was discovered in Kibana where a user with Viewer role could cause a Kibana instance to crash by sending a large number of maliciously crafted requests to a specific endpoint.
-
Medium 4.7
itsourcecode Alton Management System reservation_status.php sql injection
A vulnerability, which was classified as critical, has been found in itsourcecode Alton Management System 1.0. This issue affects some unknown processing of the file /reservation_status.php. The manipulation of the argument rcode leads to sql injection. The a…
-
Medium 6.3
itsourcecode Alton Management System search.php sql injection
A vulnerability classified as critical was found in itsourcecode Alton Management System 1.0. This vulnerability affects unknown code of the file search.php. The manipulation of the argument rcode leads to sql injection. The attack can be initiated remotely. …
-
Medium 6.4
SiteOrigin Widgets Bundle <= 1.62.2 - Authenticated (Contributor+) Stored Cross-Site Scripting in Image Grid widget
The SiteOrigin Widgets Bundle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Image Grid widget in all versions up to, and including, 1.62.2 due to insufficient input sanitization and output escaping on user supplied attributes. This…
-
Low 3.1
The fuels-ts typescript SDK has no awareness of to-be-spent transactions
fuels-ts is a library for interacting with Fuel v2. The typescript SDK has no awareness of to-be-spent transactions causing some transactions to fail or silently get pruned as they are funded with already used UTXOs. The problem occurs, because the `fund` fun…
-
High 7.5
TensorFlow segfault in array_ops.upper_bound
TensorFlow is an end-to-end open source platform for machine learning. `array_ops.upper_bound` causes a segfault when not given a rank 2 tensor. The fix will be included in TensorFlow 2.13 and will also cherrypick this commit on TensorFlow 2.12.