Search vulnerabilities

Expected end of text, found 'ż' (at char 47), (line:1, col:48)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,461

CVE-2023-2146

Campcodes Online Thesis Archiving System Master.php sql injection

A vulnerability was found in Campcodes Online Thesis Archiving System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file classes/Master.php. The manipulation of the argument name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226267.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Online Thesis Archiving System Project
Products
Online Thesis Archiving System
CVE-2023-2145

Campcodes Online Thesis Archiving System projects_per_curriculum.php sql injection

A vulnerability was found in Campcodes Online Thesis Archiving System 1.0. It has been classified as critical. Affected is an unknown function of the file projects_per_curriculum.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-226266 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Online Thesis Archiving System Project
Products
Online Thesis Archiving System
CVE-2023-2143

Enable SVG, WebP & ICO Upload <= 1.0.3 - Author+ Stored XSS

The Enable SVG, WebP & ICO Upload WordPress plugin through 1.0.3 does not sanitize SVG file contents, leading to a Cross-Site Scripting vulnerability.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Ideastocode
Products
Enable Svg\, Webp \& Ico Upload
CVE-2023-2130

SourceCodester Purchase Order Management System GET Parameter view_details.php sql injection

A vulnerability classified as critical has been found in SourceCodester Purchase Order Management System 1.0. Affected is an unknown function of the file /admin/suppliers/view_details.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-226206 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS 4.1% KEV · Not listed
Vendors
Purchase Order Management System Project
Products
Purchase Order Management System
CVE-2023-2124

kernel: OOB access in the Linux kernel's XFS subsystem

An out-of-bounds memory access flaw was found in the Linux kernel’s XFS file system in how a user restores an XFS image after failure (with a dirty log journal). This flaw allows a local user to crash or potentially escalate their privileges on the system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Debian Linux Netapp and 1 more
Products
Debian Linux Linux Kernel H300s and 15 more
CVE-2023-2123

WP Inventory Manager < 2.1.0.13 - Reflected Cross-Site Scripting

The WP Inventory Manager WordPress plugin before 2.1.0.13 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.

CVSS 3.1 · 6.1 Medium EPSS 1.2% KEV · Not listed
Vendors
Wpinventory
Products
Wp Inventory Manager
CVE-2023-2122

Image Optimizer by 10web < 1.0.27 - Reflected Cross-Site Scripting

The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin panel, leading to a reflected Cross-Site Scripting vulnerability, allowing an attacker to trick a logged in admin to execute arbitrary javascript by clicking a link.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
10web
Products
Image Optimizer
CVE-2023-2110

Obsidian Local File Disclosure

Improper path handling in Obsidian desktop before 1.2.8 on Windows, Linux and macOS allows a crafted webpage to access local files and exfiltrate them to remote web servers via "app://local/<absolute-path>". This vulnerability can be exploited if a user opens a malicious markdown file in Obsidian, or copies text from a malicious webpage and paste it into Obsidian.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Apple Linux Microsoft and 1 more
Products
Macos Linux Kernel Windows and 1 more
CVE-2023-2108

SourceCodester Judging Management System edit_contestant.php sql injection

A vulnerability has been found in SourceCodester Judging Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file edit_contestant.php. The manipulation of the argument contestant_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226147.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Judging Management System Project
Products
Judging Management System
CVE-2023-2101

moxi624 Mogu Blog v2 uploadPicsByUrl uploadPictureByUrl absolute path traversal

A vulnerability, which was classified as problematic, has been found in moxi624 Mogu Blog v2 up to 5.2. This issue affects the function uploadPictureByUrl of the file /mogu-picture/file/uploadPicsByUrl. The manipulation of the argument urlList leads to absolute path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226109 was assigned to this vulnerability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mogublog Project
Products
Mogublog
CVE-2023-2100

SourceCodester Vehicle Service Management System index.php cross site scripting

A vulnerability classified as problematic was found in SourceCodester Vehicle Service Management System 1.0. This vulnerability affects unknown code of the file /admin/report/index.php. The manipulation of the argument date_end leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226108.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Oretnom23
Products
Vehicle Service Management System
CVE-2023-2098

SourceCodester Vehicle Service Management System topBarNav.php cross site scripting

A vulnerability was found in SourceCodester Vehicle Service Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /inc/topBarNav.php. The manipulation of the argument search leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-226106 is the identifier assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Oretnom23
Products
Vehicle Service Management System
CVE-2023-2096

SourceCodester Vehicle Service Management System manage_inventory.php sql injection

A vulnerability was found in SourceCodester Vehicle Service Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/service_requests/manage_inventory.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226104.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vehicle Service Management System Project
Products
Vehicle Service Management System
CVE-2023-2095

SourceCodester Vehicle Service Management System manage_category.php sql injection

A vulnerability was found in SourceCodester Vehicle Service Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /admin/maintenance/manage_category.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-226103.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vehicle Service Management System Project
Products
Vehicle Service Management System
CVE-2023-2093

SourceCodester Vehicle Service Management System Login.php sql injection

A vulnerability, which was classified as critical, was found in SourceCodester Vehicle Service Management System 1.0. This affects an unknown part of the file /classes/Login.php. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226101 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vehicle Service Management System Project
Products
Vehicle Service Management System
CVE-2023-2092

SourceCodester Vehicle Service Management System view_service.php sql injection

A vulnerability, which was classified as critical, has been found in SourceCodester Vehicle Service Management System 1.0. Affected by this issue is some unknown functionality of the file view_service.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-226100.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vehicle Service Management System Project
Products
Vehicle Service Management System
CVE-2023-2090

SourceCodester Employee and Visitor Gate Pass Logging System GET Parameter view_designation.php sql injection

A vulnerability classified as critical has been found in SourceCodester Employee and Visitor Gate Pass Logging System 1.0. Affected is an unknown function of the file /admin/maintenance/view_designation.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-226098 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Employee And Visitor Gate Pass Logging System Project Oretnom23
Products
Employee And Visitor Gate Pass Logging System Employee And Visitor Gate Pass Logging System
CVE-2023-2089

SourceCodester Complaint Management System GET Parameter userprofile.php sql injection

A vulnerability was found in SourceCodester Complaint Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/userprofile.php of the component GET Parameter Handler. The manipulation of the argument uid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-226097 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Complaint Management System Project
Products
Complaint Management System
CVE-2023-2072

Rockwell Automation PowerMonitor 1000 Cross-Site Scripting Vulnerability

The Rockwell Automation PowerMonitor 1000 contains stored cross-site scripting vulnerabilities within the web page of the product.  The vulnerable pages do not require privileges to access and can be injected with code by an attacker which could be used to leverage an attack on an authenticated user resulting in remote code execution and potentially the complete loss of confidentiality, integrity, and availability of the product.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Rockwellautomation
Products
Powermonitor 1000 Powermonitor 1000 Firmware
CVE-2023-2071

FactoryTalk View Machine Edition Vulnerable to Remote Code Execution

Rockwell Automation FactoryTalk View Machine Edition on the PanelView Plus, improperly verifies user’s input, which allows unauthenticated attacker to achieve remote code executed via crafted malicious packets.  The device has the functionality, through a CIP class, to execute exported functions from libraries.  There is a routine that restricts it to execute specific functions from two dynamic link library files.  By using a CIP class, an attacker can upload a self-made library to the device which allows the attacker to bypass the security check and execute any code written in the function.

CVSS 3.1 · 9.8 Critical EPSS 17.3% KEV · Not listed
Vendors
Rockwellautomation
Products
Factorytalk View Panelview Plus