CVE Vulnerability Catalog

SQL injection vulnerability in itsourcecode Hospital Management System 1.0, in an unknown function of the file /viewadmin.php, via manipulation of the argument delid. The attack can be performed remotely. The exploit is now public.

SQL injection vulnerability in itsourcecode Hospital Management System 1.0, in an unknown function of the file /treatmentrecord.php, via manipulation of the argument editid. The attack can be performed remotely. The exploit has been publicly disclosed.

SQL injection vulnerability in itsourcecode Hospital Management System 1.0, in an unknown function of the file /treatmentdetail.php, via manipulation of the argument patientid. The attack can be performed remotely. The exploit has been made public.

SQL injection vulnerability in itsourcecode Hospital Management System 1.0, in an unknown function of the file /treatment.php, via manipulation of the argument editid. Remote exploitation is possible. The exploit has been released publicly.

Authorization bypass vulnerability in SourceCodester Online Examination & Learning Management System 1.0, in an unknown function of the file view_students.php, via manipulation of the argument class_group. The attack can be launched remotely.

Unrestricted file upload vulnerability in SourceCodester Online Examination & Learning Management System 1.0, in some unknown processing of the file upload_files.php. The attack may be initiated remotely.

A vulnerability was found in SourceCodester Online Examination & Learning Management System 1.0 in the file /view.php. Manipulation of the ID argument results in authorization bypass. The attack can be launched remotely.

A vulnerability was identified in FoundationAgents MetaGPT up to 0.8.2 affecting an unknown function, allowing code injection. The attack requires local access. The exploit is publicly available and might be used. The vendor did not respond.

A vulnerability was found in FoundationAgents MetaGPT up to 0.8.2 in the DataInterpreter function of the file metagpt/roles/di/data_interpreter.py, allowing code injection. The attack must be initiated locally. The exploit is public and could be used. The vendor did not respond.

A vulnerability was detected in Lspace-io lspace-server up to 79f02fe5aa8970b210a6a05cf097155f8d9ffd71 affecting the fileExists/readFile/writeFile/deleteFile functions in the file src/core/repository.ts of the Repositories File API component. Manipulation of the filePath argument results in path traversal. The attack requires local access. The project did not respond.

A flaw was found in Epiphany in how the browser reads web addresses, allowing attackers to fake the domain name shown in the address bar. Clicking a specially crafted link containing a colon (e.g., https://trusted.com:[email protected]/) displays the safe website (trusted.com) in the address bar but actually loads the attacker's website (attacker.com). This allows creating convincing phishing pages.

The Event Booking Manager for WooCommerce (Pro) WordPress plugin before 5.0.3 does not validate the ticket price on the server during its native (non-WooCommerce) checkout, trusting the per-ticket price supplied by the client instead of re-deriving the event's configured price. This allows unauthenticated users to book paid event tickets for free, obtaining completed bookings and valid tickets at no cost.

The Ninja Forms WordPress plugin before 3.14.10 does not prevent user-supplied query-string input, used to pre-populate a form field's default value, from being processed as a shortcode, allowing unauthenticated attackers to execute arbitrary shortcodes registered on the site when a form so configured is embedded on a public page.

The RegistrationMagic WordPress plugin before 6.0.9.5 does not compare the verified PayPal capture's amount, currency, payee, or prior use against the registration it is finalising: its server-side check only confirms the capture status is COMPLETED. An unauthenticated attacker can therefore finalise an expensive paid registration with any genuinely-completed low-value capture, and replay a single capture across unlimited registrations because captures are not de-duplicated.

The WP Hotel Booking WordPress plugin before 2.3.2 does not verify that a payment notification corresponds to a payment made to the site's own merchant account, nor that the paid amount matches the booking total, allowing unauthenticated users to have their bookings marked as fully paid without any payment reaching the site owner.

The WP Hotel Booking WordPress plugin before 2.3.3 does not ensure that room quantities and the resulting order total are non-negative when placing a booking, and relies on client-controlled cart data, allowing unauthenticated users to create confirmed reservations for free or at an arbitrarily reduced price.

The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the intended booking. This allows unauthenticated attackers to mark arbitrary pending reservations as paid and confirmed.

The Simple Membership WordPress plugin before 4.7.7 does not verify that a PayPal payment notification was sent to the site's own configured merchant account before activating a membership. This allows unauthenticated users to activate or extend a membership using a payment made to an arbitrary PayPal account they control.

The Events Made Easy WordPress plugin before 3.1.2 does not bind the payment authorization token to the payment record being charged. This allows unauthenticated attackers to pay a low amount for a cheap booking and have a separate, higher-priced booking marked as fully paid.

The Easy Booking WordPress plugin before 3.5.0 does not re-enforce a bookable product's configured minimum booking duration on the server side when adding to cart and calculating the booking price. This allows unauthenticated users to place below-minimum bookings and complete underpriced orders.