CVE Vulnerability Catalog

Podatność typu SQL Injection w systemie zarządzania zapasami w wersji 1.0 umożliwia zdalnemu atakującemu wykonanie dowolnego kodu poprzez parametr id w pliku manage_bo.php.

An issue in the Plone Docker Official Image 5.2.13 (5221) where a package listed in ++plone++static/components does not exist in the public npm package index, potentially allowing remote code execution.

CVE-2023-6675 vulnerability affects CyberMath, allowing unrestricted upload of files with dangerous types, enabling the upload of a web shell to a web server.

Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials. This means the system comes with easily guessable login credentials out of the box.

Vinchin Backup & Recovery v7.2 was found to use default MySQL credentials. This allows an attacker to gain unauthorized access to the database without password cracking.

Remote command execution vulnerability in SE-elektronic GmbH E-DDC3.3 affecting versions 03.07.03 and higher. An attacker can send operating system commands to the device via the web configuration functionality.

A vulnerability in Projectworlds Vistor Management System in PHP version 1.0 allows a remote attacker to escalate privileges via a crafted script sent to the login page in the POST/index.php path.

Podatność CVE-2023-52221 dotyczy nieograniczonego przesyłania plików o niebezpiecznych typach w aplikacji UkrSolution Barcode Scanner i Inventory Manager. Problem ten występuje w wersjach od n/a do 1.5.1.

A vulnerability in Snapcast version 0.27.0 allows remote attackers to execute arbitrary code and obtain sensitive information via a crafted request to the JSON-RPC API.

An arbitrary file upload vulnerability was found in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method of YonBIP v3_23.05. It allows an attacker to execute arbitrary code by uploading a crafted file.

An arbitrary file upload vulnerability in the uap.framework.rc.itf.IResourceManager interface of YonBIP v3_23.05. Attackers can upload a crafted file, leading to arbitrary code execution on the server.

An issue in YonBIP v3_23.05 from Yonyou allows a remote attacker to execute arbitrary code via a crafted script sent to the ServiceDispatcherServlet uap.framework.rc.itf.IResourceManager component.

An arbitrary file upload vulnerability was found in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method of YonBIP v3_23.05. An attacker can upload a crafted file, leading to arbitrary code execution on the server.

A SQL injection vulnerability was discovered in YonBIP v3_23.05 via the runScript() method of the AttendScriptController. An attacker can exploit this flaw to execute arbitrary SQL queries.

An issue in weaver e-cology v.10.0.2310.01 allows a remote attacker to execute arbitrary code via a crafted script sent to the FrameworkShellController component.

Hard-coded credentials in FOLIO mod-data-export-spring before version 1.5.4 and from 2.0.0 to 2.0.2 allow unauthenticated users to access critical APIs, modify user data, change configurations including single-sign-on, and manipulate fees/fines.

CVE-2024-23679 in Enonic XP versions before 7.7.4 allows a remote unauthenticated attacker to reuse prior sessions due to missing session attribute invalidation.

In the actiNAS SL 2U-8 RDX version 3.2.03-SP1, improper access control was found in the nasSvr.php file. A remote attacker can read and modify different types of data without authentication.

An arbitrary file upload vulnerability in Xpand IT Write-back Manager v2.3.1 allows attackers to execute arbitrary code via a crafted JSP file. An attacker can upload a malicious file that gets executed on the server.