CVE Vulnerability Catalog

Missing authorization in Pardus Update allows privilege escalation. The vulnerability affects versions 0.6.3 and earlier, fixed in version 0.6.6.

A vulnerability was found in radare2 up to version 6.1.6 in the cmd_anal_opcode function of libr/core/cmd_anal.inc.c within the hexpairs Parser component. Data manipulation leads to an integer overflow. The attack requires local access and the exploit is publicly available.

A vulnerability in radare2 up to version 6.1.6 was found in the core_anal_bytes function of libr/core/cmd_anal.inc, causing an integer overflow. The attack requires local access and has been publicly disclosed.

A SQL injection vulnerability was found in the Hotel and Tourism Reservation 1.0 system in the file /admin/add_tour.php. Manipulation of the delete_image argument allows SQL injection. The attack can be launched remotely and the exploit is publicly available.

A SQL Injection vulnerability has been found in code-projects Hotel and Tourism Reservation 1.0 in the file /admin/reservations.php. The unknown functionality of the Reservations Management Page allows manipulation of the delete argument, enabling remote SQL injection. The exploit has been publicly disclosed.

A vulnerability in Pardus Pen (TUBITAK BILGEM) involves improper null termination, potentially leading to buffer overflow. It affects versions <=4.1.5 before 4.2.1.

A vulnerability in Pardus Domain Joiner allows sensitive information exposure during process invocation. Affected versions are from 0.5.2 before 0.5.4, enabling data excavation.

A SQL injection vulnerability has been found in Hotel and Tourism Reservation 1.0 in the file /admin/add_room.php. An attacker can remotely manipulate arguments delete_image, edit, description, number, price, rooms, or type, leading to unauthorized database access. The exploit has been published and may be used.

A vulnerability was found in mjperpinosa stumasy up to commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be. An unknown function in /PHP/objects/notes within the Note Handler/Assignment Handler component allows authorization bypass via manipulation of the assignment_item_id argument. The attack is remotely exploitable and the exploit is public.

A security vulnerability has been detected in mjperpinosa stumasy up to commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be. The function add_definition in application/PHP/objects/notes/add_into_dictionary.php is affected by cross-site scripting via the reference argument. The exploit is publicly available and can be used remotely.

A SQL injection vulnerability has been found in mjperpinosa stumasy up to commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be in the Notes_controller::search_scratch_data function. The attack can be launched remotely by manipulating the field_name argument. The exploit is publicly available, increasing the risk of exploitation.

A SQL injection vulnerability was discovered in mjperpinosa stumasy up to commit 327d1b0f2915ba79d7ef8ebb74553e987609d9be in the Notes_controller::accessing_dictionary_authorization function. Remote attacks are possible by manipulating the Password argument. The exploit has been publicly released, increasing the risk of exploitation.

An unauthenticated improper input validation vulnerability in the POST /fetch_cve_data endpoint in cve-search allows a remote attacker to manipulate request parameters to read arbitrary application MongoDB collections. This can expose administrative usernames and password hashes from the mgmt_users collection.

A vulnerability was found in mjperpinosa stumasy up to version 327d1b0f2915ba79d7ef8ebb74553e987609d9be in the eval function of calculate.php. Manipulating the mathematical_sentence argument allows remote code injection. The exploit is publicly available and may be used.

A server-side request forgery (SSRF) vulnerability has been found in the mcp-wiki/wiki-summary component of AIAnytime Awesome-MCP-Server up to commit a884bb51bcd99e08e14fd712c749d55d9d9a13ab. The issue affects the file mcp-wiki/src/mcp_wiki/server.py via manipulation of the url argument. The attack can be initiated remotely and an exploit has been published.

A SQL Injection vulnerability was found in Real State Services 1.0 in the /addprojectsale.php file. An attacker can remotely manipulate the amen argument, leading to SQL injection.

A SQL Injection vulnerability has been detected in code-projects Real State Services 1.0. The flaw exists in the /addprojectrent.php file, where the amen argument is susceptible to SQL injection. The attack can be performed remotely, and the exploit has been publicly disclosed.

A SQL injection vulnerability has been found in Real State Services 1.0 in the /single-list_rent.php file. Manipulating the ID argument allows remote exploitation. A public exploit increases the risk of attacks.

A SQL injection vulnerability has been discovered in code-projects Real State Services 1.0 in the file /normalHomeRent.php. An attacker can remotely manipulate the loc argument, leading to unauthorized database access. The exploit has been publicly released, increasing the risk of attacks.

A SQL injection vulnerability was found in Real State Services 1.0 in the file /normalHomeSale.php. An attacker can remotely manipulate the 'loc' argument, leading to SQL injection. The exploit is publicly available.