Archive
8 September 2024
Vulnerabilities first published on this day (UTC), newest first.
27 results · Feed
-
Low 3.5
SourceCodester Online Bank Management System Feedback mfeedback.php cross site scripting
A vulnerability was found in SourceCodester Online Bank Management System and Online Bank Management System - 1.0. It has been classified as problematic. This affects an unknown part of the file /mfeedback.php of the component Feedback Handler. The manipulati…
-
Low 3.5
SourceCodester Food Ordering Management System index.php cross site scripting
A vulnerability was found in SourceCodester Food Ordering Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /index.php. The manipulation of the argument description leads to cross site script…
-
High 8.1
TOTOLINK AC1200 T8 shadow.sample hard-coded password
A vulnerability classified as critical was found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220. This vulnerability affects unknown code of the file /etc/shadow.sample. The manipulation leads to use of hard-coded password. The attack can be initiated remotely. T…
-
High 8.8
TOTOLINK AC1200 T8 cstecgi.cgi setWiFiRepeaterCfg buffer overflow
A vulnerability classified as critical has been found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220. This affects the function setWiFiRepeaterCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument password leads to buffer overflow. It is possibl…
-
High 8.8
TOTOLINK AC1200 T8 cstecgi.cgi setWiFiMeshName buffer overflow
A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220. It has been rated as critical. Affected by this issue is the function setWiFiMeshName of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument device_name leads to buffer overflo…
-
High 8.8
TOTOLINK AC1200 T8/AC1200 T10 cstecgi.cgi setStaticDhcpRules buffer overflow
A vulnerability was found in TOTOLINK AC1200 T8 and AC1200 T10 4.1.5cu.861_B20230220/4.1.8cu.5207. It has been declared as critical. Affected by this vulnerability is the function setStaticDhcpRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the ar…
-
High 8.8
TOTOLINK AC1200 T8/AC1200 T10 cstecgi.cgi setIpPortFilterRules buffer overflow
A vulnerability was found in TOTOLINK AC1200 T8 and AC1200 T10 4.1.5cu.861_B20230220/4.1.8cu.5207. It has been classified as critical. Affected is the function setIpPortFilterRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument desc leads …
-
High 8.8
TOTOLINK AC1200 T8 cstecgi.cgi setWiFiScheduleCfg buffer overflow
A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220 and classified as critical. This issue affects the function setWiFiScheduleCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument desc leads to buffer overflow. The attack m…
-
Medium 5.3
Loway - CWE-204: Observable Response Discrepancy
Loway - CWE-204: Observable Response Discrepancy
-
Medium 4.3
Loway - CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
Loway - CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
-
Medium 6.1
Loway - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
Loway - CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
-
Medium 6.3
TOTOLINK AC1200 T8 cstecgi.cgi setParentalRules os command injection
A vulnerability has been found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220 and classified as critical. This vulnerability affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument slaveIpList leads to os command …
-
High 8.8
TOTOLINK AC1200 T8/AC1200 T10 cstecgi.cgi setParentalRules buffer overflow
A vulnerability, which was classified as critical, was found in TOTOLINK AC1200 T8 and AC1200 T10 4.1.5cu.861_B20230220/4.1.8cu.5207. This affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument desc/week/sTime…
-
Low 3.5
Gouniverse GoLang CMS FrontendHandler.go PageRenderHtmlByAlias cross site scripting
A vulnerability was found in Gouniverse GoLang CMS 1.4.0. It has been declared as problematic. This vulnerability affects the function PageRenderHtmlByAlias of the file FrontendHandler.go. The manipulation of the argument alias leads to cross site scripting. …
-
Low 3.5
erjemin roll_cms views.py information exposure
A vulnerability was found in erjemin roll_cms up to 1484fe2c4e0805946a7bcf46218509fcb34883a9. It has been classified as problematic. This affects an unknown part of the file roll_cms/roll_cms/views.py. The manipulation leads to information exposure through er…
-
Medium 6.3
itsourcecode Tailoring Management System inccatadd.php sql injection
A vulnerability was found in itsourcecode Tailoring Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /inccatadd.php. The manipulation of the argument title leads to sql injection. The attack ma…
-
Critical 9.8CVE-2024-6924 Scanner template
TrueBooker < 1.0.3 - Multiple Unauthenticated SQLi
The TrueBooker WordPress plugin before 1.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
-
Critical 9.8CVE-2024-6928 Scanner template
Opti Marketing <= 2.0.9 - Unauthenticated SQLi
The Opti Marketing WordPress plugin through 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
-
Medium 4.3
TrueBooker < 1.0.3 - Settings Update via CSRF
The TrueBooker WordPress plugin before 1.0.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack.
-
Medium 6.5
WP MultiTasking <= 0.1.12 - Exit Popup Update via CSRF
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating exit popups, which could allow attackers to make logged admins perform such action via a CSRF attack
-
Medium 6.5
WP MultiTasking <= 0.1.12 - Settings Update via CSRF
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
-
Medium 6.5
WP MultiTasking <= 0.1.12 - Welcome Popup Update via CSRF
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check when updating welcome popups, which could allow attackers to make logged admins perform such action via a CSRF attack
-
Medium 6.5
WP MultiTasking <= 0.1.12 - SMTP Settings Update via CSRF
The WP MultiTasking WordPress plugin through 0.1.12 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack
-
Medium 5.4
WP MultiTasking <= 0.1.12 - Reflected XSS via Shortcode
The WP MultiTasking WordPress plugin through 0.1.12 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform S…
-
High 7.3
code-projects Hospital Management System user-login.php sql injection
A vulnerability has been found in code-projects Hospital Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file user-login.php. The manipulation of the argument username leads to sql injection.…
-
Medium 6.3
Mini-Tmall 1 rewardMapper.select sql injection
A vulnerability, which was classified as critical, was found in Mini-Tmall up to 20240901. Affected is the function rewardMapper.select of the file tmall/admin/order/1/1. The manipulation of the argument orderBy leads to sql injection. It is possible to launc…
-
High 7.3
itsourcecode Payroll Management System ajax.php sql injection
A vulnerability, which was classified as critical, has been found in itsourcecode Payroll Management System 1.0. This issue affects some unknown processing of the file /ajax.php?action=delete_deductions. The manipulation of the argument id leads to sql inject…