CVE Vulnerability Catalog

A vulnerability was found in GNU Binutils 2.45 in the elf_swap_shdr function in the bfd/elfcode.h library of the Linker component. Manipulation leads to a heap-based buffer overflow. The attack must be performed locally, and the exploit has been publicly disclosed.

A flaw was found in GNU Binutils 2.45 in the _bfd_elf_parse_eh_frame function in bfd/elf-eh-frame.c of the Linker component. Executing manipulation leads to a heap-based buffer overflow. The attack is restricted to local execution, and the exploit has been published.

A vulnerability has been detected in zhuimengshaonian wisdom-education (up to 1.0.4) in the selectStudentExamInfoList function of ExamInfoController.java. Manipulation of the subjectId argument leads to improper authorization. The exploit has been publicly disclosed.

A vulnerability in Campcodes Farm Management System 1.0 affects some unknown functionality, leading to file and directory information exposure. The attack can be performed remotely and the exploit is public.

A vulnerability was identified in itsourcecode Open Source Job Portal 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/user/controller.php?action=photos. The manipulation of the argument photo leads to unrestricted upload. The attack is possible to be carried out remotely. The exploit is publicly available and might be used.

A vulnerability in Keyfactor RG-EW5100BE EW_3.0B11P280_EW5100BE-PRO_12183019 affects an unknown function in /cgi-bin/luci/api/cmd of the HTTP POST Request Handler. Manipulation of the url argument results in command injection. The attack can be launched remotely and the exploit is public.

A SQL injection vulnerability was detected in SeaCMS 13.3.20250820 in an unknown function of /admin_cron.php within the Cron Task Management Module. Manipulation of the resourcefrom/collectID arguments leads to SQL injection. The attack can be launched remotely and the exploit has been publicly disclosed.

ProjectsAndPrograms School Management System 1.0 has an SQL injection vulnerability in owner_panel/fetch-data/select-students.php. Manipulating the select argument allows remote attacks. The exploit has been published.

A security vulnerability has been detected in itsourcecode Open Source Job Portal 1.0. This impacts an unknown function of the file /jobportal/admin/category/index.php?view=edit. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

The Professional Contact Form plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0.0. This is due to missing or incorrect nonce validation on the watch_for_contact_form_submit function. This makes it possible for unauthenticated attackers to trigger test email sending via a forged request if they can trick a site administrator into clicking a link.

The Trust Reviews plugin for Google, Tripadvisor, Yelp, Airbnb and other platforms for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0. This is due to missing or incorrect nonce validation on the feed_save function. This makes it possible for unauthenticated attackers to create or modify feed entries via a forged request if they can trick a site administrator into clicking a link.

The cForms – Light speed fast Form Builder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 3.0.0. This is due to missing or incorrect nonce validation on the cforms_api function. This makes it possible for unauthenticated attackers to modify forms and their settings via a forged request if they can trick a site administrator into clicking a link.

The HidePost plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 2.3.8. This is due to missing or incorrect nonce validation on the options.php settings page. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request if they can trick a site administrator into clicking a link.

The Sync Feedly plugin for WordPress (all versions up to and including 1.0.1) is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on the crsf_cron_job_func function. An unauthenticated attacker can trigger content synchronization from Feedly, potentially creating multiple posts via a forged request if they can trick a site administrator into clicking a link.

The VM Menu Reorder plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 1.0.0. This is due to missing or incorrect nonce validation on the vm_set_to_default function. This makes it possible for unauthenticated attackers to reset all menu reordering settings via a forged request if they can trick a site administrator into clicking a link.

A cross-site request forgery (CSRF) vulnerability has been found in SourceCodester Pet Grooming Management Software 1.0. The vulnerability affects unknown code and can be exploited remotely.

A flaw has been found in Portabilis i-Educar up to 2.10. This affects an unknown part of the file /periodo-lancamento. Executing manipulation can lead to improper authorization. The attack can be executed remotely. The exploit has been published and may be used.

Versions of the package github.com/nyaruka/phonenumbers before 1.2.2 are vulnerable to Improper Validation of Syntactic Correctness of Input in the phonenumbers.Parse() function. An attacker can cause a panic by providing crafted input causing a "runtime error: slice bounds out of range".

A vulnerability was detected in Portabilis i-Educar up to 2.10. Affected by this issue is some unknown functionality of the file /unificacao-aluno. Performing manipulation results in improper authorization. Remote exploitation of the attack is possible. The exploit is now public and may be used.

The Ninja Forms plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to and including 3.12.0. This is due to missing or incorrect nonce validation on the maybe_opt_in() function, allowing unauthenticated attackers to opt a site into usage statistics collection via a forged request if they can trick an administrator into clicking a link.