CVE Vulnerability Catalog

A vulnerability was found in mjperpinosa stumasy up to version 327d1b0f2915ba79d7ef8ebb74553e987609d9be in the eval function of application/pages/imba_calculator/calculate.php. Manipulating the mathematical_sentence argument allows remote code injection. The exploit is publicly available and may be used.

A server-side request forgery (SSRF) vulnerability has been found in the mcp-wiki/wiki-summary component of AIAnytime Awesome-MCP-Server up to commit a884bb51bcd99e08e14fd712c749d55d9d9a13ab. The attack is performed by manipulating the url argument in mcp-wiki/src/mcp_wiki/server.py and can be initiated remotely. The exploit has been published, and the project has not responded to the issue report.

A SQL Injection vulnerability was found in Real State Services 1.0 in the /addprojectsale.php file. An attacker can remotely manipulate the amen argument, leading to SQL injection.

A SQL injection vulnerability has been detected in code-projects Real State Services 1.0 in the /addprojectrent.php file. An attacker can remotely manipulate the amen argument, leading to SQL injection. The exploit has been publicly disclosed.

A SQL injection vulnerability has been found in Real State Services 1.0 in the /single-list_rent.php file via the ID argument. The attack can be performed remotely and the exploit has been made public.

A SQL injection vulnerability has been discovered in code-projects Real State Services 1.0 in the file /normalHomeRent.php. An attacker can remotely manipulate the loc argument, leading to unauthorized database access. The exploit has been publicly released, increasing the risk of attacks.

A SQL injection vulnerability was found in Real State Services 1.0 in the file /normalHomeSale.php. An attacker can remotely manipulate the 'loc' argument, leading to SQL injection. The exploit is publicly available.

A vulnerability was found in langgraph library from langchain-ai up to version 1.2.4 in the _freeze function of _cache.py, where the default_cache_key argument causes use of a weak hash function. The attack can be carried out remotely but is difficult to exploit.

A weak hash function was found in the Vision Feature Cache component of exo-explore exo up to version 1.0.71, specifically in the _image_cache_key function. The vulnerability allows remote attacks but is difficult to exploit due to high complexity. A public exploit is available, and a fix is pending acceptance.

A SQL injection vulnerability was found in Hanwang e-Face General Management Platform 6.3.5.4 in the file /sysAuthStr/querySysAuthStr.do. An attacker can remotely manipulate the order argument, leading to SQL injection. The exploit is publicly available.

A vulnerability was found in Ruijie RG-UAC up to version 1.0-R1.8.2.p5 in the file user_auth_commit.php. An unknown function allows unrestricted file upload via manipulation of the upload_image argument. The attack can be carried out remotely and the exploit has been made public.

A SQL injection vulnerability has been found in Smart Parking System 1.0 in the file /parkings/parkings.php. An unknown function allows manipulation of the street, city, or status arguments, enabling remote SQL injection. The exploit has been publicly disclosed.

A SQL injection vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0 in the /edit_product.php file via the ID argument. The attack can be performed remotely and the exploit has been published.

A SQL injection vulnerability was found in SourceCodester Class and Exam Timetabling System 1.0 in the file /edit_coursea.php. An attacker can remotely manipulate the ID argument, leading to SQL injection. The exploit is publicly available.

A SQL injection vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0 in the /edit_exam.php file via the ID argument. The attack can be performed remotely and the exploit has been publicly disclosed.

A SQL injection vulnerability has been found in itsourcecode Hospital Management System 1.0 in the /patientreport.php file. Manipulating the editid argument allows remote exploitation. The exploit has been publicly released, increasing the risk of attacks.

A SQL injection vulnerability has been discovered in itsourcecode Hospital Management System 1.0 in the /patientprofile.php file. An attacker can remotely manipulate the patientname argument, leading to SQL injection. The exploit has been publicly released and may be used in attacks.

A vulnerability was found in SourceCodester Online Boat Reservation System 1.0 involving an unknown functionality that leads to session expiration. The attack can be launched remotely and the exploit is publicly available.

In AD-Security AD_Miner 1.9.0, the Cache Handler component's request_a function in ad_miner/scripts/analyse_cache.py mishandles the sys.argv[1] argument, causing deserialization. The attack requires local access.

A vulnerability was found in TidGi-Desktop up to version 0.13.0 in the Git Repository Import component. An unknown function in loadWikiTiddlersWithSubWikis.ts allows remote code injection. The exploit has been made public.