Vulnerabilidades

Una vulnerabilidad fue detectada en 1000projects Design & Development of Student Database Management System 1.0. Afecta a una función desconocida del archivo /TeacherLogin/Academics/SubjectDetails.php. La manipulación del argumento SubCode resulta en inyección SQL. El ataque puede realizarse de forma remota. El…

Se ha encontrado un fallo en Dromara dataCompare hasta la versión 1.0.1. El elemento afectado es la función DbConfig del archivo src/main/java/com/vince/xq/project/system/dbconfig/service/DbconfigServiceImpl.java del componente Gestor de URL JDBC. La ejecución de manipulación puede conducir a la inyección. El ataque…

A flaw has been found in WeiYe-Jing datax-web up to 2.1.2. Affected is an unknown function. Executing manipulation can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.

A vulnerability was detected in WeiYe-Jing datax-web up to 2.1.2. This impacts the function remove/update/pause/start/triggerJob of the component Job Handler. Performing manipulation results in improper access controls. The attack may be initiated remotely. The exploit is now public and may be used.

El plugin Data Tables Generator by Supsystic para WordPress es vulnerable a la eliminación arbitraria de archivos debido a una validación insuficiente de la ruta de archivo en la función cleanCache() en todas las versiones hasta la 1.10.45, inclusive. Esto permite a atacantes autenticados, con acceso de nivel de…

Dell Data Lakehouse, versions prior to 1.6.0.0, contain(s) an Improper Access Control vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Elevation of privileges. This vulnerability is considered Critical, as it may result in unauthorized access with…

The Datadog Agent collects events and metrics from hosts and sends them to Datadog. A vulnerability within the Datadog Linux Host Agent versions 7.65.0 through 7.70.2 exists due to insufficient permissions being set on the `opt/datadog-agent/python-scripts/__pycache__` directory during installation. Code in this…

When using the Grafana Databricks Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it could result in the wrong user identifier being used, and information for which the viewer is not authorized being…

When using the Grafana Snowflake Datasource Plugin, if Oauth passthrough is enabled on the datasource, and multiple users are using the same datasource at the same time on a single Grafana instance, it could result in the wrong user identifier being used, and information for which the viewer is not authorized being…

A security issue exists within DataMosaix™ Private Cloud allowing for Persistent XSS. This vulnerability can result in the execution of malicious JavaScript, allowing for account takeover, credential theft, or redirection to a malicious website.

A security issue exists within DataMosaix™ Private Cloud, allowing attackers to bypass MFA during setup and obtain a valid login-token cookie without knowing the users password. This vulnerability occurs when MFA is enabled but not completed within a 7-day period.

Una vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en el Sistema de Gestión de Base de Datos de Cliente SourceCodester 1.0 permite a un atacante hacer que un usuario administrativo autenticado realice acciones de eliminación de usuarios sin su consentimiento. El endpoint de eliminación de…

Datasette es una multiherramienta de código abierto para explorar y publicar datos. En las versiones 0.65.1 e inferiores y de la 1.0a0 a la 1.0a19, las instancias desplegadas de Datasette incluyen una vulnerabilidad de redirección abierta. Las solicitudes a la ruta //example.com/foo/bar/ (la barra final es…

Vulnerabilidad de cross-site scripting y ejecución remota de código en Heimdall Data Database Proxy. Esta vulnerabilidad permite a atacantes remotos ejecutar código arbitrario en instalaciones afectadas de Heimdall Data Database Proxy. Se requiere una interacción mínima del usuario para explotar esta vulnerabilidad.…

Dataease is an open source data visualization analysis tool. In versions 2.10.14 and below, DataEase did not properly filter when establishing JDBC connections to Oracle, resulting in a risk of JNDI injection (Java Naming and Directory Interface injection). This issue is fixed in version 2.10.15.

DataEase is an open source data visualization analysis tool. In versions 2.10.14 and below, the vendor added a blacklist to filter ldap:// and ldaps://. However, omission of protection for the dns:// protocol results in an SSRF vulnerability. This issue is fixed in version 2.10.15.

The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'saswp_tiny_multiple_faq' shortcode in all versions up to, and including, 1.51 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for…

Vulnerabilidad de Cross-Site Request Forgery (CSRF) en Younes JFR. Advanced Database Cleaner advanced-database-cleaner permite Cross Site Request Forgery. Este problema afecta a Advanced Database Cleaner: desde n/a hasta menor igual que 3.1.6.

Incorrect access control on Dataphone A920 v2025.07.161103 exposes a service on port 8888 by default on the local network without authentication. This allows an attacker to interact with the device via a TCP socket without credentials. Additionally, sending an HTTP request to the service on port 8888 triggers an error…

An issue was discovered in Dataphone A920 v2025.07.161103. A custom packet based on public documentation can be crafted, where some fields can contain arbitrary or trivial data. Normally, such data should cause the device to reject the packet. However, due to a lack of validation, the device accepts it with no…

El plugin Advanced Database Cleaner para WordPress es vulnerable a la falsificación de petición en sitios cruzados en todas las versiones hasta la 3.1.6, inclusive. Esto se debe a la validación de nonce faltante o incorrecta en la función aDBc_prepare_elements_to_clean(). Esto hace posible que atacantes no…

Multiple NAS management applications provided by I-O DATA DEVICE, INC. register Windows services with unquoted file paths. A user with the write permission on the root directory of the system drive may execute arbitrary code with SYSTEM privilege.

El plugin Simple Business Data para WordPress es vulnerable a cross-site scripting almacenado a través de los atributos del shortcode 'simple_business_data' en todas las versiones hasta la 1.0.1, inclusive. Esto se debe a que el plugin no sanea correctamente la entrada del usuario ni escapa la salida al incrustar el…

This High severity Path Traversal (Arbitrary Write) vulnerability was introduced in versions: 9.12.0, 10.3.0 and remain present in 11.0.0 of Jira Software Data Center and Server. This Path Traversal (Arbitrary Write) vulnerability, with a CVSS Score of 8.7, allows an attacker to modify any filesystem path writable by…

Vulnerabilidad en el producto Oracle Health Sciences Data Management Workbench de Oracle Health Sciences Applications (componente: Logger). Las versiones compatibles que están afectadas son 3.4.0.1.3 y 3.4.1.0.10. La vulnerabilidad fácilmente explotable permite a un atacante con altos privilegios y acceso a la red a…