Export limit exceeded: 45141 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (45141 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-2555 | 1 Oretnom23 | 1 Employee Task Management System | 2025-02-18 | 6.3 Medium |
| A vulnerability was found in SourceCodester Employee Task Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file update-admin.php. The manipulation of the argument admin_id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-257054 is the identifier assigned to this vulnerability. | ||||
| CVE-2024-2556 | 1 Oretnom23 | 1 Employee Task Management System | 2025-02-18 | 6.3 Medium |
| A vulnerability was found in SourceCodester Employee Task Management System 1.0. It has been classified as critical. This affects an unknown part of the file attendance-info.php. The manipulation of the argument user_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-257055. | ||||
| CVE-2024-2418 | 1 Mayurik | 1 Best Pos Management System | 2025-02-18 | 6.3 Medium |
| A vulnerability was found in SourceCodester Best POS Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /view_order.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256705 was assigned to this vulnerability. | ||||
| CVE-2024-2393 | 1 Remyandrade | 1 Crud Without Page Reload\/refresh | 2025-02-18 | 6.3 Medium |
| A vulnerability was found in SourceCodester CRUD without Page Reload 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file add_user.php. The manipulation of the argument city leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-256453 was assigned to this vulnerability. | ||||
| CVE-2024-2332 | 1 Oretnom23 | 1 Online Mobile Store Management System | 2025-02-18 | 6.3 Medium |
| A vulnerability was found in SourceCodester Online Mobile Management Store 1.0. It has been rated as critical. This issue affects some unknown processing of the file /admin/maintenance/manage_category.php of the component HTTP GET Request Handler. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-256283. | ||||
| CVE-2022-38922 | 1 Iss-oberlausitz | 1 Bluepage Cms | 2025-02-18 | 9.8 Critical |
| BluePage CMS thru 3.9 processes an insufficiently sanitized HTTP Header Cookie value allowing MySQL Injection in the 'users-cookie-settings' token using a Time-based blind SLEEP payload. | ||||
| CVE-2024-2168 | 1 Mayurik | 1 Online Tours \& Travels Management System | 2025-02-18 | 4.7 Medium |
| A vulnerability was found in SourceCodester Online Tours & Travels Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/operations/expense_category.php of the component HTTP POST Request Handler. The manipulation of the argument status leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-255678 is the identifier assigned to this vulnerability. | ||||
| CVE-2023-6152 | 1 Grafana | 2 Grafana, Grafana Enterprise | 2025-02-15 | 5.4 Medium |
| A user changing their email after signing up and verifying it can change it without verification in profile settings. The configuration option "verify_email_enabled" will only validate email only on sign up. | ||||
| CVE-2022-37377 | 2 Foxit, Microsoft | 3 Pdf Editor, Pdf Reader, Windows | 2025-02-14 | 7.8 High |
| This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Editor 11.1.1.53537;. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within JavaScript optimizations. The issue results from an improper optimization, which can result in a type confusion condition. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16733. | ||||
| CVE-2022-43609 | 1 Ironcad | 1 Ironcad | 2025-02-14 | 7.8 High |
| This vulnerability allows remote attackers to execute arbitrary code on affected installations of IronCAD. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of STP files. When parsing the VECTOR element, the process does not properly initialize a pointer prior to accessing it. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17672. | ||||
| CVE-2025-25355 | 1 Phpgurukul | 1 Land Record System | 2025-02-14 | 7.2 High |
| A SQL Injection vulnerability was found in /admin/bwdates-reports-details.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the fromdate POST request parameter. | ||||
| CVE-2022-38923 | 1 Iss-oberlausitz | 1 Bluepage Cms | 2025-02-14 | 9.8 Critical |
| BluePage CMS thru v3.9 processes an insufficiently sanitized HTTP Header allowing MySQL Injection in the 'User-Agent' field using a Time-based blind SLEEP payload. | ||||
| CVE-2025-25352 | 1 Phpgurukul | 1 Land Record System | 2025-02-14 | 7.2 High |
| A SQL Injection vulnerability was found in /admin/aboutus.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the pagetitle POST request parameter. | ||||
| CVE-2025-25354 | 1 Phpgurukul | 1 Land Record System | 2025-02-14 | 7.2 High |
| A SQL Injection was found in /admin/admin-profile.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the contactnumber POST request parameter. | ||||
| CVE-2025-25356 | 1 Phpgurukul | 1 Land Record System | 2025-02-14 | 7.2 High |
| A SQL Injection vulnerability was found in /admin/bwdates-reports-details.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the " todate" POST request parameter. | ||||
| CVE-2025-25357 | 1 Phpgurukul | 1 Land Record System | 2025-02-14 | 7.2 High |
| A SQL Injection vulnerability was found in /admin/contactus.php in PHPGurukul Land Record System v1.0, which allows remote attackers to execute arbitrary code via the email POST request parameter. | ||||
| CVE-2024-3087 | 1 Phpgurukul | 1 Emergency Ambulance Hiring Portal | 2025-02-14 | 7.3 High |
| A vulnerability, which was classified as critical, has been found in PHPGurukul Emergency Ambulance Hiring Portal 1.0. Affected by this issue is some unknown functionality of the file ambulance-tracking.php of the component Ambulance Tracking Page. The manipulation of the argument searchdata leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-258680. | ||||
| CVE-2021-39351 | 1 Wp Bannerize Project | 1 Wp Bannerize | 2025-02-14 | 7.7 High |
| The WP Bannerize WordPress plugin is vulnerable to authenticated SQL injection via the id parameter found in the ~/Classes/wpBannerizeAdmin.php file which allows attackers to exfiltrate sensitive information from vulnerable sites. This issue affects versions 2.0.0 - 4.0.2. | ||||
| CVE-2021-38345 | 1 Brizy | 1 Brizy-page Builder | 2025-02-14 | 7.1 High |
| The Brizy Page Builder plugin <= 2.3.11 for WordPress used an incorrect authorization check that allowed any logged-in user accessing any endpoint in the wp-admin directory to modify the content of any existing post or page created with the Brizy editor. An identical issue was found by another researcher in Brizy <= 1.0.125 and fixed in version 1.0.126, but the vulnerability was reintroduced in version 1.0.127. | ||||
| CVE-2021-39348 | 1 Thimpress | 1 Learnpress | 2025-02-14 | 5.5 Medium |
| The LearnPress WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $custom_profile parameter found in the ~/inc/admin/views/backend-user-profile.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 4.1.3.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. Please note that this is seperate from CVE-2021-24702. | ||||