CVE Vulnerability Catalog

Vulnerability in Online Examination System 1.0 by code-projects. Unknown code in /account.php?q=quiz allows manipulation of arguments eid/n/t, leading to Cross-Site Scripting (XSS). The attack can be performed remotely, and the exploit is publicly available.

A path traversal vulnerability has been found in Croogo CMS up to version 4.0.7 in the Admin File Manager component. The FileManager::isEditable function in FileManager/src/Utility/FileManager.php allows path manipulation. The attack can be initiated remotely and an exploit has been published.

A security vulnerability has been detected in guohongze adminset up to version 0.61. It affects an unknown functionality of the file delivery/deli.py in the Delivery Deployment Endpoint component. Manipulation of the project_id argument leads to authorization bypass.

In geex-arts django-jet up to version 1.0.8, a cross-site request forgery vulnerability exists in the OAuth Handler component. The attack can be performed remotely, and the exploit is publicly available. The project was notified but has not responded.

A security flaw was discovered in django-jet up to version 1.0.8 in the OAuth Credential Revoke Handler component. Missing authorization in this function allows remote attacks without required privileges. The exploit has been publicly released and may be used in real attacks.

A vulnerability was identified in geex-arts django-jet up to 1.0.8. This affects an unknown function of the file jet/dashboard/views.py of the component Dashboard Module. Such manipulation leads to authorization bypass. The attack can be executed remotely. The exploit is publicly available and might be used. The project was informed of the problem early through an issue report but has not responded yet.

A race condition vulnerability was found in the django-shop library up to version 1.2.4, specifically in the Purchase Stock Handler function within shop/models/inventory.py. The attack can be performed remotely but is considered difficult due to high complexity. A public exploit is available, increasing the risk of exploitation.

In django-tastypie up to version 0.15.1, the CacheThrottle/CacheDBThrottle function in tastypie/throttle.py has a race condition vulnerability. The attack can be remote but is difficult to exploit. The project was informed but has not responded.

A security vulnerability has been found in django-oauth-toolkit version 3.3.0 in the _load_id_token function of oauth2_provider/oauth2_validators.py. The issue allows remote session expiration.

A security flaw in zevorn rt-claw up to version 0.2.0 affects the tool_run_script_execute function in claw/services/tools/script.c. Input manipulation allows remote code injection. The exploit has been publicly released and may be used in attacks.

A vulnerability was found in zevorn rt-claw up to version 0.2.0 in the functions claw_net_get and claw_net_post in the file claw/services/tools/net.c of the http_request component. Data manipulation leads to information disclosure. The attack can be executed remotely and the exploit has been made public.

A vulnerability has been found in GoClaw up to version 3.13.3-beta.3 in the ExecTool.Execute function of the goclaw/internal/tools/credentialed_exec.go file. Manipulation can lead to improper authorization. The attack can be launched remotely and the exploit has been published.

A vulnerability in Sipeed PicoClaw up to version 0.2.9 in the file web/backend/middleware/access_control.go allows authentication bypass by manipulating the allowed_cidrs argument. The attack is remote but requires high complexity and is difficult to exploit. The exploit is publicly available.

A security vulnerability was found in Sipeed PicoClaw up to version 0.2.9. The issue is in the handleMessageReceive function in the file pkg/channels/feishu/feishu_64.go of the Group Message Handler component, leading to missing authorization. The attack can be launched remotely and the exploit has been publicly disclosed.

A weakness in the web_fetch component of Sipeed PicoClaw up to version 0.2.9 allows server-side request forgery (SSRF). The attack can be performed remotely, and the exploit is publicly available.

A security flaw was discovered in Sipeed PicoClaw up to version 0.2.9 in the dispatchIncoming function of the file pkg/channels/wecom/wecom.go in the Group Message Handler component. The issue involves incorrect authorization, allowing remote exploitation. The exploit has been publicly released and may be used in attacks.

A server-side request forgery (SSRF) vulnerability was found in zhayujie CowAgent up to version 2.1.1 in the WebFetch.execute function of agent/tools/web_fetch/web_fetch.py. The attack can be performed remotely by manipulating the url argument, and the exploit has been publicly disclosed.

The Flow Payment plugin for WordPress version 3.0.8 is vulnerable to reflected XSS on the WooCommerce checkout page. The error_message parameter is passed unsanitized to wc_add_notice(), allowing an unauthenticated attacker to execute JavaScript in the victim's browser.

Stored XSS vulnerability in the POST /api/prompts/share endpoint in parisneo/lollms (latest version). An attacker can store malicious JavaScript in a message, which executes in the victim's browser when opened, enabling data theft and account takeover.

Stoat Android app exposes ShareTargetActivity component that accepts a URI from SEND intent. It does not validate the URI, so an attacker can pass a file:// URI pointing to internal app files (e.g., database, tokens). The victim may unknowingly send these files to the attacker.