CVE Vulnerability Catalog

A cross-site scripting vulnerability was found in SourceCodester Pizzafy Ecommerce System 1.0 in the file /admin/ajax.php?action=save_user via manipulation of the Name argument. The attack can be executed remotely and the exploit is publicly available.

A cross-site scripting vulnerability was found in SourceCodester Pizzafy Ecommerce System 1.0 in the file /admin/ajax.php?action=save_order via manipulation of the first_name argument. The attack can be executed remotely and the exploit is publicly available.

SourceCodester Pizzafy Ecommerce System 1.0 is vulnerable to XSS in the save_menu function of /admin/ajax.php?action=save_menu via the Name argument. The attack is remote and the exploit is public.

A vulnerability was found in SourceCodester Pizzafy Ecommerce System 1.0 in the save_settings function of /admin/index.php?page=save_settings. Manipulating the Name argument causes cross-site scripting. The attack may be initiated remotely, and the exploit has been published and may be used.

In Spring gRPC, the raw message of every server-side AuthenticationException is returned to the unauthenticated remote caller in the gRPC status description. This lets an attacker obtain information about the authentication failure, which may aid further attacks. Versions 1.0.0–1.0.2 are affected (fixed in 1.0.3), as are older unsupported versions.

A vulnerability was determined in SourceCodester Pharmacy Sales and Inventory System 1.0 in the supplier function of /index.php?page=supplier. Manipulating the Name argument leads to cross-site scripting. The attack may be performed remotely, and the exploit has been publicly disclosed and may be utilized.

A vulnerability was found in SourceCodester Pharmacy Sales and Inventory System 1.0. Affected is an unknown function of the file /index.php?page=product. Performing a manipulation of the argument ID results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used.

A vulnerability was found in Artifex MuPDF, specifically an out-of-bounds read in the fz_subset_cff_for_gids function of subset-cff.c, which handles CFF indexes. The attack requires local access, and the exploit has been publicly disclosed. The project was notified but has not responded.

XSS vulnerability in Coaching Management System 1.0 in file /cims/modules/student/complaint.php. Manipulation of the Complaint argument allows remote cross-site scripting. Exploit is publicly available.

A transient execution vulnerability within AMD CPUs may allow a local user-privileged attacker to leak data via the floating point divisor unit, potentially resulting in loss of confidentiality.

In code-projects Invoice System in Laravel 1.0, manipulation of the item name/description argument in the /item file leads to cross-site scripting. The attack can be launched remotely, and the exploit has been published and may be used.

A vulnerability was found in Chat System 1.0 involving use of a weak hash (MD5) when handling the Password argument in update_user.php. The attack is remotely possible, though rated high complexity, and a public exploit has been disclosed.

A vulnerability was detected in code-projects Chat System 1.0. It affects an unknown function in /admin/send_message.php within the Chat Interface component. Manipulation of the msg argument results in cross site scripting, and the attack may be launched remotely.

A vulnerability was detected in 666ghj MiroFish up to 0.1.2. An unknown function in the /console file of the Werkzeug Debugger PIN Handler component, when manipulating the SECRET argument, results in information disclosure. The attack can be initiated remotely, is highly complex, and the exploit is publicly available.

A weakness has been identified in tufantunc ssh-mcp up to 1.5.0 in an unknown function of src/index.ts in the Command Line Handler component, causing insufficiently protected credentials. The attack is restricted to local execution, and the exploit has been made public. The project was informed but has not responded.

A vulnerability was identified in D-Link DSL-2740R EU_01.15 affecting an unknown function of the Wireless Setup Section. Manipulation of the Wireless Network Name argument leads to cross site scripting, and the attack can be executed remotely. The exploit is publicly available.

In SmythOS sre up to 0.0.15, manipulation of the baseURL argument in packages/sdk/src/LLM/utils.ts of the Connector Service causes information disclosure. Remote exploitation is possible, the exploit is publicly available and could be used for attacks, and the vendor did not respond to the disclosure.

A vulnerability was found in MaxSite CMS up to 109.3. An unknown function of the ushki Plugin component is impacted. Manipulation of the f_ushka_new/f_ushk argument results in cross site scripting, remote exploitation is possible, and the exploit has been made public. The vendor classifies it as "Self-XSS" and recommends upgrading to 109.4.

A vulnerability has been found in MaxSite CMS up to 109.3. Some unknown processing of the Guestbook Plugin component is affected. Manipulation of the f_text/f_slug/f_limit/f_email argument leads to cross site scripting, the attack may be launched remotely, and the exploit has been disclosed publicly. The vendor classifies it as "Self-XSS" and recommends upgrading to 109.4.

A flaw was found in MaxSite CMS up to 109.3 in the down_count Plugin. Manipulation of the f_file/f_prefix arguments leads to cross-site scripting (XSS), and the attack can be launched remotely. The exploit is publicly available, and the vendor classifies it as Self-XSS and fixed it in version 109.4.