CVE Vulnerability Catalog

A vulnerability was detected in SourceCodester Stock Management System 1.0 in the file /classes/Master.php?f=delete_supplier. Manipulating the ID argument results in SQL injection. The attack can be launched remotely, and the exploit is public.

A weakness was identified in code-projects Online Shopping System 1.0 in the file /checkout_process.php. Manipulating the total_count argument can lead to SQL injection. The attack can be launched remotely, and the exploit is public.

A vulnerability was identified in code-projects Online Shopping System 1.0 in the file /homeaction.php. Manipulating the cat_id argument leads to SQL injection. The attack can be launched remotely, and the exploit is publicly available.

A vulnerability was determined in code-projects Online Shopping System 1.0 in the file /action.php. Manipulating the proId argument causes SQL injection. The attack can be initiated remotely, and the exploit is publicly disclosed.

A vulnerability was found in SpaceX Starlink Router Gen 3 version 2025.11.14.mr64708.3 in the get_status function of the gRPC Management Interface component. The manipulation leads to improper access controls. The attack can only be initiated within the local network. The exploit is public, and the vendor did not respond.

A flaw has been found in code-projects Online Food Order System 1.0. An unknown function of the file delete_food_items1.php is affected. Manipulation of the argument checkbox leads to SQL injection. The attack can be executed remotely. The exploit has been published and may be used.

Shescape before 2.1.15 (and 3.0.0 before 3.0.2) fails to properly escape tilde (~) characters in assignment contexts on Unix systems where the shell is explicitly configured to "sh" or true and /bin/sh points to BusyBox. Using the escape and escapeAll APIs with untrusted input in an assignment prefixed to a command, an attacker can inject a tilde payload to disclose the user's home directory location and, depending on usage, alter the location on which a command operates.

SiYuan versions <= 3.7.3 (fixed in v3.7.4) contain a server-side template injection vulnerability in the attribute-view Template calculation feature (introduced in v3.7.0-beta.1). The feature's template engine uses Sprig's unmodified function map, which still exposes the env, expandenv, and getHostByName functions that were removed elsewhere for CVE-2024-55660. A local, unauthenticated attacker (the kernel binds to 127.0.0.1 by default with no per-UID access control) can inject a malicious Template calculation formula to read environment variables belonging to the account running siyuan — including from a separate, unprivileged OS account — and to perform DNS lookups from the server's network position.

A vulnerability has been found in SourceCodester Online Clothing Store 1.0. An unknown part of the file /db/shopping.sql of the component SQL Database Backup is affected. The manipulation leads to files or directories accessible. Remote exploitation is possible. The exploit has been disclosed to the public and may be used.

The @fastify/oauth2 plugin for Fastify, versions 7.2.0 up to but not including 8.3.0, improperly validates the OAuth state and PKCE code verifier by comparing callback query parameters against an unprefixed, predictable cookie, with no server-side binding to the browser. An attacker can set cookies and perform a login CSRF attack, silently signing the victim into the attacker's account. The fix in 8.3.0 adds an opt-in hostPrefixedCookies option.

In the itsourcecode Hospital Management System 1.0, a SQL injection vulnerability was found in the file /viewmedicine.php. Manipulation of the delid argument allows remote execution of SQL queries. The exploit has been published and may be used.

The WPML Multilingual CMS plugin for WordPress is vulnerable to SQL injection via the 'sorting' parameter in all versions up to and including 4.9.5 due to insufficient escaping and lack of preparation on the SQL query. This allows authenticated attackers with translator-level access and above to append additional SQL queries to extract sensitive information from the database.

The JSON plugin of Apache Struts is vulnerable to exposure of data element to wrong session. Per-response serialization state could be shared across concurrent requests, allowing response content associated with one request to become observable in another. Only the SMD / JSON-RPC handling of the JSON interceptor is affected, which is not enabled by default; applications using the json result type are not affected.

A vulnerability in the JSON plugin of Apache Struts allows per-request parsing state to be shared across concurrent requests, potentially exposing data from one request to another and not enforcing configured parsing limits. Populating actions from JSON request bodies is not enabled by default, so applications not using the JSON plugin are unaffected.

The ECS WordPress plugin before 4.3.13 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any user who can open the page builder, allowing users with a contributor-level account or above to read, alter and delete the binding configuration of posts they do not own and to change the ECS WordPress plugin before 4.3.13's site-wide presets.

The Backup Migration WordPress plugin before version 2.1.7 does not properly restrict a post-restore automatic login mechanism. A user who administers one site of a multisite network can obtain a long-lived authenticated session as an administrator of another site in the same network, without credentials and bypassing two-factor authentication.

The Simply Schedule Appointments WordPress plugin before version 1.6.12.17 does not restrict the user records returned by some of its REST endpoints to those the requester is entitled to see. This allows users with a low-privileged staff role to disclose the names and email addresses of arbitrary registered users.

The ECS WordPress plugin before version 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers (gated only by a capability-agnostic nonce that any edit_posts user obtains from the Elementor editor). A Contributor can write a data-source binding into any post, including admin-authored pages, whose attacker-controlled values are rendered into a widget's repeater output without sanitization, executing JavaScript in the session of any visitor or administrator who views the page.

The ECS WordPress plugin before version 4.3.8 does not check the post status or any capability when rendering an Elementor document requested through one of its AJAX actions. This allows unauthenticated users to retrieve the rendered content of unpublished (private, draft, pending) documents by supplying their identifier.

The Groundhogg plugin for WordPress up to version 4.5.14 is vulnerable to SQL injection via the tag_query parameter. Insufficient escaping and lack of query preparation allow authenticated attackers with vendor-level access to append additional SQL queries, potentially extracting sensitive information. Exploitation requires triggering the Legacy_Contact_Query code path via an unknown filter type.