CVE Vulnerability Catalog

A SQL injection vulnerability was found in the Online Examination 1.0 system in the quiz creation feature. An attacker can remotely manipulate the name/total/right/wrong/time/tag/desc arguments in /update.php?q=addquiz, leading to SQL injection. The exploit is publicly available.

A SQL injection vulnerability was found in code-projects Online Examination 1.0 in the head.php file. Manipulating the uname or password arguments allows remote exploitation. The exploit has been publicly disclosed and may be used.

A vulnerability was found in bluebox up to version 4.5.12, allowing Cross-Site Scripting (XSS) via manipulation of the 'code' argument. The attack can be performed remotely and the exploit has been made public.

A SQL injection vulnerability has been found in itsourcecode Hospital Management System 1.0 in the file /patientorder.php. An unknown function allows manipulation of the editid argument, enabling remote SQL injection. The exploit has been publicly disclosed.

A flaw in zcaceres markdownify-mcp up to version 1.1.0 causes insufficiently random values in the saveToTempFile function of src/Markdownify.ts. The attack requires local access and is difficult to exploit, but a public exploit is available.

A SQL injection vulnerability was found in the Internship Management System 1.0 in the file employer/details/change_password.php. An attacker can remotely manipulate the Current argument, leading to SQL injection. The exploit is publicly available.

A SQL injection vulnerability has been found in the Internship Management System 1.0 in the employer/login.php file. An attacker can remotely manipulate the email/password arguments, leading to SQL injection. The exploit has been publicly disclosed.

A vulnerability has been discovered in zcaceres markdownify-mcp up to version 1.1.0, allowing symlink following via the assertPathAllowed function in src/Markdownify.ts. The attack can only be executed locally.

A security flaw has been discovered in SourceCodester Syllabus-Aligned Learning Management and Examination System 1.0. An unknown function in upload_files.php allows unrestricted file upload, which can be exploited remotely. The exploit has been publicly released and may be used in attacks.

A SQL injection vulnerability was found in the save_client function of classes/Users.php in SourceCodester Multi-Vendor Online Grocery Management System 1.0. Manipulation of the Name argument in the Registration Handler allows remote SQL injection. The exploit has been made public and could be used.

A SQL injection vulnerability was found in the cancel_order function of classes/Master.php in SourceCodester Multi-Vendor Online Grocery Management System 1.0. An attacker can remotely manipulate the ID argument, leading to SQL injection.

A vulnerability has been found in SourceCodester Multi-Vendor Online Grocery Management System 1.0 in the cancel_order function of classes/Master.php. Manipulation of this function can lead to improper authorization. The attack can be performed remotely and the exploit has been published.

A SQL injection vulnerability was found in SourceCodester Multi-Vendor Online Grocery Management System 1.0/5.7.26. The issue affects the save_shop_type function in classes/Master.php, which improperly handles POST parameters. The attack can be performed remotely, and the exploit is publicly available.

A security vulnerability has been detected in SourceCodester Multi-Vendor Online Grocery Management System 1.0, involving code injection in the update_settings_info function of classes/SystemSettings.php. The attack can be executed remotely, and the exploit has been publicly disclosed.

A weakness in SourceCodester Multi-Vendor Online Grocery Management System 1.0 affects the save_users function in classes/Users.php, causing improper authorization. Remote exploitation is possible, and the exploit is publicly available.

A SQL injection vulnerability has been discovered in CodeAstro Apartment Visitor Management System 1.0 in the file /apartment-visitor/add-apartment.php. An attacker can remotely manipulate the apartmentno argument, leading to SQL injection. The exploit has been publicly released.

A vulnerability in the Crypt::DSA library for Perl before version 1.22 causes insecure generation of DSA signing nonces and private keys due to a biased random generator. An attacker with access to a few signatures and the public key can recover the private key using a lattice attack.

A SQL injection vulnerability was found in itsourcecode Online Hotel Management System 1.0 in the file /admin/login.php. An attacker can remotely manipulate the email argument, leading to SQL injection. The exploit is publicly available.

A vulnerability was found in the InsightEngine component of BettaFish up to version 1.2.1 in the _deduplicate_results function of InsightEngine/agent.py. Input manipulation can lead to partial string comparison, allowing remote attacks. The exploit has been publicly disclosed and may be used.

A vulnerability was found in HdrHistogram up to version 2.2.2 in the `DoubleHistogram.recordValue` function. It involves an incorrect comparison during range checking, potentially leading to erroneous behavior. The attack requires local access and is publicly known, but its significance is disputed due to security boundary limitations.