CVE Vulnerability Catalog

An attacker that gains SSH access to an unprivileged account may be able to disrupt services (including SSH), causing persistent loss of availability.

A flaw has been found in abhicodebox ModernShop 20250922. This issue affects some unknown processing of the file /search. Executing manipulation of the argument q can lead to cross site scripting. The attack may be performed from remote. The exploit has been published and may be used.

A vulnerability was detected in Zytec Dalian Zhuoyun Technology Central Authentication Service up to version 20251009. The function _empty of the file /index.php/auth/widget is affected. Manipulation of arguments get.layer/get.widget/get.action results in code injection. The attack can be performed remotely, and the exploit is public.

A vulnerability was identified in code-projects Online Event Judging System 1.0. Affected is an unknown function of the file /edit_judge.php. The manipulation of the argument judge_id leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.

A vulnerability was determined in code-projects Online Event Judging System 1.0. This impacts an unknown function of the file /edit_criteria.php. Executing manipulation of the argument crit_id can lead to sql injection. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

A Denial of Service (DoS) vulnerability exists in the ZTE MC889A Pro product. Due to insufficient validation of input parameters in the Short Message Service interface, an attacker can exploit it to perform a DoS attack.

A SQL injection vulnerability was found in CodeAstro Gym Management System 1.0 in the file /admin/actions/remove-announcement.php. Manipulation of the argument ID allows remote attack. The exploit has been made public and could be used.

The Online Event Judging System 1.0 by code-projects is vulnerable to SQL injection in /edit_contestant.php via the contestant_id argument. The attack can be executed remotely, and the exploit is publicly available.

A security flaw has been discovered in code-projects Online Event Judging System 1.0. The file /add_contestant.php is affected. Manipulation of the argument fullname results in SQL injection. Remote exploitation is possible, and the exploit is public.

A vulnerability was identified in code-projects Online Event Judging System 1.0. The file /add_judge.php is affected. Manipulation of the argument fullname leads to SQL injection. The attack may be launched remotely, and the exploit is publicly available.

A vulnerability was found in code-projects Online Event Judging System 1.0. The file /ajax/action.php is affected. Manipulation of the argument content results in SQL injection. The attack can be launched remotely, and the exploit has been made public.

A flaw was found in OpenWGA 7.11.12 Build 737. An unknown function of the WGA.File file in the TMLScript API component is affected. Manipulation can lead to path traversal. The attack can be launched remotely. The exploit has been published and may be used. The vendor was contacted early but did not respond.

On Wear OS devices, when Google Messages is configured as the default SMS/MMS/RCS application, the handling of ACTION_SENDTO intents using the sms:, smsto:, mms:, and mmsto: URI schemes is incorrectly implemented. An attacker capable of invoking an Android intent can send messages on the user's behalf without further interaction or permissions.

A vulnerability was detected in Axosoft Scrum and Bug Tracking 22.1.1.11545. The impacted element is an unknown function of the component Edit Ticket Page. Performing manipulation of the argument Title results in csv injection. It is possible to initiate the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

A cross-site scripting (XSS) vulnerability was found in Chatwoot up to 4.7.0 in the Admin Interface component, specifically in app/javascript/shared/components/IframeLoader.vue. Manipulating the Link argument allows script execution, and the attack can be performed remotely.

A vulnerability was identified in Chatwoot up to version 4.7.0 affecting the initPostMessageCommunication function in app/javascript/sdk/IFrameHelper.js of the Widget component. Manipulation of the baseUrl argument leads to an origin validation error. The vendor was contacted but did not respond.

A cross-site scripting (XSS) vulnerability was found in Simple E-Banking System 1.0 in the file /eBank/register.php. Manipulation of the Username argument allows injection of malicious script. The attack can be launched remotely and the exploit has been publicly disclosed.

A vulnerability was found in code-projects Client Details System 1.0. The file clientdetails/welcome.php in the GET Parameter Handler component is affected. Manipulation of the argument ID results in SQL injection. The attack can be initiated remotely and the exploit has been made public.

A vulnerability has been found in CodeAstro Gym Management System 1.0. The file /admin/actions/check-attendance.php is affected. Manipulation of the argument ID leads to SQL injection. The attack can be launched remotely, and the exploit has been disclosed to the public.

A security flaw has been discovered in code-projects Automated Voting System 1.0. The affected element is an unknown function of the file /admin/user.php. Performing manipulation of the argument Username results in sql injection. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited.