CVE Vulnerability Catalog

The Bit Integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress in all versions up to and including 2.10.6 is vulnerable to Stored Cross-Site Scripting via the field mapped to notification_content (attacker-chosen key, e.g. payload_text) due to insufficient input sanitization and output escaping. Exploitation requires a site administrator to have preconfigured a Bit Integrations flow binding the public Bit Assist webhook to a BuddyBoss "Send Notification" action with a form field mapped to notification_content, and the attacker to know the flow's UUID callback URL.

Command injection in the backup function in Teltonika Networks RUTOS 7.22 before 7.24.6 and 7.25 before 7.25.2 (RUT, RUTX, RUTM, RUTC, ATRM, CAP, OXA, DAP, TRB, OTD, and EBG devices), RUTOS 7.22 before 7.25.2 (TAP devices), and TSWOS 1.9 before 1.10.4 (TSW and SWM devices) allows a remote authenticated attacker to execute arbitrary OS commands.

A security flaw has been discovered in SourceCodester Library Management System 1.0 affecting the move_uploaded_file function in admin/add_admin.php. Manipulation of the image argument results in unrestricted upload. The attack may be initiated remotely and the exploit has been released to the public.

A vulnerability was identified in SourceCodester E-Learning System 1.0 affecting the save_users function in /classes/Users.php?f=save. Manipulation of the img argument leads to unrestricted upload. The attack can be launched remotely and the exploit is publicly available.

A vulnerability was determined in SourceCodester Contact Tracing System 1.0 affecting the move_uploaded_file function in /classes/Users.php?f=save. Manipulation of the img/id argument causes unrestricted upload. The attack can be initiated remotely and the exploit has been publicly disclosed.

The macOS version of the DigiD app is not signed with Hardened Runtime. This allows a local process to load its own dylib into DigiD via DYLD_INSERT_LIBRARIES. An attacker with local user-level code execution can execute arbitrary code within the app, gaining access to DigiD data and cryptographic capabilities.

A vulnerability was found in SourceCodester Human Resource Management System 1.0 in the session_start function of controller/employee.php in the Employee Endpoint component. Manipulation of role/pfimg/EmpId arguments leads to improper authentication. The attack can be launched remotely and the exploit is public.

A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449 in the MySQLDB::addNewUser function of include/database.php in the Registration Form component. Manipulation of the branch argument results in SQL injection. The attack is remotely possible and the exploit is public. The project has not responded.

A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449 in the Session::checkLogin function of include/session.php in the Session Handler component. Manipulation of cookname/cookid arguments leads to incorrect comparison. The attack can be executed remotely and the exploit is public. The project has not responded.

SourceCodester Performance Indicator System 1.0 contains a SQL injection vulnerability in the file /opils/staff/sales_history.php. Manipulation of the ID argument leads to SQL injection. The attack can be performed remotely, and the exploit has been publicly released.

SourceCodester Performance Indicator System 1.0 contains a SQL injection vulnerability in the file /opils/staff/edit_credit.php. Manipulation of the credit argument leads to SQL injection. The attack can be performed remotely, and the exploit has been publicly released.

A SQL injection vulnerability was identified in SourceCodester Performance Indicator System 1.0 in the file /opils/staff/product.php. Manipulation of the Category argument allows remote attack. The exploit is publicly available.

A SQL injection vulnerability was found in SourceCodester Performance Indicator System 1.0 in the file /opils/staff/edit_quantity.php. Manipulation of the pqty argument allows remote attack. The exploit has been publicly disclosed.

A SQL injection vulnerability was identified in SourceCodester Performance Indicator System 1.0 in the file /opils/admin/addproduct.php. Manipulation of the prodcategory argument allows remote attack. The exploit has been made public.

A vulnerability in GitLab EE could, under certain conditions, allow an authenticated user to inject specially crafted content into AI agent instructions, potentially causing unintended command execution attributed to other users. Affects versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A vulnerability in GitLab CE/EE could, under certain conditions, allow an authenticated user to execute arbitrary JavaScript in the context of other users' browser sessions via a specially crafted repository. Affects versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A vulnerability in GitLab EE could, under certain conditions, allow an authenticated user to execute arbitrary CI/CD pipelines in a transferred project with the new group's privileges. Affects versions from 18.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

OpenS100 through commit 2b1dafc contains an integer overflow vulnerability in the S-102 Bathymetric Surface parser. A crafted HDF5 file with malicious grid metadata can cause memory corruption, leading to a heap-based buffer overflow and potential arbitrary code execution.

A vulnerability in GitLab CE/EE could, under certain conditions, allow an authenticated user with Developer role to execute CI/CD pipelines on protected branches without authorization. Affects versions from 18.7 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.

A vulnerability in GitLab CE/EE could, under certain conditions, allow a user to poison cached responses for raw repository files, causing targeted users' CI/CD pipelines to execute specially crafted content and potentially exposing protected environment variables. Affects versions before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2.