CVE-2022-2870

laravel deserialization

A vulnerability was found in laravel 5.1 and classified as problematic. This issue affects some unknown processing. The manipulation leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-206501 was assigned to this vulnerability.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed

Vendors

Laravel

Products

Laravel

CVE-2022-2847

SourceCodester Guest Management System front.php sql injection

A vulnerability, which was classified as critical, has been found in SourceCodester Guest Management System. This issue affects some unknown processing of the file /guestmanagement/front.php. The manipulation of the argument rid leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-206489 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Guest Management System Project

Products

Guest Management System

CVE-2022-2844

MotoPress Timetable and Event Schedule Calendar cross site scripting

A vulnerability classified as problematic has been found in MotoPress Timetable and Event Schedule up to 1.4.06. This affects an unknown part of the file /wp/?cpmvc_id=1&cpmvc_do_action=mvparse&f=datafeed&calid=1&month_index=1&method=adddetails&id=2 of the component Calendar Handler. The manipulation of the argument Subject/Location/Description leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-206487.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Motopress

Products

Timetable And Event Schedule

CVE-2022-2843

MotoPress Timetable and Event Schedule Quick Edit admin-ajax.php cross site scripting

A vulnerability was found in MotoPress Timetable and Event Schedule. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /wp-admin/admin-ajax.php of the component Quick Edit. The manipulation of the argument post_title with the input <img src=x onerror=alert`2`> leads to cross site scripting. The attack may be launched remotely. VDB-206486 is the identifier assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Motopress

Products

Timetable And Event Schedule

CVE-2022-2841

CrowdStrike Falcon Uninstallation authorization

A vulnerability was found in CrowdStrike Falcon 6.31.14505.0/6.42.15610/6.44.15806. It has been classified as problematic. Affected is an unknown function of the component Uninstallation Handler. The manipulation leads to missing authorization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 6.40.15409, 6.42.15611 and 6.44.15807 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-206880.

CVSS 3.1 · 2.7 Low EPSS 5.1% KEV · Not listed

Vendors

Crowdstrike

Products

Falcon

CVE-2022-2814

SourceCodester Simple and Nice Shopping Cart Script login.php cross site scripting

A vulnerability has been found in SourceCodester Simple and Nice Shopping Cart Script and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /mkshope/login.php. The manipulation of the argument msg leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-206401 was assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Simple And Nice Shopping Cart Script Project

Products

Simple And Nice Shopping Cart Script

CVE-2022-2813

SourceCodester Guest Management System cleartext storage

A vulnerability, which was classified as problematic, was found in SourceCodester Guest Management System. Affected is an unknown function. The manipulation leads to cleartext storage of passwords in the database. The identifier of this vulnerability is VDB-206400.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Guest Management System Project

Products

Guest Management System

CVE-2022-2811

SourceCodester Guest Management System myform.php cross site scripting

A vulnerability classified as problematic has been found in SourceCodester Guest Management System. This affects an unknown part of the file myform.php. The manipulation of the argument name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-206397 was assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Guest Management System Project

Products

Guest Management System

CVE-2022-2809

Unauthenticated out of bounds heap write in bmcweb

A vulnerability in bmcweb of OpenBMC Project allows user to cause denial of service. When fuzzing the multipart_parser code using AFL++ with address sanitizer enabled to find smallest memory corruptions possible. It detected problem in how multipart_parser handles unclosed http headers. If long enough http header is passed in the multipart form without colon there is one byte overwrite on heap. It can be conducted multiple times in a loop to cause DoS.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Openbmc-project

Products

Openbmc

CVE-2022-2803

SourceCodester Zoo Management System animals.php sql injection

A vulnerability was found in SourceCodester Zoo Management System and classified as critical. This issue affects some unknown processing of the file /pages/animals.php. The manipulation of the argument class_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-206249 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Zoo Management System

CVE-2022-2801

SourceCodester Automated Beer Parlour Billing System Login sql injection

A vulnerability, which was classified as critical, was found in SourceCodester Automated Beer Parlour Billing System. This affects an unknown part of the component Login. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-206247.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Automated Beer Parlour Billing System Project

Products

Automated Beer Parlour Billing System

CVE-2022-2797

SourceCodester Student Information System view_student.php sql injection

A vulnerability classified as critical was found in SourceCodester Student Information System. Affected by this vulnerability is an unknown functionality of the file /admin/students/view_student.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The identifier VDB-206245 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Student Information System Project

Products

Student Information System

CVE-2022-2779

SourceCodester Gas Agency Management System oneWord.php unrestricted upload

A vulnerability classified as critical was found in SourceCodester Gas Agency Management System. Affected by this vulnerability is an unknown functionality of the file /gasmark/assets/myimages/oneWord.php. The manipulation of the argument shell leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-206173 was assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Gas Agency Management System Project

Products

Gas Agency Management System

CVE-2022-2776

SourceCodester Gym Management System delete_user.php denial of service

A vulnerability classified as problematic has been found in SourceCodester Gym Management System. Affected is an unknown function of the file delete_user.php. The manipulation of the argument delete_user leads to denial of service. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-206172.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Gym Management System Project

Products

Gym Management System

CVE-2022-2774

SourceCodester Library Management System student.php sql injection

A vulnerability was found in SourceCodester Library Management System. It has been declared as critical. This vulnerability affects unknown code of the file librarian/student.php. The manipulation of the argument title leads to sql injection. The attack can be initiated remotely. VDB-206170 is the identifier assigned to this vulnerability.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Library Management System Project

Products

Library Management System

CVE-2022-2773

SourceCodester Apartment Visitor Management System profile.php cross site scripting

A vulnerability was found in SourceCodester Apartment Visitor Management System. It has been classified as problematic. This affects an unknown part of the file profile.php. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The identifier VDB-206169 was assigned to this vulnerability.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Apartment Visitors Management System Project

Products

Apartment Visitors Management System

CVE-2022-2772

SourceCodester Apartment Visitor Management System action-visitor.php sql injection

A vulnerability was found in SourceCodester Apartment Visitor Management System and classified as critical. Affected by this issue is some unknown functionality of the file action-visitor.php. The manipulation of the argument editid/remark leads to sql injection. The attack may be launched remotely. The identifier of this vulnerability is VDB-206168.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apartment Visitors Management System Project

Products

Apartment Visitors Management System

CVE-2022-2771

SourceCodester Simple Online Book Store System bookPerPub.php sql injection

A vulnerability has been found in SourceCodester Simple Online Book Store System and classified as critical. Affected by this vulnerability is an unknown functionality of the file /obs/bookPerPub.php. The manipulation of the argument bookisbn leads to sql injection. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-206167.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Simple Online Book Store System Project

Products

Simple Online Book Store System

CVE-2022-2768

SourceCodester Library Management System cross site scripting

A vulnerability classified as problematic was found in SourceCodester Library Management System. This vulnerability affects unknown code of the file /qr/I/. The manipulation of the argument error leads to cross site scripting. The attack can be initiated remotely. The identifier of this vulnerability is VDB-206164.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Library Management System Project

Products

Library Management System

CVE-2022-2767

SourceCodester Online Admission System index.php cross site scripting

A vulnerability classified as problematic has been found in SourceCodester Online Admission System. This affects an unknown part of the file /index.php. The manipulation of the argument student_add leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-206163.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Online Admission System Project

Products

Online Admission System