Podatności

A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown part of the file changebookingstatus.php of the component submit2 Handler. Such manipulation of the argument username[]/timestamp[]/status[] leads…

CVSS 7,3 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

A vulnerability was identified in SourceCodester E-Learning System 1.0. This affects the function save_users of the file /classes/Users.php?f=save. Such manipulation of the argument img leads to unrestricted upload. The attack can be launched remotely. The exploit is publicly available and might…

CVSS 7,3 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing javascript: URLs in citation embed_url fields. Attackers can share a crafted chat whose citation, when clicked, is passed to…

CVSS 7,3 · EPSS 0,28 % · rekomendacja wg zapisanej polityki

9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allows authenticated dashboard users to inject arbitrary keys into the Hermes Agent config.yaml file. Attackers can submit a baseUrl containing double quotes and…

CVSS 7,3 · EPSS 0,27 % · rekomendacja wg zapisanej polityki

KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function within app/function/helper.function.php, where a single non-recursive str_replace() sanitization pass can be bypassed using crafted filenames like "....//", combined with PclZip's extract() call in…

CVSS 7,2 · EPSS 0,77 % · rekomendacja wg zapisanej polityki

Unauthenticated Broken Authentication in eRoom <= 1.7.1 versions.

CVSS 7,3 · EPSS 0,27 % · rekomendacja wg zapisanej polityki

Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.

CVSS 7,3 · EPSS 0,27 % · rekomendacja wg zapisanej polityki

A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects some unknown processing of the file User/forgot3.php of the component Password Reset. Performing a manipulation of the argument email/password results in sql…

CVSS 7,3 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FpySequencer STORE directive stack write validation the bounds check adds attacker-controlled offset and size before memcpy, allowing integer wraparound…

CVSS 7,2 · EPSS 0,75 % · rekomendacja wg zapisanej polityki

Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Session Hijacking.This issue affects Broadcast Live Video: from n/a through 7.3.2.

CVSS 7,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the attacker-controlled HTTP 'Host' header. This makes it possible for…

CVSS 7,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from inference_information.json without confining it to the results directory. Attackers who can modify inference_information.json can point it at a…

CVSS 7,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.

CVSS 7,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the _crossnote namespace, and invokes…

CVSS 7,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then check_filter_exec() in mt.c passed the constructed command…

CVSS 7,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could…

CVSS 7,2 · EPSS 0,71 % · rekomendacja wg zapisanej polityki

Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a stored cross-site scripting vulnerability in a report view that interpolates stored record names into markup without escaping. Authenticated users able to create records can store crafted record names that execute script in the…

CVSS 7,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki

Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a stored cross-site scripting vulnerability because a tool view interpolates stored record names into markup without escaping. An authenticated user able to create such records can give them malicious names, executing script in the…

CVSS 7,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki

Insecure Storage of Sensitive Information vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4.

CVSS 7,3 · EPSS 0,17 % · rekomendacja wg zapisanej polityki

Vifm 0.8.1-beta through 0.14.4 reuses a pre-existing IPC FIFO in the shared temporary directory without checking ownership, allowing local users to execute commands as another user. Attackers can pre-create a world-writable vifm-ipc-vifm FIFO and write IPC packets with -c and ! shell commands that…

CVSS 7,3 · EPSS 0,15 % · rekomendacja wg zapisanej polityki

The Post Export Import with Media plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.17.1 via deserialization of untrusted input . This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object.…

CVSS 7,2 · EPSS 0,64 % · rekomendacja wg zapisanej polityki

IBM Power Systems Firmware FW1060.00 through FW1060.81 is affected by a vulnerability in host firmware configuration parsing. An attacker with authenticated service-level access to the service processor can write specially crafted configuration data, causing the host firmware boot stack to crash…

CVSS 7,3 · EPSS 0,14 % · rekomendacja wg zapisanej polityki

NVIDIA DALI contains a vulnerability where an attacker could cause a stack-based buffer overflow. A successful exploit of this vulnerability might lead to code execution, information disclosure, data tampering, and denial of service.

CVSS 7,3 · EPSS 0,14 % · rekomendacja wg zapisanej polityki

ImageMagick on Windows through 7.1.2-33 and 6.9.13-58 contains an uncontrolled search path vulnerability in NTGhostscriptEXE() that launches gswin64c.exe by bare name when Ghostscript is unregistered. Attackers can plant a malicious gswin64c.exe in the working directory to execute code with…

CVSS 7,3 · EPSS 0,13 % · rekomendacja wg zapisanej polityki

NVIDIA DALI contains a vulnerability where an attacker could cause an uncontrolled out-of-bounds write. A successful exploit of this vulnerability might lead to denial of service, information disclosure, and data tampering.

CVSS 7,3 · EPSS 0,13 % · rekomendacja wg zapisanej polityki