CVE Vulnerability Catalog

In PyBlade versions 0.1.8-alpha and 0.1.9-alpha, the function _is_safe_ast in sandbox.py (AST Validation component) improperly neutralizes special elements used in a template engine. The attack can be performed remotely, and the exploit has been publicly disclosed.

In PHPGurukul Online Shopping Portal Project up to version 2.1, a SQL injection vulnerability was found in the file /pending-orders.php via manipulation of the ID argument. The attack can be performed remotely and the exploit has been published.

In pi-mono up to version 0.58.4, the pi-mom Slack Bot component in packages/mom/src/slack.ts has an authentication bypass vulnerability via an alternate channel. The attack can be executed remotely and the exploit is public.

pi-mono up to 0.58.4 has a code injection vulnerability in the discoverAndLoadExtensions function in loader.ts. Remote exploitation is possible and the exploit is public.

In itsourcecode Online Cellphone System 1.0, a SQL injection vulnerability was found in the file /cp/available.php via manipulation of the Name argument. The attack can be performed remotely and the exploit is publicly available.

A SQL injection vulnerability was identified in PHPGurukul Online Shopping Portal Project 2.1 in the file /sub-category.php. Manipulation of the pid argument allows remote attack. The exploit has been made public.

Vulnerability in Tenda AC10 version 16.03.10.10_multi_TDE01, in the file /webroot_ro/pem/privkeySrv.pem of the RSA 2048-bit Private Key Handler component. Manipulation leads to use of a hard-coded cryptographic key. Remote attack possible, exploit publicly available.

In the Tenda AC10 router version 16.03.10.10_multi_TDE01, the function formAddMacfilterRule in file /bin/httpd is vulnerable to OS command injection. The attack can be performed remotely, and multiple endpoints may be affected.

In Campcodes Complete Online Learning Management System 1.0, an unrestricted file upload vulnerability was found in the add_lesson function in the file /application/models/Crud_model.php. The attack can be performed remotely and the exploit has been published.

SQL Injection vulnerability in PHPGurukul User Registration & Login and User Management System 3.3. An unknown function in the file /admin/yesterday-reg-users.php allows manipulation of the ID argument, leading to SQL injection. Remote attack is possible, exploit is public.

A cross-site scripting (XSS) vulnerability was found in code-projects Simple Laundry System 1.0 in the file /modstaffinfo.php. Manipulating the userid argument allows remote script injection. The exploit has been publicly disclosed.

The Simple Laundry System 1.0 has an XSS vulnerability in the file /modmemberinfo.php. Manipulation of the userid argument leads to reflected XSS. The attack can be launched remotely, and the exploit has been published.

Race condition vulnerability during TCP connection teardown in an unspecified component. The tcp_recv() function may operate on a released connection. If tcp_conn_search() returns NULL while processing a SYN packet, a NULL pointer is passed to tcp_backlog_is_full() and dereferenced without validation, causing a crash.

The Simple Laundry System 1.0 has an XSS vulnerability in the file /modifymember.php. Manipulation of the firstName argument leads to reflected XSS. The attack can be launched remotely, and the exploit has been published.

QingdaoU OnlineJudge up to version 1.6.1 has a Server-Side Request Forgery (SSRF) vulnerability in the service_url function of JudgeServer.service_url in the judge_server_heartbeat endpoint. Manipulation of this parameter allows SSRF attacks.

A SQL injection vulnerability was found in halex CourseSEL up to version 1.1.0 in the check_sel function of IndexController.class.php. Manipulation of the seid argument via HTTP GET allows remote attack. The exploit has been disclosed, and the vendor did not respond.

FedML-AI FedML versions up to 0.8.9 contain a path traversal vulnerability in the MQTT Message Handler component in FileUtils.java. An attacker can remotely manipulate the dataSet argument, leading to access to files outside the allowed directory.

In badlogic pi-mono 0.58.4, a cross-site scripting (XSS) vulnerability exists in packages/web-ui/src/tools/artifacts/SvgArtifact.ts in the SVG Artifact Handler component. Remote exploitation is possible and the exploit is public.

A vulnerability was detected in ScrapeGraphAI scrapegraph-ai up to version 1.74.0 allowing OS command injection via the create_sandbox_and_execute function in scrapegraphai/nodes/generate_code_node.py. The attack can be launched remotely and the exploit is publicly available. The vendor did not respond.

Cleartext storage vulnerability in SourceCodester Student Result Management System 1.0. An unknown function in the file /login_credentials.txt of the HTTP GET Request Handler component stores credentials in cleartext. The attack can be performed remotely, exploit is public.