Search vulnerabilities

Expected end of text, found '/' (at char 38), (line:1, col:39)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,805

CVE-2023-1785

SourceCodester Earnings and Expense Tracker App manage_user.php sql injection

A vulnerability was found in SourceCodester Earnings and Expense Tracker App 1.0. It has been classified as critical. Affected is an unknown function of the file manage_user.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-224700.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Earnings And Expense Tracker App Project
Products
Earnings And Expense Tracker App
CVE-2023-1780

Companion Sitemap Generator < 4.5.3 - Reflected XSS

The Companion Sitemap Generator WordPress plugin before 4.5.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Codeermeneer
Products
Companion Sitemap Generator
CVE-2023-1771

SourceCodester Grade Point Average GPA Calculator Master.php get_scale cross site scripting

A vulnerability was found in SourceCodester Grade Point Average GPA Calculator 1.0 and classified as problematic. Affected by this issue is the function get_scale of the file Master.php. The manipulation of the argument perc leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224672.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Grade Point Average \(gpa\) Calculator Project
Products
Grade Point Average \(gpa\) Calculator
CVE-2023-1770

SourceCodester Grade Point Average GPA Calculator Master.php get_scale sql injection

A vulnerability has been found in SourceCodester Grade Point Average GPA Calculator 1.0 and classified as critical. Affected by this vulnerability is the function get_scale of the file Master.php. The manipulation of the argument perc leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224671.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Grade Point Average \(gpa\) Calculator Project
Products
Grade Point Average \(gpa\) Calculator
CVE-2023-1769

SourceCodester Grade Point Average GPA Calculator index.php information disclosure

A vulnerability, which was classified as problematic, was found in SourceCodester Grade Point Average GPA Calculator 1.0. Affected is an unknown function of the file index.php. The manipulation of the argument page with the input php://filter/read=convert.base64-encode/resource=grade_table leads to information disclosure. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-224670 is the identifier assigned to this vulnerability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Grade Point Average \(gpa\) Calculator Project
Products
Grade Point Average \(gpa\) Calculator
CVE-2023-1745

KMPlayer SHFOLDER.dll uncontrolled search path

A vulnerability, which was classified as problematic, has been found in KMPlayer 4.2.2.73. This issue affects some unknown processing in the library SHFOLDER.dll. The manipulation leads to uncontrolled search path. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. The identifier VDB-224633 was assigned to this vulnerability.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Pandora
Products
Kmplayer
CVE-2023-1744

IBOS htaccess unrestricted upload

A vulnerability classified as critical was found in IBOS 4.5.5. This vulnerability affects unknown code of the component htaccess Handler. The manipulation leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224632.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibos
Products
Ibos
CVE-2023-1743

SourceCodester Grade Point Average GPA Calculator index.php cross site scripting

A vulnerability classified as problematic has been found in SourceCodester Grade Point Average GPA Calculator 1.0. This affects an unknown part of the file index.php. The manipulation of the argument page leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224631.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Grade Point Average \(gpa\) Calculator Project
Products
Grade Point Average \(gpa\) Calculator
CVE-2023-1742

IBOS Report Search getlist sql injection

A vulnerability was found in IBOS 4.5.5. It has been rated as critical. Affected by this issue is some unknown functionality of the file /?r=report/api/getlist of the component Report Search. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-224630 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Ibos
Products
Ibos
CVE-2023-1741

jeecg-boot Sleep Command SysDictMapper.java sql injection

A vulnerability was found in jeecg-boot 3.5.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file SysDictMapper.java of the component Sleep Command Handler. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-224629 was assigned to this vulnerability.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jeecg
Products
Jeecg Boot
CVE-2023-1740

SourceCodester Air Cargo Management System GET Parameter manage_user.php sql injection

A vulnerability was found in SourceCodester Air Cargo Management System 1.0. It has been classified as critical. Affected is an unknown function of the file admin/user/manage_user.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-224628.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Air Cargo Management System Project
Products
Air Cargo Management System
CVE-2023-1739

SourceCodester Simple and Beautiful Shopping Cart System upload.php unrestricted upload

A vulnerability was found in SourceCodester Simple and Beautiful Shopping Cart System 1.0 and classified as critical. This issue affects some unknown processing of the file upload.php. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-224627.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Simple And Beautiful Shopping Cart System Project
Products
Simple And Beautiful Shopping Cart System
CVE-2023-1736

SourceCodester Young Entrepreneur E-Negosyo System sql injection

A vulnerability, which was classified as critical, has been found in SourceCodester Young Entrepreneur E-Negosyo System 1.0. Affected by this issue is some unknown functionality of the file cart/controller.php?action=add. The manipulation of the argument PROID leads to sql injection. The identifier of this vulnerability is VDB-224624.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Young Entrepreneur E-negosyo System Project
Products
Young Entrepreneur E-negosyo System
CVE-2023-1734

SourceCodester Young Entrepreneur E-Negosyo System unrestricted upload

A vulnerability classified as critical has been found in SourceCodester Young Entrepreneur E-Negosyo System 1.0. Affected is an unknown function of the file admin/products/controller.php?action=add. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. VDB-224622 is the identifier assigned to this vulnerability.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Young Entrepreneur E-negosyo System Project
Products
Young Entrepreneur E-negosyo System
CVE-2023-1720

Bitrix24 Stored Cross-Site Scripting (XSS) via File Upload

Lack of mime type response header in Bitrix24 22.0.300 allows authenticated remote attackers to execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via uploading a crafted HTML file through /desktop_app/file.ajax.php?action=uploadfile.

CVSS 3.1 · 9.6 Critical EPSS 1.1% KEV · Not listed
Vendors
Bitrix24
Products
Bitrix24
CVE-2023-1719

Bitrix24 Insecure Global Variable Extraction

Global variable extraction in bitrix/modules/main/tools.php in Bitrix24 22.0.300 allows unauthenticated remote attackers to (1) enumerate attachments on the server and (2) execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via overwriting uninitialised variables.

CVSS 3.1 · 7.5 High EPSS 6.3% KEV · Not listed
Vendors
Bitrix24
Products
Bitrix24
CVE-2023-1718

Bitrix24 Denial-of-Service (DoS) via Improper File Stream Access

Improper file stream access in /desktop_app/file.ajax.php?action=uploadfile in Bitrix24 22.0.300 allows unauthenticated remote attackers to cause denial-of-service via a crafted "tmp_url".

CVSS 3.1 · 7.5 High EPSS 28.7% KEV · Not listed
Vendors
Bitrix24
Products
Bitrix24
CVE-2023-1717

Bitrix24 Cross-Site Scripting (XSS) via Client-side Prototype Pollution

Prototype pollution in bitrix/templates/bitrix24/components/bitrix/menu/left_vertical/script.js in Bitrix24 22.0.300 allows remote attackers to execute arbitrary JavaScript code in the victim’s browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege, via polluting `__proto__[tag]` and `__proto__[text]`.

CVSS 3.1 · 9.6 Critical EPSS 1.5% KEV · Not listed
Vendors
Bitrix24
Products
Bitrix24
CVE-2023-1716

Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (2 of 2)

Cross-site scripting (XSS) vulnerability in Invoice Edit Page in Bitrix24 22.0.300 allows attackers to execute arbitrary JavaScript code in the victim's browser, and possibly execute arbitrary PHP code on the server if the victim has administrator privilege.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Bitrix24
Products
Bitrix24
CVE-2023-1715

Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (1 of 2)

A logic error when using mb_strpos() to check for potential XSS payload in Bitrix24 22.0.300 allows attackers to bypass XSS sanitisation via placing HTML tags at the begining of the payload.

CVSS 3.1 · 9 Critical EPSS < 1% KEV · Not listed
Vendors
Bitrix24
Products
Bitrix24