Vulnerabilidades

Una falla de seguridad ha sido descubierta en projectworlds puede pasar cargas útiles maliciosas hasta 1.0. Esta vulnerabilidad afecta código desconocido del archivo /add_book.php. La manipulación del argumento image resulta en subida irrestricta. El ataque puede ser ejecutado remotamente. El exploit ha sido publicado…

Una vulnerabilidad fue identificada en projectworlds Advanced Biblioteca Management System 1.0. Esto afecta una parte desconocida del archivo /delete_admin.php. La manipulación del argumento admin_id conduce a inyección SQL. La explotación remota del ataque es posible. El exploit está disponible públicamente y podría…

phpPgAdmin 7.13.0 and earlier contains an incorrect access control vulnerability in sql.php at lines 68-76. The application allows unauthorized manipulation of session variables by accepting user-controlled parameters ('subject', 'server', 'database', 'queryid') without proper validation or access control checks.…

phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled input from $_REQUEST['query'] directly to the browseQuery function without proper sanitization. An authenticated attacker can exploit this vulnerability to execute arbitrary SQL…

phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at line 118. The application directly executes user-supplied SQL queries from the $_REQUEST['query'] parameter without any sanitization or parameterization via $data->conn->Execute($_REQUEST['query']). An authenticated attacker can…

phpPgAdmin 7.13.0 and earlier contains multiple cross-site scripting (XSS) vulnerabilities across various components. User-supplied input from $_REQUEST parameters is reflected in HTML output without proper encoding or sanitization in multiple locations including sequences.php, indexes.php, admin.php, and other…

A security vulnerability has been detected in Public Knowledge Project omp and ojs 3.3.0/3.4.0/3.5.0. Impacted is an unknown function of the file plugins/paymethod/manual/templates/paymentForm.tpl of the component Payment Instructions Setting Handler. The manipulation of the argument manualInstructions leads to cross…

A vulnerability was identified in SourceCodester Online Shop Project 1.0. The affected element is an unknown function of the file /action.php. Such manipulation of the argument Search leads to sql injection. It is possible to launch the attack remotely. The exploit is publicly available and might be used.

A vulnerability was determined in SourceCodester Online Shop Project 1.0. Impacted is an unknown function of the file /shop/register.php. This manipulation of the argument f_name causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized.

A vulnerability was found in code-projects Online Shop Project 1.0. This issue affects some unknown processing of the file /login.php. The manipulation of the argument Password results in sql injection. The attack may be performed from remote. The exploit has been made public and could be used.

A vulnerability was identified in icret EasyImages up to 2.8.6. This affects an unknown part of the file /app/upload.php of the component SVG Image Handler. The manipulation of the argument File leads to cross site scripting. It is possible to initiate the attack remotely.

A reflected cross-site scripted (XSS) vulnerability in the /ecommerce/products.php component of E-commerce Project v1.0 and earlier allows attackers to execute arbitrary Javascript in the context of a user's browser via injecting a crafted payload into the id parameter.

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Simple multi step form allows Cross-Site Scripting (XSS).This issue affects Simple multi step form: from 0.0.0 before 2.0.0.

Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email TFA allows Functionality Bypass.This issue affects Email TFA: from 0.0.0 before 2.0.6.

A command injection vulnerability exists in the MCP Data Science Server's (reading-plus-ai/mcp-server-data-exploration) 0.1.6 in the safe_eval() function (src/mcp_server_ds/server.py:108). The function uses Python's exec() to execute user-supplied scripts but fails to restrict the __builtins__ dictionary in the…

The Project Honey Pot Spam Trap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the printAdminPage() function. This makes it possible for unauthenticated attackers to update settings and inject…

Una vulnerabilidad fue detectada en 1000projects Design & Development of Student Database Management System 1.0. Afecta a una función desconocida del archivo /TeacherLogin/Academics/SubjectDetails.php. La manipulación del argumento SubCode resulta en inyección SQL. El ataque puede realizarse de forma remota. El…

Una vulnerabilidad ha sido encontrada en projectworlds Advanced Library Management System 1.0. Afecta a una función desconocida del archivo /borrowed_book_search.php. Dicha manipulación del argumento datefrom/dateto conduce a inyección SQL. El ataque puede lanzarse remotamente. El exploit ha sido divulgado al público…

Se ha identificado una debilidad en projectworlds Sistema Avanzado de Gestión de Bibliotecas 1.0. Afecta a una función desconocida del archivo /borrow.PHP. La ejecución de una manipulación del argumento roll_number puede conducir a una inyección SQL. Es posible lanzar el ataque remotamente. El exploit se ha puesto a…

Se ha descubierto una falla de seguridad en el Sistema de Gestión Avanzado de Bibliotecas 1.0 de projectworlds. Este problema afecta a un procesamiento desconocido del archivo /book_search.php. Realizar una manipulación del argumento book_pub/book_title resulta en inyección SQL. Es posible iniciar el ataque de forma…

Una vulnerabilidad fue identificada en projectworlds Advanced Library Management System 1.0. Esta vulnerabilidad afecta código desconocido del archivo /add_member.php. Dicha manipulación del argumento roll_number conduce a inyección SQL. El ataque puede ser realizado de forma remota. El exploit está disponible…

Se determinó una vulnerabilidad en projectworlds Advanced Library Management System 1.0. Esto afecta una parte desconocida del archivo /add_librarian.php. Esta manipulación del argumento Username causa inyección SQL. El ataque puede ser llevado a cabo de forma remota. El exploit ha sido divulgado públicamente y puede…

A flaw has been found in WeiYe-Jing datax-web up to 2.1.2. Affected is an unknown function. Executing manipulation can lead to sql injection. The attack may be launched remotely. The exploit has been published and may be used.

A vulnerability was detected in WeiYe-Jing datax-web up to 2.1.2. This impacts the function remove/update/pause/start/triggerJob of the component Job Handler. Performing manipulation results in improper access controls. The attack may be initiated remotely. The exploit is now public and may be used.

A flaw has been found in projectsend up to r1720. Impacted is an unknown function of the component File Editor/Custom Download Aliases. This manipulation causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been published and may be used. Upgrading to version r1945 is…