CVE-2023-3821

Cross-site Scripting (XSS) - Stored in pimcore/pimcore

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.6.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Pimcore

Products

Pimcore

CVE-2023-3820

SQL Injection in pimcore/pimcore

SQL Injection in GitHub repository pimcore/pimcore prior to 10.6.4.

CVSS 3.1 · 7.2 High EPSS 1.2% KEV · Not listed

Vendors

Pimcore

Products

Pimcore

CVE-2023-3819

Exposure of Sensitive Information to an Unauthorized Actor in pimcore/pimcore

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository pimcore/pimcore prior to 10.6.4.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Pimcore

Products

Pimcore

CVE-2023-3815

y_project RuoYi File Upload uploadFilesPath cross site scripting

A vulnerability, which was classified as problematic, has been found in y_project RuoYi up to 4.7.7. Affected by this issue is the function uploadFilesPath of the component File Upload. The manipulation of the argument originalFilenames leads to cross site scripting. The attack may be launched remotely. VDB-235118 is the identifier assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Ruoyi

Products

Ruoyi

CVE-2023-3811

Hospital Management System patientprofile.php sql injection

A vulnerability was found in Hospital Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file patientprofile.php. The manipulation of the argument address leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235079.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hospital Management System Project

Products

Hospital Management System

CVE-2023-3810

Hospital Management System patientappointment.php sql injection

A vulnerability was found in Hospital Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file patientappointment.php. The manipulation of the argument loginid/password/mobileno/appointmentdate/appointmenttime/patiente/dob/doct/city leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-235078 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hospital Management System Project

Products

Hospital Management System

CVE-2023-3809

Hospital Management System patient.php sql injection

A vulnerability was found in Hospital Management System 1.0. It has been classified as critical. This affects an unknown part of the file patient.php. The manipulation of the argument address leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235077 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hospital Management System Project

Products

Hospital Management System

CVE-2023-3808

Hospital Management System patientforgotpassword.php sql injection

A vulnerability was found in Hospital Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file patientforgotpassword.php. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235076.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hospital Management System Project

Products

Hospital Management System

CVE-2023-3807

Campcodes Beauty Salon Management System edit_product.php sql injection

A vulnerability has been found in Campcodes Beauty Salon Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file edit_product.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235075.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Campcodes

Products

Beauty Salon Management System

CVE-2023-3806

SourceCodester House Rental and Property Listing System btn_functions.php unrestricted upload

A vulnerability, which was classified as critical, was found in SourceCodester House Rental and Property Listing System 1.0. Affected is an unknown function of the file btn_functions.php. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-235074 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

House Rental And Property Listing Php Project

Products

House Rental And Property Listing Php

CVE-2023-3805

Xiamen Four Letter Video Surveillance Management System Login UserInfoAction.class improper authorization

A vulnerability, which was classified as critical, has been found in Xiamen Four Letter Video Surveillance Management System up to 20230712. This issue affects some unknown processing in the library UserInfoAction.class of the component Login. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235073 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Four-faith

Products

Video Surveillance Management System

CVE-2023-3804

Chengdu Flash Flood Disaster Monitoring and Warning System FileHandler.ashx unrestricted upload

A vulnerability classified as problematic was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This vulnerability affects unknown code of the file /Service/FileHandler.ashx. The manipulation of the argument userFile leads to unrestricted upload. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235072. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Cdwanjiang

Products

Flash Flood Disaster Monitoring And Warning System

CVE-2023-3803

Chengdu Flash Flood Disaster Monitoring and Warning System File Name ImageStationDataService.asmx random values

A vulnerability classified as problematic has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. This affects an unknown part of the file /Service/ImageStationDataService.asmx of the component File Name Handler. The manipulation leads to insufficiently random values. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235071. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 2.6 Low EPSS < 1% KEV · Not listed

Vendors

Cdwanjiang

Products

Flash Flood Disaster Monitoring And Warning System

CVE-2023-3802

Chengdu Flash Flood Disaster Monitoring and Warning System Ajaxfileupload.ashx unrestricted upload

A vulnerability was found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /Controller/Ajaxfileupload.ashx. The manipulation of the argument file leads to unrestricted upload. The exploit has been disclosed to the public and may be used. VDB-235070 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Cdwanjiang

Products

Flash Flood Disaster Monitoring And Warning System

CVE-2023-3801

IBOS OA Mobile Notification edit actionEdit sql injection

A vulnerability was found in IBOS OA 4.5.5. It has been declared as critical. Affected by this vulnerability is the function actionEdit of the file ?r=officialdoc/officialdoc/edit of the component Mobile Notification Handler. The manipulation leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-235069 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Ibos

Products

Ibos

CVE-2023-3800

EasyAdmin8 File Upload Module index.html unrestricted upload

A vulnerability was found in EasyAdmin8 2.0.2.2. It has been classified as problematic. Affected is an unknown function of the file /admin/index/index.html#/admin/mall.goods/index.html of the component File Upload Module. The manipulation leads to unrestricted upload. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-235068. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed

Vendors

Wolfcode

Products

Easyadmin8

CVE-2023-3799

IBOS OA Delete Category del sql injection

A vulnerability was found in IBOS OA 4.5.5 and classified as critical. This issue affects some unknown processing of the file ?r=article/category/del of the component Delete Category Handler. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-235067. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ibos

Products

Ibos

CVE-2023-3798

Chengdu Flash Flood Disaster Monitoring and Warning System upload.aspx unrestricted upload

A vulnerability has been found in Chengdu Flash Flood Disaster Monitoring and Warning System 2.0 and classified as critical. This vulnerability affects unknown code of the file /App_Resource/UEditor/server/upload.aspx. The manipulation of the argument file leads to unrestricted upload. The exploit has been disclosed to the public and may be used. VDB-235066 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Cdwanjiang

Products

Flash Flood Disaster Monitoring And Warning System

CVE-2023-3796

Bug Finder Foody Friend Profile Picture profile unrestricted upload

A vulnerability, which was classified as problematic, has been found in Bug Finder Foody Friend 1.0. Affected by this issue is some unknown functionality of the file /user/profile of the component Profile Picture Handler. The manipulation of the argument profile_picture leads to unrestricted upload. The attack may be launched remotely. The identifier of this vulnerability is VDB-235064. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Bugfinder

Products

Foody Friend

CVE-2023-3795

Bug Finder ChainCity Real Estate Investment Platform GET Parameter property sql injection

A vulnerability classified as critical was found in Bug Finder ChainCity Real Estate Investment Platform 1.0. Affected by this vulnerability is an unknown functionality of the file /property of the component GET Parameter Handler. The manipulation of the argument name leads to sql injection. The associated identifier of this vulnerability is VDB-235063. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Bugfinder

Products

Chaincity