CVE Vulnerability Catalog

A cross-site scripting vulnerability was found in SourceCodester Indian Invoicing System 1.0 in the file /Invoicing/category.php. Manipulation of the msg argument allows remote injection of malicious scripts. The exploit is publicly available.

A vulnerability was found in SourceCodester Indian Invoicing System 1.0 in an unknown function of the Backend Endpoint component. Manipulation leads to improper access controls. The attack can be launched remotely. The exploit has been publicly disclosed and may be used. Multiple endpoints are affected.

A SQL Injection vulnerability has been found in SourceCodester Indian Invoicing System 1.0 in the file /Invoicing/IGST_Invoice.php of the Invoice Generation Handler component. Manipulation of the customer_name/category arguments leads to SQL injection. The attack can be initiated remotely, and the exploit has been made public.

A vulnerability was found in Sushmi-pal Invoice-System up to a0a3faa16dee2621b231ae227333f5761607283b in unknown code of the /profile file in the Profile Workflow component. Manipulation of the ID argument leads to improper authorization. The attack can be launched remotely. The exploit has been publicly disclosed. The vendor did not respond.

A vulnerability was found in Sushmi-pal Invoice-System up to a0a3faa16dee2621b231ae227333f5761607283b in an unknown part of the /user file in the User Management Handler component. Manipulation of the role argument leads to improper authorization. The attack can be launched remotely. The exploit has been published. The vendor did not respond.

A command injection vulnerability has been found in Edimax BR-6675nD version 1.12 in the formWlanMP function of the /goform/formWlanMP file. The attack can be launched remotely by manipulating multiple arguments.

A command injection vulnerability has been found in Edimax BR-6675nD version 1.12 in the formUSBStorage function of the /goform/formUSBStorage file. The attack can be launched remotely by manipulating the sub_dir argument.

A command injection vulnerability has been found in Edimax BR-6675nD version 1.12 in the formWpsStart function of the /goform/formWpsStart file. The attack can be launched remotely by manipulating the pinCode argument.

A vulnerability in Edimax BR-6675nD 1.12. The formHwSet function in /goform/formHwSet of the POST Request Handler component allows command injection via regDomain/ABandregDomain/nic0Addr/nic1Addr/wlanAddr/inicAddr arguments. Remote attack, exploit public.

An improper authorization vulnerability has been found in JPress up to version 1.0.3 in the UCenter Article Submission endpoint. Manipulation of id/userId arguments can lead to unauthorized access. The attack can be performed remotely and the exploit is publicly available.

A vulnerability was found in yangzongzhuan RuoYi-Vue up to 3.9.2 in the FileUploadUtils.upload function in the /common/upload file of the Common Upload Endpoint component. Manipulation leads to unrestricted upload. The attack can be launched remotely. The vendor did not respond.

A missing authentication vulnerability was found in the API component of Vane up to version 1.12.1, specifically in the route.ts file. The attack can be performed remotely but is considered difficult. The exploit has been publicly disclosed.

In NousResearch hermes-agent version 2026.4.23, a flaw was found in the _discover_dashboard_plugins function of the hermes_cli/web_server.py file. Manipulation of the HERMES_ENABLE_PROJECT_PLUGINS argument leads to incorrect comparison. The attack requires local access and the exploit has been published.

In Ettercap up to version 0.8.3, a heap-based buffer overflow exists in the FUNC_DECODER function of the GG Dissector component (file ec_gg.c). Manipulation of the gg argument can lead to a remote attack, though exploitation is difficult.

A command injection vulnerability has been found in Edimax EW-7438RPn version 1.12 in the formEZCHNwlanSetup function of the /goform/formEZCHNwlanSetu file. The attack can be launched remotely by manipulating the method argument.

A command injection vulnerability has been found in Edimax EW-7438RPn version 1.12 in the formConnectionSetting function of the /goform/formConnectionSetting file. The attack can be launched remotely by manipulating the max_Conn and timeOut arguments.

A command injection vulnerability has been found in Edimax EW-7438RPn version 1.12 in the formAccept function of the /goform/formAccep file. The attack can be launched remotely by manipulating the submit-url argument.

A command injection vulnerability was identified in Edimax EW-7438RPn version 1.28a in the formHwSet function of the /goform/formHwSet file. An attacker can remotely manipulate arguments such as Anntena, Mcs, regDomain, and others, leading to arbitrary command execution. The exploit is publicly available and may be used.

Vulnerability in postcss-selector-parser up to 6.1.2/7.1.2 affects the toString function in src/selectors/container.js (AST Serialization component). Manipulation can lead to uncontrolled recursion. Remote attack is possible. Fixed in versions 6.1.3 and 7.1.3.

Vulnerability due to improper output escaping in the format_message function in Slack Agent/Mattermost Agent in hermes-agent. Manipulation of the format_message argument allows code injection.