CVE Vulnerability Catalog

Use-after-free vulnerability in the Compositing component of Google Chrome prior to 151.0.7922.72. A remote attacker who compromised the renderer process could potentially escape the sandbox via a crafted HTML page.

A vulnerability in VaahCMS versions 2.0.0-2.3.4 involves a malicious obfuscated JavaScript payload embedded in the Blade template for OTP emails. The payload establishes a WebSocket connection to a C2 server, installs a password keylogger, scrapes WhatsApp Web DOM, and accepts remote commands to redirect or overwrite the page.

The kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in check_availability.php via the emailid and email parameters.

The kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in /doctor/edit-patient.php?editid=1.

The kishan0725 Hospital Management System 4.0 is vulnerable to SQL Injection in the view-medhistory.php endpoint via the viewid parameter.

Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection in /save_user.php via the status parameter.

Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection in update_student.php via the fname and student_class parameters.

Sourcecodester Advocate office management system 1.0 is vulnerable to SQL injection in control/activate_case.php via the id parameter, allowing remote code execution.

Sourcecodester CASAP Automated Enrollment System 1.0 is vulnerable to SQL injection in update_password.php via the new_password parameter.

OliveTin up to version 3000.17.0 stores OAuth2 login states in a map without expiration or size limits, allowing an unauthenticated attacker to exhaust memory and cause a denial of service (DoS).

XML External Entity (XXE) vulnerability in Jinher OA C6. An unauthenticated remote attacker can send a crafted XML payload to the GetXmlHttp endpoint to read arbitrary files from the server via an out-of-band attack.

Autel MaxiCharger AC Elite Home EV chargers have an integer underflow vulnerability in WebSocket OCPP message handling, allowing an unauthenticated remote attacker to execute arbitrary code on the device.

GitLab CE/EE versions 10.1.0 through 19.0.5, 19.1 through 19.1.3, and 19.2 through 19.2.1 have insufficient access controls on internal request handling, potentially allowing an authenticated Developer user to access unauthorized information.

The NTIOLib_X64.sys driver in MSI Center fails to properly validate command origins, allowing a local attacker to escalate privileges to SYSTEM and execute arbitrary code.

The redfish-* plugins in Linuxfabrik monitoring-plugins up to version 6.0.0 build request URLs by concatenating a base URL with @odata.id links from responses, allowing a malicious or compromised BMC to redirect authenticated Redfish requests and disclose X-Auth-Token or HTTP Basic credentials.

MCP Ruby SDK before version 0.23.0 in StreamableHTTPTransport reads the entire JSON-RPC POST body without size limits, allowing an unauthenticated remote attacker to exhaust process memory.

MCP Ruby SDK before version 0.23.0 does not bind a session ID to its owner, allowing an attacker with a stolen session ID to send tools/call requests in the victim's session.

DriveLock has a directory traversal vulnerability in its web service on port 6067, allowing an unauthenticated remote attacker to disclose sensitive information due to lack of path validation.

DriveLock has an SQL injection vulnerability in its web service on port 4568, allowing an authenticated remote attacker to escalate privileges due to lack of input validation in SQL queries.

DriveLock has a directory traversal vulnerability in its web service on port 4568, allowing an unauthenticated remote attacker to disclose sensitive information due to lack of path validation.