A vulnerability in Aviatrix Controller allows unauthenticated attackers to exploit improper handling of OS command elements. This security flaw enables the execution of arbitrary code through the manipulation of API requests by injecting shell metacharacters into the parameters 'cloud_type' and '...

A Cross Site Scripting vulnerability has been discovered in the Longpi1 Warehouse version 1.0. This issue arises from a flaw in the backend component, specifically in the file located at /resources/..;/inport/updateInport. The vulnerability allows remote attackers to manipulate the 'remark' param...

A vulnerability has been identified in the reckcn SPPanAdmin application that allows for cross site scripting (XSS) attacks. The flaw exists in an unknown function of the administration module located at '/admin/role/edit'. Attackers can manipulate the name parameter, which can potentially lead t...

An operating system command injection vulnerability exists in specific models of Four-Faith routers, enabling authenticated and remote attackers to execute arbitrary OS commands through an HTTP request when modifying the system time. The vulnerability is compounded by the inclusion of default cre...

bl-kernel/security.class.php in Bludit 3.9.2 allows attackers to bypass a brute-force protection mechanism by using many different forged X-Forwarded-For or Client-IP HTTP headers.

A stack-based buffer overflow vulnerability exists in Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA gateways, prior to designated versions. This flaw allows a remote unauthenticated attacker to execute arbitrary code on the affected systems, posing significant risks to s...

A SQL injection vulnerability exists in the Jeewms product from Guangzhou Huayi Intelligent Technology, specifically in the datagridGraph function within the graphReportController.do file. This vulnerability allows an attacker to manipulate the store_code argument, permitting unauthorized remote ...

A SQL injection vulnerability has been identified in Jeewms developed by Guangzhou Huayi Intelligent Technology, affecting versions up to 20241229. The issue is located in the saveOrUpdate function within the CgFormBuildController.java file. This vulnerability allows attackers to manipulate SQL q...

A path traversal vulnerability in Jeewms by Guangzhou Huayi Intelligent Technology allows an attacker to manipulate file paths within the application. This vulnerability affects the /wmOmNoticeHController.do file and can be exploited remotely. Attackers may exploit this flaw to access unauthorize...

The Contact Form Master plugin for WordPress, up to version 1.0.7, is susceptible to a reflected cross-site scripting (XSS) vulnerability. This flaw arises due to the plugin's failure to properly sanitize and escape user-input parameters before rendering them on the web page. As a result, an atta...

A security flaw in the file upload mechanism of Apache Struts could allow an attacker to exploit file upload parameters. This vulnerability enables path traversal, leading to the possibility of uploading a malicious file that can facilitate remote code execution. To mitigate risks, users should u...

A vulnerability exists in the GlobalProtect feature of Palo Alto Networks PAN-OS software, allowing for arbitrary file creation. This issue can be exploited by an unauthenticated attacker to execute code with root privileges on the affected firewall systems. Specific configurations and versions a...

The Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress plugin for WordPress is vulnerable to Limited JavaScript File Upload in all versions up to, and including, 6.5.7. This is due to a lack of proper checks on allowed file types. This makes it possible for auth...

A vulnerability exists in Tenda AC6 15.03.05.16 that allows for a stack-based buffer overflow through the GetParentControlInfo function located in /goform/GetParentControlInfo. Manipulating the 'src' argument could enable remote attackers to exploit the vulnerability, potentially affecting additi...

A cross-site scripting vulnerability has been identified in CampCodes DepEd Equipment Inventory System version 1.0. The flaw is located in the /data/add_employee.php file, where user input is not adequately sanitized. This oversight allows attackers to inject malicious scripts, potentially compro...

A significant SQL injection vulnerability has been identified in the Admission Management System version 1.0 by Code-Projects. This flaw resides in the index.php file, specifically within the login component, where improper handling of the user identifier (u_id) parameter can allow attackers to e...

A vulnerability exists in the code-projects Content Management System 1.0, specifically within the Publish News Page component located at /admin/publishnews.php. This issue allows for unrestricted file uploads through manipulation of the 'image' argument, enabling attackers to upload arbitrary fi...

A SQL injection vulnerability exists in the listData function of the Leiyuxi Cy-Fast 1.0 product. This security flaw occurs due to improper handling of input arguments, specifically in the argument order within the /sys/menu/listData file. This weakness allows an attacker to manipulate the SQL qu...

A vulnerability exists in leiyuxi cy-fast version 1.0 within the listData function located in /commpara/listData. By manipulating the order of function arguments, attackers can exploit this vulnerability to perform SQL injection attacks remotely. This issue exposes sensitive information and may c...

A cross-site scripting vulnerability exists in the CampCodes Computer Laboratory Management System version 1.0, primarily affecting the file located at /class/edit/edit. This security flaw can be exploited by manipulating the 's_lname' argument, potentially allowing remote attackers to execute ar...

A vulnerability has been identified in CampCodes Computer Laboratory Management System 1.0, specifically in the functionality of the file /class/edit/edit. This weakness allows an attacker to manipulate the argument e_photo, leading to unrestricted file uploads. Such attacks can be executed remot...

The Codezips Project Management System 1.0 contains a vulnerability in the /pages/forms/teacher.php file that allows remote SQL injection through manipulation of the argument name. This flaw enables attackers to execute arbitrary SQL queries on the database, potentially leading to unauthorized ac...

A Denial of Service vulnerability was identified in GitLab CE/EE that could allow attackers to create cyclic references between epics, leading to resource exhaustion and potential service disruption. This issue affects all versions from 15.7 to 17.5.5, 17.6 from its release to 17.6.3, and 17.7 up...

A vulnerability exists in the Online Bike Rental System 1.0 developed by Code-Projects, centered around the Change Image Handler component. This flaw allows attackers to upload files without proper restrictions, which may lead to unauthorized access and exploitation. The potential for remote atta...

The BU Section Editing WordPress plugin fails to properly sanitize and escape user-supplied input, leading to a reflected cross-site scripting vulnerability. This flaw poses a significant risk for high privilege users such as administrators, as it can allow attackers to inject malicious scripts t...

The Aklamator INfeed WordPress plugin, up to version 2.0.0, has a security flaw where it fails to properly sanitize and escape a certain parameter before displaying it on the web page. This vulnerability can expose high-privilege users, such as administrators, to reflected cross-site scripting at...

The Aklamator INfeed WordPress plugin, up to version 2.0.0, is susceptible to Stored Cross-Site Scripting due to improper sanitization and escaping of its settings. This vulnerability permits high privilege users, such as administrators, to conduct attacks that could lead to malicious scripts bei...

A vulnerability exists in Leiyuxi Cy-Fast version 1.0, specifically in the listData function located in the /sys/user/listData file. This vulnerability arises due to inadequate validation of input parameters, allowing attackers to manipulate the order of arguments. As a result, it opens the door ...

The Asgard Security Scanner plugin for WordPress, specifically versions up to 0.7, contains a security flaw that arises from inadequate sanitization and escaping of user-supplied input. This oversight can lead to reflected cross-site scripting (XSS) attacks, potentially targeting high-privilege u...

The Backlink Monitoring Manager plugin for WordPress, up to version 0.1.3, is vulnerable to reflected cross-site scripting. This occurs due to insufficient sanitization and escaping of parameters before rendering them on the page. Attackers may exploit this weakness to inject malicious scripts, p...

The PostLists WordPress plugin, up to version 2.0.2, is vulnerable to a reflected cross-site scripting (XSS) issue due to improper handling of the $_SERVER['REQUEST_URI'] parameter. This flaw allows malicious actors to inject harmful scripts into the web page, potentially compromising user data i...

A vulnerability exists in the leiyuxi cy-fast application, specifically within the listData function located in the file /sys/role/listData. This issue arises from poorly validated input that allows attackers to manipulate the order of function arguments, resulting in SQL injection attacks. Such ...

A vulnerability has been identified in YunzMall versions up to 2.4.2, specifically within the changePwd function of the ResetpwdController.php file. This weakness allows for remote manipulation of the password recovery process, potentially enabling unauthorized access to user accounts through wea...

A command injection vulnerability exists within the KaiYuanTong ECT Platform, particularly in the /public/server/runCode.php file used for handling HTTP POST requests. An attacker can manipulate the 'code' argument, potentially allowing unauthorized commands to be executed on the server. This iss...

A cross-site scripting vulnerability has been identified in the SingMR HouseRent application version 1.0. This weakness exists in the code handling requests to the endpoint /toAdminUpdateHousePage?hID=30, allowing an attacker to inject malicious scripts. The attack can be executed remotely, posin...

A serious vulnerability exists in SingMR HouseRent 1.0, allowing attackers to exploit the singleUpload/upload function found in AddHouseController.java. This flaw enables the manipulation of the file argument, leading to unrestricted file uploads. Given that this vulnerability can be exploited re...

A significant vulnerability has been identified in SingMR HouseRent version 1.0, specifically within the file AdminController.java. This flaw results in improper access controls, allowing unauthorized users to manipulate functionalities that should be restricted. The vulnerability can be exploite...

A vulnerability has been identified in Donglight Bookstore System 1.0, specifically in the uploadPicture function of the AdminBookController located in src/main/java/org/zdd/bookstore/web/controller/admin. An attacker can exploit this flaw to perform unrestricted file uploads, which may lead to f...

An exploitable cross site scripting vulnerability exists in the Structure Management Page of Redaxo CMS version 5.18.1. This vulnerability is triggered by manipulating the 'Article Name' parameter within the index.php file, allowing attackers to inject malicious scripts. The attack can be execute...

A vulnerability has been identified in REVE Antivirus version 1.0.0.0 on Linux, resulting in incorrect default permissions for a component within the file /usr/local/reveantivirus/tmp/reveinstall. This security flaw allows local attackers to exploit these permissions, leading to potential unautho...

A SQL injection vulnerability exists in the E-Commerce-PHP 1.0 web application, specifically within the Create Product Page at /admin/create_product.php. This vulnerability allows an attacker to manipulate the 'Name' argument, potentially leading to unauthorized access or manipulation of the data...

A remote SQL injection vulnerability exists in E-Commerce-PHP 1.0, specifically within the /blog-details.php file. This flaw arises from improper handling of the blog_id parameter, allowing attackers to manipulate database queries. As a result, unauthorized access to sensitive data could occur. T...

A cross-site scripting vulnerability was identified in the Blog Article Handler of wander-chu SpringBoot-Blog 1.0. The issue arises from improper handling of user-supplied content within the modifiyArticle function in the PageController.java file. This flaw can be exploited remotely, allowing att...

A vulnerability exists in the Admin Attachment Handler of wander-chu's SpringBoot-Blog 1.0, specifically in the file upload function located in the AttachtController.java file. This flaw allows attackers to manipulate the file upload argument, resulting in unrestricted file uploads. This can lead...

A vulnerability exists in the wander-chu SpringBoot-Blog application version 1.0, located in the preHandle function of the BaseInterceptor.java file. This flaw results in improper access controls that can be exploited to perform unauthorized actions remotely. The potential for exploitation has be...

A cross-site scripting vulnerability has been identified in the langhsu Mblog Blog System version 3.5.0, specifically within the Search Bar component. This flaw arises from improper handling of the 'kw' parameter in the '/search' file, allowing remote attackers to execute arbitrary JavaScript in ...

A vulnerability has been identified within the langhsu Mblog Blog System version 3.5.0, specifically impacting the login functionality. This vulnerability allows attackers to exploit an observable response discrepancy, providing them the potential to execute remote attacks. The complexity of the ...

A vulnerability in Aviatrix Controller allows unauthenticated attackers to exploit improper handling of OS command elements. This security flaw enables the execution of arbitrary code through the manipulation of API requests by injecting shell metacharacters into the parameters 'cloud_type' and '...

The WordPress File Upload plugin suffers from a significant security vulnerability that allows unauthenticated attackers to exploit the 'wfu_file_downloader.php' file. This is attributed to insufficient sanitization of the 'source' parameter, enabling attackers to dictate a directory path. Conseq...

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.