CVE Vulnerability Catalog

A weakness has been identified in SourceCodester Alumni Management System 1.0. The impacted element is an unknown function of the file /manage_career.php. This manipulation of the argument ID causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited.

A vulnerability was reported in the Lenovo Scanner pro application during an internal security assessment that, under certain circumstances, could allow an attacker on the same logical network to disclose sensitive user files from the application.

Dell SmartFabric OS10 Software, versions prior to 10.6.1.0, contain an Improper Control of Generation of Code ('Code Injection') vulnerability. A high privileged attacker with local access could potentially exploit this vulnerability, leading to Code execution.

A heap-use-after-free vulnerability exists in airpig2011 IEC104 through commit be6d841 (2019-07-08). During multi-threaded client execution, the Iec10x_Scheduled function can access freed memory, potentially causing crashes or undefined behavior.

A stored cross-site scripting (XSS) in the Business Line Management module of Xxl-api v1.3.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the Name parameter.

A vulnerability was identified in Campcodes School Fees Payment Management System 1.0. Impacted is an unknown function of the file /ajax.php?action=save_student. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

A Cross-Site Request Forgery (CSRF) vulnerability in xxl-api v1.3.0 allows attackers to arbitrarily add users to the management module via a crafted GET request.

Omnissa Workspace ONE UEM contains an observable response discrepancy vulnerability. An attacker may enumerate sensitive information such as tenant ID and user accounts. This facilitates brute-force, password-spraying, and credential-stuffing attacks.

A Cross Site Scripting (XSS) vulnerability in CrushFTP 11.3.6_48. The web-based server has a file-sharing feature that reflects the filename into an email body field without sanitization, leading to HTML injection.

Cross Site Scripting vulnerability in CentralSquare Community Development 19.5.7 via form fields.

A vulnerability in kdcproxy allows an attacker to perform a DoS attack by sending unbounded data in a KDC response, causing excessive memory and CPU usage. The lack of TCP response length validation and inefficient buffer management can overwhelm the server even with a single request.

A cross-site scripting (XSS) vulnerability exists in the generate report functionality in Rarlab WinRAR 7.11. The generate report command includes archived file names without validation in the HTML report, allowing potentially malicious HTML tags to be injected and disclosing user information such as the computer username, generated report directory, and IP address. User interaction is required: the user must use the generate report functionality and open the report.

N-central < 2025.4 can generate sessionIDs for unauthenticated users. This issue affects N-central: before 2025.4.

A CWE-307 vulnerability exists due to improper restriction of excessive authentication attempts. An attacker on the local network can gain access to a user account by performing an arbitrary number of authentication attempts with different credentials on the /REST/shutdownnow endpoint.

An execution with unnecessary privileges vulnerability in lightdm-kde-greeter allows escalation from the service user to root. This issue affects versions before 6.0.4.

A vulnerability in the Linux kernel related to the use of smp_processor_id() in preemptible code has been fixed. The bug report concerned a warning generated by dhcpcd, indicating improper use of this function in a preemptible context.

The Specific Content For Mobile – Customize the mobile version without redirections plugin for WordPress is vulnerable to SQL Injection via the eos_scfm_duplicate_post_as_draft() function in all versions up to and including 0.5.5 due to insufficient escaping of a user-supplied parameter and lack of proper preparation of the SQL query.

A missing authorization vulnerability in Apache OpenOffice allows an attacker to craft a document that causes external links to be loaded without prompting the user. Such links could also be used to transmit system information, such as environment variables or configuration settings.

A reflected cross-site scripting vulnerability exists in Apache OFBiz. This issue affects versions before 24.09.03.

Origin Validation Error in Kibana can lead to Server-Side Request Forgery via a forged Origin HTTP header processed by the Observability AI Assistant.