Sequalize - Bad query filtering leading to SQL errors

Due to improper input filtering in the sequalize js library, can malicious queries lead to sensitive information disclosure.

Sequalize - Unsafe fall-through in getWhereConditions

Due to improper parameter filtering in the sequalize js library, can a attacker peform injection.

Cloudflow - Unauthenticated file upload vulnerability

Cloudflow contains a unauthenticated file upload vulnerability, which makes it possible for an attacker to upload malicious files to the CLOUDFLOW PROOFSCOPE built-in storage.

Visioweb.js - Prototype Pollution can results in XSS

Prototype Pollution in Visioweb.js 1.10.6 allows attackers to execute XSS on the client system.

Not used

Not used

Not used

Not used

Not used

Not used

Not used

Not used

Not used

Illustrator | Untrusted Search Path (CWE-426)

Illustrator versions 29.2.1, 28.7.4 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute their own programs, access unauthorized data files, or modify configuration in unexpected ways. If the application uses a search path to locate critical resources such as programs, then an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. The problem extends to any type of critical resource that the application trusts.

Illustrator | Stack-based Buffer Overflow (CWE-121)

Illustrator versions 29.2.1, 28.7.4 and earlier are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Illustrator | NULL Pointer Dereference (CWE-476)

Illustrator versions 29.2.1, 28.7.4 and earlier are affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker could exploit this vulnerability to crash the application, leading to a denial of service condition. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

SEO Plugin by Squirrly SEO < 12.3.21 - Editor+ Stored XSS

In the process of testing the SEO Plugin by Squirrly SEO WordPress plugin before 12.3.21, a vulnerability was found that allows you to implement Stored XSS on behalf of the editor by embedding malicious script, which entails account takeover backdoor

Cross-Site Scripting (XSS) vulnerabilities in Anuj Kumar's Client Management System Version 1.2 allow local attackers to inject arbitrary web script or HTML via the search input field parameter to admin search invoice page and client search invoice page.

Phpgurukul Beauty Parlour Management System v1.1 is vulnerable to SQL Injection in admin/index.php via the the username parameter.

Phpgurukul Teachers Record Management System v2.1 is vulnerable to SQL Injection via the tid parameter to admin/queries.php.