CVE Vulnerability Catalog

A critical vulnerability was found in the Agro-School Management System version 1.0. Manipulation of the 'password' argument in the index.php file leads to SQL injection.

A critical vulnerability was found in the Agro-School Management System version 1.0. This issue affects some unknown processing of the file btn_functions.php of the Attachment Image Handler component, leading to unrestricted file uploads.

A critical vulnerability was found in SourceCodester Online Exam Form Submission 1.0, affecting the file /admin/update_s6.php. Manipulation of the argument id leads to SQL injection.

A vulnerability was found in YFCMF up to 3.0.4, allowing path traversal attacks through manipulation of the controllername argument in app/admin/controller/Ajax.php.

The Mobatime web application has an incorrect authorization vulnerability that allows privilege escalation through incorrectly configured access control security levels.

Improper limitation of a pathname leads to a Path Traversal vulnerability in the King-Avis module for Prestashop, allowing a user knowing the download token to read arbitrary local files. This issue affects King-Avis versions before 17.3.15.

A vulnerability was found in YFCMF up to version 3.0.4, affecting unknown code in the index.php file. The manipulation leads to path traversal: '../filedir'.

The eScan management console by Microworld Technologies version 14.0.1400.2281 has a reflected Cross Site Scripting (XSS) vulnerability in the view dashboard detail feature. This allows a remote attacker to inject arbitrary code via the URL.

mp4v2 v2.1.3 was discovered to contain a memory leak when a method calling MP4File::ReadBytes() had allocated memory but did not catch exceptions thrown by ReadBytes().

The BT21 x BTS Wallpaper app 12 for Android allows unauthorized apps to request permission to insert data into the user preferences database. Injecting malicious image URLs causes memory overload and app crashes.

eMedia Consulting simpleRedak up to version 2.47.23.05 was found to contain a stored cross-site scripting (XSS) vulnerability via the component #/de/casting/show/detail/<ID>.

The captive portal in Inpiazza Cloud WiFi versions prior to v4.2.17 does not enforce limits on the number of attempts for password recovery, allowing attackers to brute force valid user accounts to gain access to login credentials.

Kyverno, a policy engine designed for Kubernetes, in versions prior to 1.10.0 allowed resources with the `deletionTimestamp` field defined to bypass validation, generation, or mutation policies. Resources pending deletion were consciously exempted from processing, which could enable malicious users to manipulate policies.

Janino 3.1.9 and earlier are subject to denial of service (DOS) attacks when using the expression evaluator.guess parameter name method. If the parser runs on user-supplied input, an attacker could supply content that causes the parser to crash due to a stack overflow.

Hawtio version 2.17.2 is vulnerable to Path Traversal. It is possible to input malicious zip files, which can result in high-risk files being stored in any location, even leading to file overwrite.

A vulnerability has been found in Guangdong Pythagorean OA Office System up to version 4.50.31, allowing cross-site request forgery (CSRF) attacks through manipulation of the id argument in the /note/index/delete file.

Version 2.1.3 of the mp4v2 library was found to contain a memory leak in the MP4SdpAtom::Read() function in atom_sdp.cpp.

Version 2.1.3 of the mp4v2 library was found to contain a memory leak in the MP4StringProperty class in mp4property.cpp.

Version 4.1 of the iniparser library is vulnerable to NULL Pointer Dereference in the iniparser_getlongint function, which misses a NULL check for the return of the iniparser_getstring function.

A Cross-site Scripting (XSS) vulnerability exists in the GitHub repository jgraph/drawio prior to version 21.2.8, allowing for the storage of malicious code.