Archive
26 December 2024
Vulnerabilities first published on this day (UTC), newest first.
33 results · Clear filters · Feed
-
Medium 5.3
Stored Cross-Site Scripting (XSS) in lgsl v7.0
LGSL (Live Game Server List) provides online status for games. Before 7.0.0, a stored cross-site scripting (XSS) vulnerability was identified in lgsl. The function lgsl_query_40 in lgsl_protocol.php has implemented an HTTP crawler. This function makes a reque…
-
Medium 4.3
OpenCTI leaks support information due to inadequate access control
OpenCTI is an open-source cyber threat intelligence platform. Before 6.3.0, general users can access information that can only be accessed by users with access privileges to admin and support information (SETTINGS_SUPPORT). This is due to inadequate access co…
-
Medium 5.3
Marp Core allows XSS by improper neutralization of HTML sanitization
@marp-team/marp-core is the core for Marp, which is the ecosystem to write your presentation with plain Markdown. Marp Core from v3.0.2 to v3.9.0 and v4.0.0, are vulnerable to cross-site scripting (XSS) due to improper neutralization of HTML sanitization. Mar…
-
Medium 6.9
Delinea addressed a reported case on Secret Server v11.7.31 (protocol handler version 6.0.3.26) where, within the proto…
-
Medium 6.3
1000 Projects Portfolio Management System MCA add_achievement_details.php unrestricted upload
A vulnerability was found in 1000 Projects Portfolio Management System MCA 1.0 and classified as critical. This issue affects some unknown processing of the file /add_achievement_details.php. The manipulation of the argument ach_certy leads to unrestricted up…
-
Medium 4.3CVE-2024-12955 Public exploit
PHPGurukul Blood Bank & Donor Management System logout.php cross-site request forgery
A vulnerability has been found in PHPGurukul Blood Bank & Donor Management System 2.4 and classified as problematic. This vulnerability affects unknown code of the file /logout.php. The manipulation leads to cross-site request forgery. The attack can be initi…
-
Medium 6.3
1000 Projects Portfolio Management System MCA update_ach.php unrestricted upload
A vulnerability, which was classified as critical, was found in 1000 Projects Portfolio Management System MCA 1.0. This affects an unknown part of the file /update_ach.php. The manipulation of the argument ach_certy leads to unrestricted upload. It is possibl…
-
Medium 6.3
1000 Projects Portfolio Management System MCA update_pd_process.php unrestricted upload
A vulnerability, which was classified as critical, has been found in 1000 Projects Portfolio Management System MCA 1.0. Affected by this issue is some unknown functionality of the file /update_pd_process.php. The manipulation of the argument profile leads to …
-
Medium 6.3
melMass comfy_mtb Dependency endpoint.py run_command code injection
A vulnerability classified as critical was found in melMass comfy_mtb up to 0.1.4. Affected by this vulnerability is the function run_command of the file comfy_mtb/endpoint.py of the component Dependency Handler. The manipulation leads to code injection. The …
-
Medium 6.3
1000 Projects Portfolio Management System MCA add_personal_details.php unrestricted upload
A vulnerability classified as critical has been found in 1000 Projects Portfolio Management System MCA 1.0. Affected is an unknown function of the file /add_personal_details.php. The manipulation of the argument profile leads to unrestricted upload. It is pos…
-
Medium 4.0
Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause d…
-
Medium 6.3
code-projects/projectworlds Travel Management System subcat.php sql injection
A vulnerability was found in code-projects/projectworlds Travel Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /subcat.php. The manipulation of the argument catid leads to sql injection. The attack…
-
Medium 5.5
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information…
-
Medium 5.5
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information…
-
Medium 6.2
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information…
-
Medium 6.3
code-projects Travel Management System package.php sql injection
A vulnerability was found in code-projects Travel Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /package.php. The manipulation of the argument subcatid leads to sql injection. The attack can be in…
-
Medium 4.0
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information…
-
Medium 6.2
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information…
-
Medium 6.2
Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information…
-
Medium 6.3
Some Honor products are affected by file writing vulnerability, successful exploitation could cause code execution
-
Medium 6.3
code-projects Travel Management System detail.php sql injection
A vulnerability was found in code-projects Travel Management System 1.0. It has been classified as critical. This affects an unknown part of the file /detail.php. The manipulation of the argument pid leads to sql injection. It is possible to initiate the atta…
-
Medium 6.3
Codezips Hospital Management System invo.php sql injection
A vulnerability was found in Codezips Hospital Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /invo.php. The manipulation of the argument dname leads to sql injection. The attack may be launc…
-
Medium 6.3
CodeAstro Blood Donor Management System deletedannounce.php sql injection
A vulnerability was found in CodeAstro Blood Donor Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /pages/deletedannounce.php. The manipulation of the argument id leads to sql injection. The attack may …
-
Medium 6.3
code-projects Job Recruitment _all_edits.php add_edu sql injection
A vulnerability was found in code-projects Job Recruitment 1.0. It has been rated as critical. This issue affects the function add_edu of the file /_parse/_all_edits.php. The manipulation of the argument degree leads to sql injection. The attack may be initia…
-
Medium 6.3
code-projects Simple Admin Panel updateOrderStatus.php sql injection
A vulnerability has been found in code-projects Simple Admin Panel 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file updateOrderStatus.php. The manipulation of the argument record leads to sql injection. Th…
-
Medium 4.7
WPForms < 1.9.2.3 - Admin+ Stored XSS
The WPForms WordPress plugin before 1.9.2.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for exam…
-
Medium 4.7
Broken Link Checker < 2.4.2 - Admin+ SSRF
The Broken Link Checker WordPress plugin before 2.4.2 does not validate a the link URLs before making a request to them, which could allow admin users to perform SSRF attack, for example on a multisite installation.
-
Medium 6.3
code-projects Simple Admin Panel addVariationController.php sql injection
A vulnerability, which was classified as critical, was found in code-projects Simple Admin Panel 1.0. Affected is an unknown function of the file addVariationController.php. The manipulation of the argument qty leads to sql injection. It is possible to launch…
-
Medium 6.3
code-projects Simple Admin Panel catDeleteController.php sql injection
A vulnerability, which was classified as critical, has been found in code-projects Simple Admin Panel 1.0. This issue affects some unknown processing of the file catDeleteController.php. The manipulation of the argument record leads to sql injection. The atta…
-
Medium 6.3
code-projects Simple Admin Panel editItemForm.php sql injection
A vulnerability classified as critical was found in code-projects Simple Admin Panel 1.0. This vulnerability affects unknown code of the file editItemForm.php. The manipulation of the argument record leads to sql injection. The attack can be initiated remotel…
-
Medium 6.3
code-projects Simple Admin Panel updateItemController.php sql injection
A vulnerability classified as critical has been found in code-projects Simple Admin Panel 1.0. This affects an unknown part of the file updateItemController.php. The manipulation of the argument p_desk leads to sql injection. It is possible to initiate the at…
-
Medium 6.3
code-projects Simple Admin Panel addCatController.php sql injection
A vulnerability was found in code-projects Simple Admin Panel 1.0. It has been classified as critical. Affected is an unknown function of the file /addCatController.php. The manipulation of the argument size leads to sql injection. It is possible to launch th…
-
Medium 6.3
code-projects Student Management System addCatController.php sql injection
A vulnerability has been found in code-projects Student Management System 1.0.00 and classified as critical. This vulnerability affects unknown code of the file /addCatController.php. The manipulation of the argument size leads to sql injection. The attack ca…