CVE Vulnerability Catalog

Multiple endpoints with sensitive information do not require authentication, making the application susceptible to information gathering.

In the HTTP request, the username and password are transferred directly in the URL as parameters. However, URLs can be stored in various systems such as server logs, browser histories or proxy servers. As a result, there is a high risk that this sensitive data will be disclosed unintentionally.

The application provides access to a login protected H2 database for caching purposes. The username is prefilled.

If a user tries to login but the provided credentials are incorrect, a log is created. The data for this POST request is not validated, making it possible to send giant payloads which are then logged.

When an error occurs in the application a full stacktrace is provided to the user. The stacktrace lists class and method names as well as other internal information. An attacker can thus obtain information about the technology used and the structure of the application.

An API endpoint allows arbitrary log entries to be created via POST request. Without sufficient validation of the input data, an attacker can create manipulated log entries and thus falsify or dilute logs, for example.

Due to a lack of authentication, an unauthenticated user can request data from this endpoint, making the application vulnerable to user enumeration.

The Responsive Lightbox & Gallery WordPress plugin before 2.5.3 does not properly handle HTML tag attribute modifications, potentially allowing unauthenticated attackers to abuse the functionality to include event handlers and conduct Stored XSS attacks.

The Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) WordPress plugin before 2.5.0 does not sanitize SVG file contents when uploaded through the xmlrpc.php endpoint using base64 encode, leading to a Cross-Site Scripting vulnerability.

A vulnerability was detected in zhuimengshaonian wisdom-education up to 1.0.4. The affected element is an unknown function of the file src/main/java/com/education/api/controller/student/WrongBookController.java. Performing manipulation of the argument subjectId results in authorization bypass. The attack can be initiated remotely. The exploit is now public and may be used.

A security vulnerability has been detected in zhuimengshaonian wisdom-education up to 1.0.4. Impacted is the function uploadFile of the file src/main/java/com/education/core/controller/UploadController.java. Such manipulation of the argument File leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used.

In the nahiduddinahammed Hospital-Management-System-Website up to version e6562429e14b2f88bd2139cae16e87b965024097, a SQL injection vulnerability was found in /delete.php when manipulating the 'ai' argument. The attack can be initiated remotely, and the exploit has been made public.

A cross-site scripting (XSS) vulnerability was found in qianfox FoxCMS up to version 1.2 in the /index.php/Search file, in the Search Page component. Manipulation of the keyword argument allows remote exploitation. The exploit has been made public, and the vendor did not respond.

A flaw was found in CodeCanyon/ui-lib Mentor LMS up to version 1.1.1 in an unknown functionality of the API component. Manipulation can lead to a permissive cross-domain policy with untrusted domains. The attack may be launched remotely, and the exploit has been published and may be used.

A vulnerability was detected in Belkin F9K1015 1.00.10, involving command injection in /goform/mp. Manipulation of the command argument allows remote command execution. The exploit is public and may be used.

A vulnerability was determined in Belkin F9K1015 1.00.10, involving command injection in /goform/formSetWanStatic. Manipulation of m_wan_ipaddr allows remote command execution. The exploit is publicly disclosed.

A weakness was identified in Belkin F9K1015 1.00.10, involving command injection in /goform/formBSSetSitesurvey. Manipulation of wan_ipaddr allows remote command execution. The exploit is publicly available.

ixmaps website2017 up to 0c71cffa0162186bc057a76766bc97e9f5a3a2d0 has an XSS vulnerability in /map.php within the HTTP GET Request Handler. Manipulating the trid argument results in cross-site scripting.

A vulnerability was identified in CRMEB up to 5.6.1 affecting an unknown function of the JWT HMAC Secret Handler component. Manipulating the secret argument with the default input leads to use of a hard-coded cryptographic key. The attack can be launched remotely but is highly complex and difficult to exploit; the exploit is publicly available.

In allegroai/clearml version v2.0.1, there is a path traversal vulnerability due to improper handling of symbolic and hard links in the `safe_extract` function. This can lead to arbitrary file writes outside the intended directory, potentially resulting in remote code execution.