Search vulnerabilities

Expected end of text, found '/' (at char 38), (line:1, col:39)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,803

CVE-2023-1428

Denial-of-Service in gRPC

There exists an vulnerability causing an abort() to be called in gRPC.  The following headers cause gRPC's C++ implementation to abort() when called via http2: te: x (x != trailers) :scheme: x (x != http, https) grpclb_client_stats: x (x == anything) On top of sending one of those headers, a later header must be sent that gets the total header size past 8KB. We recommend upgrading past git commit 2485fa94bd8a723e5c977d55a3ce10b301b437f8 or v1.53 and above.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Grpc Redhat
Products
Grpc Enterprise Linux
CVE-2023-1418

SourceCodester Friendly Island Pizza Website and Ordering System POST Parameter cashconfirm.php cross site scripting

A vulnerability classified as problematic was found in SourceCodester Friendly Island Pizza Website and Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file cashconfirm.php of the component POST Parameter Handler. The manipulation of the argument transactioncode leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223129 was assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Friendly Island Pizza Website And Ordering System Project
Products
Friendly Island Pizza Website And Ordering System
CVE-2023-1416

Simple Art Gallery adminHome.php sql injection

A vulnerability classified as critical has been found in Simple Art Gallery 1.0. Affected is an unknown function of the file adminHome.php. The manipulation of the argument social_facebook leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223128.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Code-projects
Products
Simple Art Gallery
CVE-2023-1407

SourceCodester Student Study Center Desk Management System manage_user.php sql injection

A vulnerability classified as critical was found in SourceCodester Student Study Center Desk Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/user/manage_user.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223111.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Oretnom23
Products
Student Study Center Desk Management System
CVE-2023-1402

Moodle: course participation report shows roles the user should not see

The course participation report required additional checks to prevent roles being displayed which the user did not have access to view.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Moodle
Products
Moodle
CVE-2023-1398

XiaoBingBy TeaCMS upload path traversal

A vulnerability classified as critical was found in XiaoBingBy TeaCMS 2.0. Affected by this vulnerability is an unknown functionality of the file /admin/upload. The manipulation leads to path traversal: '../filedir'. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222985 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Teacms Project
Products
Teacms
CVE-2023-1397

SourceCodester Online Student Management System profile.php cross site scripting

A vulnerability classified as problematic has been found in SourceCodester Online Student Management System 1.0. Affected is an unknown function of the file profile.php. The manipulation of the argument adminname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222984.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Online Student Management System Project
Products
Online Student Management System
CVE-2023-1396

SourceCodester Online Tours & Travels Management System traveller_details.php cross site scripting

A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file admin/traveller_details.php. The manipulation of the argument address leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222983.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Online Tours \& Travels Management System Project
Products
Online Tours \& Travels Management System
CVE-2023-1394

SourceCodester Online Graduate Tracer System bsitemp.php mysqli_query sql injection

A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0. It has been classified as critical. This affects the function mysqli_query of the file bsitemp.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222981 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Online Graduate Tracer System Project
Products
Online Graduate Tracer System
CVE-2023-1391

SourceCodester Online Tours & Travels Management System ab.php unrestricted upload

A vulnerability, which was classified as problematic, was found in SourceCodester Online Tours & Travels Management System 1.0. Affected is an unknown function of the file admin/ab.php. The manipulation of the argument img leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-222978 is the identifier assigned to this vulnerability.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Online Tours \& Travels Management System Project
Products
Online Tours \& Travels Management System
CVE-2023-1386

Qemu: 9pfs: suid/sgid bits not dropped on file write

A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. When a local user in the guest writes an executable file with SUID or SGID, none of these privileged bits are correctly dropped. As a result, in rare circumstances, this flaw could be used by malicious users in the guest to elevate their privileges within the guest and help a host local user to elevate privileges on the host.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Qemu Redhat
Products
Fedora Qemu Advanced Virtualization and 1 more
CVE-2023-1378

SourceCodester Friendly Island Pizza Website and Ordering System POST Parameter paypalsuccess.php sql injection

A vulnerability classified as critical was found in SourceCodester Friendly Island Pizza Website and Ordering System 1.0. This vulnerability affects unknown code of the file paypalsuccess.php of the component POST Parameter Handler. The manipulation of the argument cusid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222904.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Friendly Island Pizza Website And Ordering System Project
Products
Friendly Island Pizza Website And Ordering System
CVE-2023-1366

SourceCodester Yoga Class Registration System manage_category.php query sql injection

A vulnerability was found in SourceCodester Yoga Class Registration System 1.0. It has been classified as critical. This affects the function query of the file admin/categories/manage_category.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222873 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Yoga Class Registration System Project
Products
Yoga Class Registration System
CVE-2023-1365

SourceCodester Online Pizza Ordering System ajax.php sql injection

A vulnerability was found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/ajax.php. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222872.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Online Pizza Ordering System Project
Products
Online Pizza Ordering System
CVE-2023-1364

SourceCodester Online Pizza Ordering System GET Parameter category.php sql injection

A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file category.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222871.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Online Pizza Ordering System Project
Products
Online Pizza Ordering System
CVE-2023-1363

SourceCodester Computer Parts Sales and Inventory System Add User Account cross site scripting

A vulnerability, which was classified as problematic, was found in SourceCodester Computer Parts Sales and Inventory System 1.0. Affected is an unknown function of the component Add User Account. The manipulation of the argument username leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-222870 is the identifier assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Computer Parts Sales And Inventory System Project
Products
Computer Parts Sales And Inventory System
CVE-2023-1358

SourceCodester Gadget Works Online Ordering System POST Parameter login.php sql injection

A vulnerability, which was classified as critical, was found in SourceCodester Gadget Works Online Ordering System 1.0. This affects an unknown part of the file /philosophy/admin/login.php of the component POST Parameter Handler. The manipulation of the argument user_email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222861 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Gadget Works Online Ordering System Project
Products
Gadget Works Online Ordering System
CVE-2023-1356

Reflected Cross-site Scripting In IDAttend’s IDWeb Application

Reflected cross-site scripting in the StudentSearch component in IDAttend’s IDWeb application 3.1.052 and earlier allows hijacking of a user’s browsing session by attackers who have convinced the said user to click on a malicious link.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Idattend
Products
Idweb
CVE-2023-1354

SourceCodester Design and Implementation of Covid-19 Directory on Vaccination System register.php cross site scripting

A vulnerability has been found in SourceCodester Design and Implementation of Covid-19 Directory on Vaccination System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file register.php. The manipulation of the argument txtfullname/txtage/txtaddress/txtphone leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222853 was assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Design And Implementation Of Covid-19 Directory On Vaccination System Project
Products
Design And Implementation Of Covid-19 Directory On Vaccination System
CVE-2023-1352

SourceCodester Design and Implementation of Covid-19 Directory on Vaccination System login.php sql injection

A vulnerability, which was classified as critical, has been found in SourceCodester Design and Implementation of Covid-19 Directory on Vaccination System 1.0. This issue affects some unknown processing of the file /admin/login.php. The manipulation of the argument txtusername/txtpassword leads to sql injection. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222851.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed
Vendors
Design And Implementation Of Covid-19 Directory On Vaccination System Project
Products
Design And Implementation Of Covid-19 Directory On Vaccination System