CVE Vulnerability Catalog

Insider Threat Management (ITM) Server versions prior to 7.17.2 contain an authentication bypass vulnerability that allows unauthenticated users on an adjacent network to perform agent unregistration when the number of registered agents exceeds the licensed limit. Successful exploitation prevents the server from receiving new events from affected agents, resulting in a partial loss of integrity and availability with no impact to confidentiality.

Phpgurukul Maid Hiring Management System 1.0 is vulnerable to Cross Site Scripting (XSS) in /maid-hiring.php via the name field. The vulnerability allows injection of malicious script through this field.

Car-Booking-System-PHP v1.0 is vulnerable to Cross Site Scripting (XSS) in /carlux/booking.php. The vulnerability allows injection of malicious script that may execute in the user's browser.

Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /orders.php.

Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /edit_product.php?id=1. The vulnerability allows injection of malicious script.

Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /add_customer.php.

Water Management System v1.0 is vulnerable to Cross Site Scripting (XSS) in /add_vendor.php.

IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an attacker to access unauthorized content or perform unauthorized actions using man-in-the-middle techniques due to improper access controls.

IBM Cloud Pak For Business Automation 25.0.0, 24.0.1, and 24.0.0 could allow an authenticated user to cause a denial of service due to improper validation of input length.

In IBM Cloud Pak for Business Automation 25.0.0, 24.0.1, and 24.0.0, an authenticated user could cause dashboards to become inaccessible to legitimate users due to invalid ownership assignment. The vulnerability relates to the resource ownership assignment mechanism.

School Management System PHP version 1.0 is vulnerable to Cross Site Scripting (XSS) in /login.php via the password parameter. The vulnerability allows injection of malicious script that may execute in the user's browser.

An issue in Raspberry Pi Imager 1.9.6 for Windows affects its OS customization feature. The public-key authentication setting unintentionally re-adds the user's id_rsa.pub key from the local Windows machine to the authorized_keys file on the Raspberry Pi, even after the user explicitly deletes it in the UI.

An issue in NetSurf v3.11 causes the application to read uninitialized heap memory when creating a dom_event structure.

NetSurf 3.11 is vulnerable to use-after-free in the dom_node_set_text_content function. The vulnerability may lead to undefined behavior or potential code execution when processing a crafted page.

A security flaw was discovered in jeecgboot jeewx-boot up to commit 641ab52 in getImgUrl of WxActGoldeneggsPrizesController.java. Manipulating the imgurl argument results in path traversal, and remote exploitation is possible. The exploit is public; the initial fix can be evaded with additional encoding.

EasyFlow .NET and EasyFlow AiNet by Digiwin contain a SQL Injection vulnerability. An authenticated remote attacker can inject arbitrary SQL commands to read database contents.

A security vulnerability has been detected in PHPGurukul News Portal 1.0. The affected element is an unknown function of the file /onps/settings.py. Such manipulation of the argument SECRET_KEY leads to use of hard-coded cryptographic key. The attack may be performed from remote. The attack requires a high level of complexity. The exploitability is described as difficult. The exploit has been disclosed publicly and may be used.

A weakness has been identified in SourceCodester Best House Rental Management System 1.0. The delete_payment function in /admin_class.php is affected, where manipulation of the ID argument causes SQL injection. The attack can be carried out remotely and the exploit is publicly available.

Campcodes School Fees Payment Management System 1.0 has a SQL Injection vulnerability in /ajax.php?action=delete_course via manipulation of the ID argument. The attack can be executed remotely and a public exploit is available.

A vulnerability was determined in CodeAstro Gym Management System 1.0. An unknown part of /admin/view-progress-report.php is affected, where manipulation of the ID argument can lead to SQL injection. The attack may be launched remotely and the exploit has been publicly disclosed.