CVE-2023-4454

Cross-Site Request Forgery (CSRF) in wallabag/wallabag

Cross-Site Request Forgery (CSRF) in GitHub repository wallabag/wallabag prior to 2.6.3.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Wallabag

Products

Wallabag

CVE-2023-4453

Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.6.8.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Pimcore

Products

Pimcore

CVE-2023-4452

Web Server Buffer Overflow Vulnerability

A vulnerability has been identified in the EDR-810, EDR-G902, and EDR-G903 Series, making them vulnerable to the denial-of-service vulnerability. This vulnerability stems from insufficient input validation in the URI, potentially enabling malicious users to trigger the device reboot.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Moxa

Products

Edr-810-2gsfp Edr-810-2gsfp-t Edr-810-2gsfp-t Firmware and 13 more

CVE-2023-4449

SourceCodester Free and Open Source Inventory Management System sql injection

A vulnerability was found in SourceCodester Free and Open Source Inventory Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /index.php?page=member. The manipulation of the argument columns[0][data] leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-237570 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Inventory Management System Project

Products

Inventory Management System

CVE-2023-4448

OpenRapid RapidCMS run-movepass.php password recovery

A vulnerability was found in OpenRapid RapidCMS 1.3.1 and classified as critical. This issue affects some unknown processing of the file admin/run-movepass.php. The manipulation of the argument password/password2 leads to weak password recovery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 4dff387283060961c362d50105ff8da8ea40bcbe. It is recommended to apply a patch to fix this issue. The identifier VDB-237569 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Openrapid

Products

Rapidcms

CVE-2023-4447

OpenRapid RapidCMS article-chat.php sql injection

A vulnerability has been found in OpenRapid RapidCMS 1.3.1 and classified as critical. This vulnerability affects unknown code of the file admin/article-chat.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-237568.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Openrapid

Products

Rapidcms

CVE-2023-4445

Mini-Tmall sql injection

A vulnerability, which was classified as critical, has been found in Mini-Tmall up to 20230811. Affected by this issue is some unknown functionality of the file product/1/1?test=1&test2=2&. The manipulation of the argument orderBy leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-237566 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mini

Products

Mini-tmall

CVE-2023-4444

SourceCodester Free Hospital Management System for Small Practices edit-user.php sql injection

A vulnerability classified as critical was found in SourceCodester Free Hospital Management System for Small Practices 1.0. Affected by this vulnerability is an unknown functionality of the file vm\patient\edit-user.php. The manipulation of the argument id00/nic/oldemail/email/spec/Tele leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-237565 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Free Hospital Management System For Small Practices Project

Products

Free Hospital Management System For Small Practices

CVE-2023-4443

SourceCodester Free Hospital Management System for Small Practices edit-doc.php sql injection

A vulnerability classified as critical has been found in SourceCodester Free Hospital Management System for Small Practices 1.0/5.0.12. Affected is an unknown function of the file vm\doctor\edit-doc.php. The manipulation of the argument id00/nic/oldemail/email/spec/Tele leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-237564.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Free Hospital Management System For Small Practices Project

Products

Free Hospital Management System For Small Practices

CVE-2023-4442

SourceCodester Free Hospital Management System for Small Practices booking-complete.php sql injection

A vulnerability was found in SourceCodester Free Hospital Management System for Small Practices 1.0. It has been rated as critical. This issue affects some unknown processing of the file \vm\patient\booking-complete.php. The manipulation of the argument userid/apponum/scheduleid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-237563.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Free Hospital Management System For Small Practices Project

Products

Free Hospital Management System For Small Practices

CVE-2023-4441

SourceCodester Free Hospital Management System for Small Practices appointment.php sql injection

A vulnerability was found in SourceCodester Free Hospital Management System for Small Practices 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /patient/appointment.php. The manipulation of the argument sheduledate leads to sql injection. The attack can be initiated remotely. VDB-237562 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Free Hospital Management System For Small Practices Project

Products

Free Hospital Management System For Small Practices

CVE-2023-4440

SourceCodester Free Hospital Management System for Small Practices appointment.php sql injection

A vulnerability was found in SourceCodester Free Hospital Management System for Small Practices 1.0. It has been classified as critical. This affects an unknown part of the file appointment.php. The manipulation of the argument sheduledate leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-237561 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Free Hospital Management System For Small Practices Project

Products

Free Hospital Management System For Small Practices

CVE-2023-4439

SourceCodester Card Holder Management System Minus Value unknown vulnerability

A vulnerability was found in SourceCodester Card Holder Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the component Minus Value Handler. The manipulation leads to improper validation of specified quantity in input. The attack may be launched remotely. The identifier of this vulnerability is VDB-237560.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Card Holder Management System Project

Products

Card Holder Management System

CVE-2023-4438

SourceCodester Inventory Management System search_sales_report.php sql injection

A vulnerability has been found in SourceCodester Inventory Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file app/ajax/search_sales_report.php. The manipulation of the argument customer leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-237559.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Inventory Management System Project

Products

Inventory Management System

CVE-2023-4437

SourceCodester Inventory Management System search_sell_paymen_report.php sql injection

A vulnerability, which was classified as critical, was found in SourceCodester Inventory Management System 1.0. Affected is an unknown function of the file app/ajax/search_sell_paymen_report.php. The manipulation of the argument customer leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-237558 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Inventory Management System Project

Products

Inventory Management System

CVE-2023-4436

SourceCodester Inventory Management System edit_update.php sql injection

A vulnerability, which was classified as critical, has been found in SourceCodester Inventory Management System 1.0. This issue affects some unknown processing of the file app/action/edit_update.php. The manipulation of the argument user_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-237557 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Inventory Management System Project

Products

Inventory Management System

CVE-2023-4435

Improper Input Validation in hamza417/inure

Improper Input Validation in GitHub repository hamza417/inure prior to build88.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Hamza417

Products

Inure

CVE-2023-4434

Missing Authorization in hamza417/inure

Missing Authorization in GitHub repository hamza417/inure prior to build88.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Hamza417

Products

Inure

CVE-2023-4433

Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit

Cross-site Scripting (XSS) - Stored in GitHub repository cockpit-hq/cockpit prior to 2.6.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Agentejo Cockpit-hq

Products

Cockpit Cockpit

CVE-2023-4432

Cross-site Scripting (XSS) - Reflected in cockpit-hq/cockpit

Cross-site Scripting (XSS) - Reflected in GitHub repository cockpit-hq/cockpit prior to 2.6.4.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Agentejo Cockpit-hq

Products

Cockpit Cockpit