Search vulnerabilities

Expected end of text, found '–' (at char 49), (line:1, col:50)
Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 425,740

CVE-2024-7831

D-Link DNS-1550-04 photocenter_mgr.cgi cgi_get_cooliris buffer overflow

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814 and classified as critical. Affected by this vulnerability is the function cgi_get_cooliris of the file /cgi-bin/photocenter_mgr.cgi. The manipulation of the argument path leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.

CVSS 4.0 · 8.7 High EPSS 1.8% KEV · Not listed
Vendors
Dlink
Products
Dnr-202l Dnr-202l Firmware Dnr-322l and 37 more
CVE-2024-7830

D-Link DNS-1550-04 photocenter_mgr.cgi cgi_move_photo buffer overflow

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. Affected is the function cgi_move_photo of the file /cgi-bin/photocenter_mgr.cgi. The manipulation of the argument photo_name leads to buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.

CVSS 4.0 · 8.7 High EPSS 1.8% KEV · Not listed
Vendors
Dlink
Products
Dnr-202l Dnr-202l Firmware Dnr-322l and 37 more
CVE-2024-7829

D-Link DNS-1550-04 photocenter_mgr.cgi cgi_del_photo buffer overflow

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. This issue affects the function cgi_del_photo of the file /cgi-bin/photocenter_mgr.cgi. The manipulation of the argument current_path leads to buffer overflow. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.

CVSS 4.0 · 8.7 High EPSS 1.8% KEV · Not listed
Vendors
Dlink
Products
Dnr-202l Dnr-202l Firmware Dnr-322l and 37 more
CVE-2024-7828

D-Link DNS-1550-04 photocenter_mgr.cgi cgi_set_cover buffer overflow

** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. This vulnerability affects the function cgi_set_cover of the file /cgi-bin/photocenter_mgr.cgi. The manipulation of the argument album_name leads to buffer overflow. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: Vendor was contacted early and confirmed that the product is end-of-life. It should be retired and replaced.

CVSS 4.0 · 8.7 High EPSS 16.2% KEV · Not listed
Vendors
Dlink
Products
Dnr-202l Dnr-202l Firmware Dnr-322l and 37 more
CVE-2024-7815

CodeAstro Online Railway Reservation System Update Employee Page admin-update-employee.php cross site scripting

A vulnerability has been found in CodeAstro Online Railway Reservation System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/admin-update-employee.php of the component Update Employee Page. The manipulation of the argument emp_fname /emp_lname /emp_nat_idno/emp_addr leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.1 Medium EPSS 1.2% KEV · Not listed
Vendors
Codeastro Online Railway Reservation System Project
Products
Online Railway Reservation System Online Railway Reservation System
CVE-2024-7813

SourceCodester Prison Management System Profile Image insufficiently protected credentials

A vulnerability, which was classified as problematic, has been found in SourceCodester Prison Management System 1.0. This issue affects some unknown processing of the file /uploadImage/Profile/ of the component Profile Image Handler. The manipulation leads to insufficiently protected credentials. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Prison Management System Project Sourcecodester
Products
Prison Management System Prison Management System
CVE-2024-7811

SourceCodester Daily Expenses Monitoring App delete-expense.php sql injection

A vulnerability classified as critical has been found in SourceCodester Daily Expenses Monitoring App 1.0. This affects an unknown part of the file /endpoint/delete-expense.php. The manipulation of the argument expense leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Rems Sourcecodester
Products
Daily Expenses Monitoring App Daily Expenses Monitoring App
CVE-2024-7750

SourceCodester Clinics Patient Management System medicines.php sql injection

A vulnerability has been found in SourceCodester Clinics Patient Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /medicines.php. The manipulation of the argument medicine_name leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Oretnom23 Sourcecodester
Products
Clinic\'s Patient Management System Clinics Patient Management System
CVE-2024-7752

SourceCodester Clinics Patient Management System update_medicine.php cross site scripting

A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /update_medicine.php. The manipulation of the argument medicine_name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Oretnom23 Sourcecodester
Products
Clinic\'s Patient Management System Clinics Patient Management System
CVE-2024-7754

SourceCodester Clinics Patient Management System check_medicine_name.php sql injection

A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /ajax/check_medicine_name.php. The manipulation of the argument user_name leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Oretnom23
Products
Clinic\'s Patient Management System
CVE-2024-7645

SourceCodester Clinics Patient Management System User Page users.php cross-site request forgery

A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file users.php of the component User Page. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Oretnom23 Sourcecodester
Products
Clinic\'s Patient Management System Clinics Patient Management System
CVE-2024-7751

SourceCodester Clinics Patient Management System update_medicine.php sql injection

A vulnerability was found in SourceCodester Clinics Patient Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /update_medicine.php. The manipulation of the argument hidden_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Oretnom23 Sourcecodester
Products
Clinic\'s Patient Management System Clinics Patient Management System
CVE-2024-7753

SourceCodester Clinics Patient Management System user_images direct request

A vulnerability was found in SourceCodester Clinics Patient Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /user_images/. The manipulation leads to direct request. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Clinics Patient Management System Project Oretnom23
Products
Clinics Patient Management System Clinic\'s Patient Management System
CVE-2024-7494

SourceCodester Clinics Patient Management System new_prescription.php sql injection

A vulnerability, which was classified as critical, has been found in SourceCodester Clinics Patient Management System 1.0. Affected by this issue is some unknown functionality of the file /new_prescription.php. The manipulation of the argument patient leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-273620.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Oretnom23 Sourcecodester
Products
Clinic\'s Patient Management System Clinics Patient Management System
CVE-2024-6358

Incorrect Authorization vulnerability

Incorrect Authorization vulnerability identified in OpenText ArcSight Intelligence.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Opentext
Products
Arcsight Intelligence
CVE-2024-6359

Privilege escalation vulnerability

Privilege escalation vulnerability identified in OpenText ArcSight Intelligence.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Opentext
Products
Arcsight Intelligence
CVE-2024-6357

Insecure Direct Object Reference vulnerability

Insecure Direct Object Reference vulnerability identified in OpenText ArcSight Intelligence.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Opentext
Products
Arcsight Intelligence
CVE-2024-7008

Calibre Reflected Cross-Site Scripting (XSS)

Unsanitized user-input in Calibre <= 7.15.0 allow attackers to perform reflected cross-site scripting.

CVSS 3.1 · 5.4 Medium EPSS 25.6% KEV · Not listed
Vendors
Calibre Calibre-ebook
Products
Calibre Calibre
CVE-2024-7009

Calibre SQL Injection

Unsanitized user-input in Calibre <= 7.15.0 allow users with permissions to perform full-text searches to achieve SQL injection on the SQLite database.

CVSS 3.1 · 4.2 Medium EPSS 13.9% KEV · Not listed
Vendors
Calibre-ebook Kovidgoyal
Products
Calibre Calibre