CVE Vulnerability Catalog

A vulnerability was found in bluebox up to version 4.5.12, allowing Cross-Site Scripting (XSS) via manipulation of the 'code' argument. The attack can be performed remotely and the exploit has been made public.

A SQL injection vulnerability has been found in itsourcecode Hospital Management System 1.0 in the file /patientorder.php. An unknown function allows manipulation of the editid argument, enabling remote SQL injection. The exploit has been publicly disclosed.

A SQL injection vulnerability was found in the Internship Management System 1.0 in the file employer/details/change_password.php. An attacker can remotely manipulate the Current argument, leading to SQL injection. The exploit is publicly available.

A security flaw has been discovered in SourceCodester Syllabus-Aligned Learning Management and Examination System 1.0. An unknown function in upload_files.php allows unrestricted file upload, which can be exploited remotely. The exploit has been publicly released and may be used in attacks.

A SQL injection vulnerability was found in the cancel_order function of classes/Master.php in SourceCodester Multi-Vendor Online Grocery Management System 1.0. An attacker can remotely manipulate the ID argument, leading to SQL injection.

A vulnerability has been found in SourceCodester Multi-Vendor Online Grocery Management System 1.0 in the cancel_order function of classes/Master.php. Manipulation of this function can lead to improper authorization. The attack can be performed remotely and the exploit has been published.

A SQL injection vulnerability was found in SourceCodester Multi-Vendor Online Grocery Management System 1.0/5.7.26. The issue affects the save_shop_type function in classes/Master.php, which improperly handles POST parameters. The attack can be performed remotely, and the exploit is publicly available.

A security vulnerability has been detected in SourceCodester Multi-Vendor Online Grocery Management System 1.0, involving code injection in the update_settings_info function of classes/SystemSettings.php. The attack can be executed remotely, and the exploit has been publicly disclosed.

A SQL injection vulnerability has been discovered in CodeAstro Apartment Visitor Management System 1.0 in the file /apartment-visitor/add-apartment.php. An attacker can remotely manipulate the apartmentno argument, leading to SQL injection. The exploit has been publicly released.

A vulnerability was found in the InsightEngine component of BettaFish up to version 1.2.1 in the _deduplicate_results function of InsightEngine/agent.py. Input manipulation can lead to partial string comparison, allowing remote attacks. The exploit has been publicly disclosed and may be used.

A SQL injection vulnerability has been found in itsourcecode Hospital Management System 1.0 in the file /patientappointment.php. An attacker can remotely manipulate the 'patiente' argument, leading to SQL injection. The exploit has been publicly disclosed.

A SQL injection vulnerability was found in Assessment Management 1.0 in the file /lecturer/marking-scheme.php. An attacker can remotely manipulate the smarksrange[] argument, leading to SQL injection. The exploit is publicly available.

A SQL injection vulnerability has been found in code-projects Assessment Management 1.0 in the file /lecturer/marking-scheme.php. An attacker can remotely manipulate the squestions[] argument, leading to unauthorized database access. The exploit has been published and may be used.

A cross-site scripting vulnerability has been found in Assessment Management 1.0 in the /admin/remove-user.php file. Manipulation of the ID argument allows remote script injection. The exploit is publicly available and may be used.

The silent Just-In-Time (JIT) provisioning feature in federated authentication implementations fails to properly segregate user roles during account creation when a federated user shares a username with a local user. This allows the provisioning process to overwrite existing roles of local users with roles assigned to the federated user.

A vulnerability has been identified in the onnxruntime component of the onnx library up to version 1.21.x, involving an out-of-bounds read in the convPoolShapeInference_opset19 function in onnx/defs/nn/old.cc. The attack can be initiated remotely, and the exploit has been made public.

A SQL injection vulnerability has been found in CodeAstro Ecommerce Website 1.0 in the file /ecommerce-website-php/customer/my_account.php?edit_account. The attack involves manipulating the c_name argument, allowing remote SQL injection. The exploit has been publicly disclosed.

A SQL injection vulnerability has been found in itsourcecode Hospital Management System 1.0 in the /patient.php file. An attacker can remotely manipulate the editid argument, leading to unauthorized database access. The exploit has been published and may be used.

A path traversal vulnerability has been identified in the Vendor Image Manager component of Ecommerce-CodeIgniter-Bootstrap. The do_upload_others_images function in AddProduct.php allows manipulation of the folder argument, enabling remote file access outside the intended directory.

A vulnerability was found in kirilkirkov Ecommerce-CodeIgniter-Bootstrap up to version 213babdbaa949e94557246414db0130e01394517. The checkForPostRequests function in application/core/MY_Controller.php is affected by cross-site scripting via the User-Agent argument, allowing remote attacks.