CVE-2023-1441

SourceCodester Automatic Question Paper Generator System GET Parameter view_course.php sql injection

A vulnerability has been found in SourceCodester Automatic Question Paper Generator System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file admin/courses/view_course.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223285 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Automatic Question Paper Generator System Project

Products

Automatic Question Paper Generator System

CVE-2023-1440

SourceCodester Automatic Question Paper Generator System GET Parameter manage_user.php sql injection

A vulnerability, which was classified as critical, was found in SourceCodester Automatic Question Paper Generator System 1.0. Affected is an unknown function of the file users/user/manage_user.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223284.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Automatic Question Paper Generator System Project

Products

Automatic Question Paper Generator System

CVE-2023-1439

SourceCodester Medicine Tracker System GET Parameter view_details.php sql injection

A vulnerability, which was classified as critical, has been found in SourceCodester Medicine Tracker System 1.0. This issue affects some unknown processing of the file medicines/view_details.php of the component GET Parameter Handler. The manipulation of the argument GET leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223283.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Medicine Tracker System Project

Products

Medicine Tracker System

CVE-2023-1437

CVE-2023-1437

All versions prior to 9.1.4 of Advantech WebAccess/SCADA are vulnerable to use of untrusted pointers. The RPC arguments the client sent could contain raw memory pointers for the server to use as-is. This could allow an attacker to gain access to the remote file system and the ability to execute commands and overwrite files.

CVSS 3.1 · 9.8 Critical EPSS 2.8% KEV · Not listed

Vendors

Advantech

Products

Webaccess\/scada

CVE-2023-1433

SourceCodester Gadget Works Online Ordering System Products unrestricted upload

A vulnerability was found in SourceCodester Gadget Works Online Ordering System 1.0. It has been classified as problematic. This affects an unknown part of the file admin/products/controller.php?action=add of the component Products Handler. The manipulation of the argument filename leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223215.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Gadget Works Online Ordering System Project

Products

Gadget Works Online Ordering System

CVE-2023-1428

Denial-of-Service in gRPC

There exists an vulnerability causing an abort() to be called in gRPC.  The following headers cause gRPC's C++ implementation to abort() when called via http2: te: x (x != trailers) :scheme: x (x != http, https) grpclb_client_stats: x (x == anything) On top of sending one of those headers, a later header must be sent that gets the total header size past 8KB. We recommend upgrading past git commit 2485fa94bd8a723e5c977d55a3ce10b301b437f8 or v1.53 and above.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Grpc Redhat

Products

Grpc Enterprise Linux

CVE-2023-1418

SourceCodester Friendly Island Pizza Website and Ordering System POST Parameter cashconfirm.php cross site scripting

A vulnerability classified as problematic was found in SourceCodester Friendly Island Pizza Website and Ordering System 1.0. Affected by this vulnerability is an unknown functionality of the file cashconfirm.php of the component POST Parameter Handler. The manipulation of the argument transactioncode leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-223129 was assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Friendly Island Pizza Website And Ordering System Project

Products

Friendly Island Pizza Website And Ordering System

CVE-2023-1416

Simple Art Gallery adminHome.php sql injection

A vulnerability classified as critical has been found in Simple Art Gallery 1.0. Affected is an unknown function of the file adminHome.php. The manipulation of the argument social_facebook leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-223128.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Simple Art Gallery

CVE-2023-1407

SourceCodester Student Study Center Desk Management System manage_user.php sql injection

A vulnerability classified as critical was found in SourceCodester Student Study Center Desk Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/user/manage_user.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-223111.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Oretnom23

Products

Student Study Center Desk Management System

CVE-2023-1402

Moodle: course participation report shows roles the user should not see

The course participation report required additional checks to prevent roles being displayed which the user did not have access to view.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Moodle

Products

Moodle

CVE-2023-1398

XiaoBingBy TeaCMS upload path traversal

A vulnerability classified as critical was found in XiaoBingBy TeaCMS 2.0. Affected by this vulnerability is an unknown functionality of the file /admin/upload. The manipulation leads to path traversal: '../filedir'. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222985 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Teacms Project

Products

Teacms

CVE-2023-1397

SourceCodester Online Student Management System profile.php cross site scripting

A vulnerability classified as problematic has been found in SourceCodester Online Student Management System 1.0. Affected is an unknown function of the file profile.php. The manipulation of the argument adminname leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222984.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Online Student Management System Project

Products

Online Student Management System

CVE-2023-1396

SourceCodester Online Tours & Travels Management System traveller_details.php cross site scripting

A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file admin/traveller_details.php. The manipulation of the argument address leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222983.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Online Tours \& Travels Management System Project

Products

Online Tours \& Travels Management System

CVE-2023-1394

SourceCodester Online Graduate Tracer System bsitemp.php mysqli_query sql injection

A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0. It has been classified as critical. This affects the function mysqli_query of the file bsitemp.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222981 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Online Graduate Tracer System Project

Products

Online Graduate Tracer System

CVE-2023-1391

SourceCodester Online Tours & Travels Management System ab.php unrestricted upload

A vulnerability, which was classified as problematic, was found in SourceCodester Online Tours & Travels Management System 1.0. Affected is an unknown function of the file admin/ab.php. The manipulation of the argument img leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-222978 is the identifier assigned to this vulnerability.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Online Tours \& Travels Management System Project

Products

Online Tours \& Travels Management System

CVE-2023-1386

Qemu: 9pfs: suid/sgid bits not dropped on file write

A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. When a local user in the guest writes an executable file with SUID or SGID, none of these privileged bits are correctly dropped. As a result, in rare circumstances, this flaw could be used by malicious users in the guest to elevate their privileges within the guest and help a host local user to elevate privileges on the host.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Qemu Redhat

Products

Fedora Qemu Advanced Virtualization and 1 more

CVE-2023-1378

SourceCodester Friendly Island Pizza Website and Ordering System POST Parameter paypalsuccess.php sql injection

A vulnerability classified as critical was found in SourceCodester Friendly Island Pizza Website and Ordering System 1.0. This vulnerability affects unknown code of the file paypalsuccess.php of the component POST Parameter Handler. The manipulation of the argument cusid leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222904.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Friendly Island Pizza Website And Ordering System Project

Products

Friendly Island Pizza Website And Ordering System

CVE-2023-1366

SourceCodester Yoga Class Registration System manage_category.php query sql injection

A vulnerability was found in SourceCodester Yoga Class Registration System 1.0. It has been classified as critical. This affects the function query of the file admin/categories/manage_category.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222873 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Yoga Class Registration System Project

Products

Yoga Class Registration System

CVE-2023-1365

SourceCodester Online Pizza Ordering System ajax.php sql injection

A vulnerability was found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/ajax.php. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222872.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Online Pizza Ordering System Project

Products

Online Pizza Ordering System

CVE-2023-1364

SourceCodester Online Pizza Ordering System GET Parameter category.php sql injection

A vulnerability has been found in SourceCodester Online Pizza Ordering System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file category.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222871.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Online Pizza Ordering System Project

Products

Online Pizza Ordering System