CVE Vulnerability Catalog

ASPRunner Professional 6.0.766 contains a local buffer overflow vulnerability that allows attackers to cause a denial of service by supplying an excessively long project name. Attackers can paste 180 or more characters into the Project name field during project creation to trigger an application crash.

a-Mac Address Change version 5.4 contains a local buffer overflow vulnerability. An attacker can supply oversized input (212 bytes) to registration form fields, causing the application to crash.

AnyBurn 4.3 x86 contains a denial of service vulnerability that allows local attackers to crash the application by supplying an excessively long string to the image conversion function. Attackers can paste a large buffer into the source or destination image file fields and click 'Convert Now' to trigger a crash.

Local buffer overflow vulnerability in IP TOOLS 2.50 in the SNMP Scanner component. A local attacker can supply oversized input in the 'From Addr' and 'To Addr' fields and click the Start button, causing a crash and SEH overwrite.

A path traversal vulnerability was found in griptape-ai griptape 0.19.4 in the FileManagerTool component. The functions load_files_from_disk, list_files_from_disk, save_content_to_file, and save_memory_artifacts_to_disk improperly validate paths, allowing remote attack. The exploit has been publicly disclosed and may be used.

Code injection vulnerability in premAI-io premsql up to version 0.2.1. The eval function in premsql/agents/baseline/workers/followup.py allows manipulation of the result argument, leading to code injection. Remote attack possible. Exploit published. Vendor unresponsive.

SQL Injection vulnerability in MAC-SQL (up to commit 31a9df5e0d520be4769be57a4b9022e5e34a14f4). The _execute_sql function in core/agents.py of the Refiner Agent component allows manipulation leading to SQL injection. Remote attack is possible, exploit is public. Vendor did not respond.

zhongyu09 openchatbi up to version 0.2.1 is vulnerable to SQL injection via the 'keywords' argument in the Multi-stage Text2SQL Workflow component. An attacker can remotely manipulate this argument, leading to unauthorized SQL queries. The exploit has been publicly disclosed.

In Tencent AI-Infra-Guard 4.0, there is a vulnerability in an unknown function of common/websocket/task_manager.go in the Task Detail Endpoint component. Manipulation leads to information disclosure. The attack can be remote. The exploit is public, and the vendor has not responded.

SQL Injection vulnerability in PHPGurukul Online Shopping Portal Project 2.1. Unknown part of /my-profile.php in Parameter Handler allows manipulation of fullname argument, leading to SQL injection. Remote attack possible. Exploit published.

In CodeAstro Online Classroom 1.0, a SQL injection vulnerability was found in the file /OnlineClassroom/addvideos.php via manipulation of the videotitle argument. The attack can be performed remotely and the exploit is publicly available.

In CodeAstro Online Classroom 1.0, a SQL injection vulnerability was found in the file /OnlineClassroom/updatedetailsfromfaculty.php?myfid=108 via manipulation of the fname argument. The attack can be performed remotely and the exploit has been publicly disclosed.

In CodeAstro Online Classroom 1.0, an SQL injection vulnerability exists in /OnlineClassroom/addassessment.php via manipulation of the deleteid argument. Remote exploitation is possible and the exploit is public.

SourceCodester/jkev Record Management System 1.0 allows unrestricted file upload via save_emp.php on the Add Employee page. Remote exploitation is possible and the exploit is public.

Missing authorization in the deletefile function of the FsBrowseClean component in Technostrobe HI-LED-WR120-G2 (version 5.5.0.1R6.03.30). Manipulation of the dir/path argument allows remote file deletion.

Technostrobe HI-LED-WR120-G2 version 5.5.0.1R6.03.30 is vulnerable to CSRF in an unknown function. The attack can be performed remotely, and the exploit has been publicly released.

Technostrobe HI-LED-WR120-G2 version 5.5.0.1R6.03.30 has a vulnerability in an unknown function of the /fs file in the Configuration Data Handler component. Manipulating the File argument leads to information disclosure. The attack is remote, and the exploit is public. The vendor did not respond.

SQL Injection vulnerability in AutohomeCorp frostmourne up to version 1.0. The httpTest function in /api/monitor-api/alarm/previewData in Alarm Preview component allows manipulation leading to SQL injection. Remote attack possible. Exploit published.

Campcodes Complete POS Management and Inventory System up to 4.0.6 has an injection vulnerability in SettingsController.php in the Environment Variable Handler component. Remote attack is possible and the exploit is public.

A SQL injection vulnerability was found in PHPGurukul Online Shopping Portal Project 2.1 in the file /payment-method.php. Manipulation of the paymethod argument allows remote attack. The exploit has been made public.