CVE-2023-1501

RockOA acloudCosAction.php.SQL runAction unrestricted upload

A vulnerability, which was classified as critical, was found in RockOA 2.3.2. This affects the function runAction of the file acloudCosAction.php.SQL. The manipulation of the argument fileid leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223401 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Rockoa

Products

Rockoa

CVE-2023-1499

code-projects Simple Art Gallery adminHome.php sql injection

A vulnerability classified as critical was found in code-projects Simple Art Gallery 1.0. Affected by this vulnerability is an unknown functionality of the file adminHome.php. The manipulation of the argument reach_city leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223399.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Simple Art Gallery

CVE-2023-1497

SourceCodester Simple and Nice Shopping Cart Script uploaderm.php unrestricted upload

A vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script 1.0. It has been rated as critical. This issue affects some unknown processing of the file uploaderm.php. The manipulation of the argument submit leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223397 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Simple And Nice Shopping Cart Script Project

Products

Simple And Nice Shopping Cart Script

CVE-2023-1493

Max Secure Anti Virus Plus IoControlCode MaxProctetor64.sys 0x220019 denial of service

A vulnerability was found in Max Secure Anti Virus Plus 19.0.2.1. It has been rated as problematic. This issue affects the function 0x220019 in the library MaxProctetor64.sys of the component IoControlCode Handler. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223379.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Maxpcsecure

Products

Anti Virus Plus

CVE-2023-1492

Max Secure Anti Virus Plus IoControlCode MaxProc64.sys 0x220019 denial of service

A vulnerability was found in Max Secure Anti Virus Plus 19.0.2.1. It has been declared as problematic. This vulnerability affects the function 0x220019 in the library MaxProc64.sys of the component IoControlCode Handler. The manipulation of the argument SystemBuffer leads to denial of service. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. VDB-223378 is the identifier assigned to this vulnerability.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Maxpcsecure

Products

Anti Virus Plus

CVE-2023-1491

Max Secure Anti Virus Plus IoControlCode MaxCryptMon.sys 0x220020 access control

A vulnerability was found in Max Secure Anti Virus Plus 19.0.2.1. It has been classified as critical. This affects the function 0x220020 in the library MaxCryptMon.sys of the component IoControlCode Handler. The manipulation leads to improper access controls. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier VDB-223377 was assigned to this vulnerability.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Maxpcsecure

Products

Anti Virus Plus

CVE-2023-1490

Max Secure Anti Virus Plus IoControlCode SDActMon.sys 0x220020 access control

A vulnerability was found in Max Secure Anti Virus Plus 19.0.2.1 and classified as critical. Affected by this issue is the function 0x220020 in the library SDActMon.sys of the component IoControlCode Handler. The manipulation leads to improper access controls. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223376.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Maxpcsecure

Products

Anti Virus Plus

CVE-2023-1489

Lespeed WiseCleaner Wise System Monitor IoControlCode WiseHDInfo64.dll 0x9C402088 access control

A vulnerability has been found in Lespeed WiseCleaner Wise System Monitor 1.5.3.54 and classified as critical. Affected by this vulnerability is the function 0x9C402088 in the library WiseHDInfo64.dll of the component IoControlCode Handler. The manipulation leads to improper access controls. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223375.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Wisecleaner

Products

Wise System Monitor

CVE-2023-1488

Lespeed WiseCleaner Wise System Monitor IoControlCode WiseHDInfo64.dll 0x9C40A0E0 denial of service

A vulnerability, which was classified as problematic, was found in Lespeed WiseCleaner Wise System Monitor 1.5.3.54. Affected is the function 0x9C40A0D8/0x9C40A0DC/0x9C40A0E0 in the library WiseHDInfo64.dll of the component IoControlCode Handler. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. VDB-223374 is the identifier assigned to this vulnerability.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Wisecleaner

Products

Wise System Monitor

CVE-2023-1486

Lespeed WiseCleaner Wise Force Deleter IoControlCode WiseUnlock64.sys 0x220004 access control

A vulnerability classified as problematic was found in Lespeed WiseCleaner Wise Force Deleter 1.5.3.54. This vulnerability affects the function 0x220004 in the library WiseUnlock64.sys of the component IoControlCode Handler. The manipulation leads to improper access controls. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223372.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wisecleaner

Products

Wise Force Deleter

CVE-2023-1485

SourceCodester Young Entrepreneur E-Negosyo System GET Parameter index.php cross site scripting

A vulnerability classified as problematic has been found in SourceCodester Young Entrepreneur E-Negosyo System 1.0. This affects an unknown part of the file /bsenordering/index.php of the component GET Parameter Handler. The manipulation of the argument category with the input <script>alert(222)</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223371.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Young Entrepreneur E-negosyo System Project

Products

Young Entrepreneur E-negosyo System

CVE-2023-1484

xzjie cms upload unrestricted upload

A vulnerability was found in xzjie cms up to 1.0.3 and classified as critical. This issue affects some unknown processing of the file /api/upload. The manipulation of the argument uploadFile leads to unrestricted upload. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-223367.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Xzjie Cms Project

Products

Xzjie Cms

CVE-2023-1483

XiaoBingBy TeaCMS getallarticleinfo sql injection

A vulnerability has been found in XiaoBingBy TeaCMS up to 2.0.2 and classified as critical. This vulnerability affects unknown code of the file /admin/getallarticleinfo. The manipulation of the argument searchInfo leads to sql injection. The attack can be initiated remotely. VDB-223366 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Teacms Project

Products

Teacms

CVE-2023-1480

SourceCodester Monitoring of Students Cyber Accounts System POST Parameter login.php sql injection

A vulnerability classified as critical was found in SourceCodester Monitoring of Students Cyber Accounts System 1.0. Affected by this vulnerability is an unknown functionality of the file login.php of the component POST Parameter Handler. The manipulation of the argument un leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223363.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Monitoring Of Students Cyber Accounts System Project

Products

Monitoring Of Students Cyber Accounts System

CVE-2023-1479

SourceCodester Simple Music Player save_music.php unrestricted upload

A vulnerability classified as critical has been found in SourceCodester Simple Music Player 1.0. Affected is an unknown function of the file save_music.php. The manipulation of the argument filename leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-223362 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Simple Music Player Project

Products

Simple Music Player

CVE-2023-1475

SourceCodester Canteen Management System createuser.php query sql injection

A vulnerability, which was classified as critical, has been found in SourceCodester Canteen Management System 1.0. This issue affects the function query of the file createuser.php. The manipulation of the argument uemail leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223337 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Canteen Management System Project

Products

Canteen Management System

CVE-2023-1467

SourceCodester Student Study Center Desk Management System POST Parameter path traversal

A vulnerability classified as critical has been found in SourceCodester Student Study Center Desk Management System 1.0. Affected is an unknown function of the file Master.php?f=delete_img of the component POST Parameter Handler. The manipulation of the argument path with the input C%3A%2Ffoo.txt leads to path traversal. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-223326 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Oretnom23

Products

Student Study Center Desk Management System

CVE-2023-1464

SourceCodester Medicine Tracker System improper authentication

A vulnerability, which was classified as critical, was found in SourceCodester Medicine Tracker System 1.0. This affects an unknown part of the file Users.php?f=save_user. The manipulation of the argument firstname/middlename/lastname/username/password leads to improper authentication. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-223311.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Medicine Tracker System Project

Products

Medicine Tracker System

CVE-2023-1461

SourceCodester Canteen Management System createCategories.php query sql injection

A vulnerability was found in SourceCodester Canteen Management System 1.0. It has been declared as critical. This vulnerability affects the function query of the file createCategories.php. The manipulation of the argument categoriesStatus leads to sql injection. The attack can be initiated remotely. VDB-223306 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Canteen Management System Project

Products

Canteen Management System

CVE-2023-1460

SourceCodester Online Pizza Ordering System Password Change improper authentication

A vulnerability was found in SourceCodester Online Pizza Ordering System 1.0. It has been classified as critical. This affects an unknown part of the file admin/ajax.php?action=save_user of the component Password Change Handler. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The identifier VDB-223305 was assigned to this vulnerability.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Online Pizza Ordering System Project

Products

Online Pizza Ordering System