Podatności

A vulnerability was detected in itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449. This affects the function MySQLDB::addNewUser of the file include/database.php of the component Registration Form. Performing a manipulation of the argument branch results in…

CVSS 7,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki

A vulnerability was identified in SourceCodester Performance Indicator System 1.0. This issue affects some unknown processing of the file /opils/staff/product.php. The manipulation of the argument Category leads to sql injection. The attack may be initiated remotely. The exploit is publicly…

CVSS 7,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki

Stack-based buffer overflow in SysInternals allows an authorized attacker to elevate privileges locally.

CVSS 7,3 · EPSS 0,41 % · rekomendacja wg zapisanej polityki

Inclusion of functionality from untrusted control sphere in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVSS 7,2 · EPSS 0,9 % · rekomendacja wg zapisanej polityki

Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network.

CVSS 7,2 · EPSS 0,89 % · rekomendacja wg zapisanej polityki

External control of system or configuration setting in Microsoft PowerToys allows an authorized attacker to elevate privileges locally.

CVSS 7,3 · EPSS 0,37 % · rekomendacja wg zapisanej polityki

An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and impersonate a service account in the project. This vulnerability…

CVSS 7,3 · EPSS 0,36 % · rekomendacja wg zapisanej polityki

A weakness has been identified in cemtan sar2html 4.0.0. Affected by this issue is the function index of the file sar2html.py. This manipulation of the argument sort causes sql injection. The attack is possible to be carried out remotely. The exploit has been made available to the public and could…

CVSS 7,3 · EPSS 0,34 % · rekomendacja wg zapisanej polityki

Wazuh from 4.3.0 before 4.14.8 contains a remote code execution vulnerability where SCA policy trust is determined by file path rather than configuration source. Attackers controlling a manager can write unsigned policy files to var/incoming via the upgrade channel and reference them to execute…

CVSS 7,2 · EPSS 0,83 % · rekomendacja wg zapisanej polityki

A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown part of the file changebookingstatus.php of the component submit2 Handler. Such manipulation of the argument username[]/timestamp[]/status[] leads…

CVSS 7,3 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

A vulnerability was identified in SourceCodester E-Learning System 1.0. This affects the function save_users of the file /classes/Users.php?f=save. Such manipulation of the argument img leads to unrestricted upload. The attack can be launched remotely. The exploit is publicly available and might…

CVSS 7,3 · EPSS 0,29 % · rekomendacja wg zapisanej polityki

Open WebUI from 0.6.33 before 0.11.4 contains a cross-site scripting vulnerability that allows authenticated users to execute script in victims' sessions by storing javascript: URLs in citation embed_url fields. Attackers can share a crafted chat whose citation, when clicked, is passed to…

CVSS 7,3 · EPSS 0,28 % · rekomendacja wg zapisanej polityki

9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allows authenticated dashboard users to inject arbitrary keys into the Hermes Agent config.yaml file. Attackers can submit a baseUrl containing double quotes and…

CVSS 7,3 · EPSS 0,27 % · rekomendacja wg zapisanej polityki

KodExplorer before 4.55 contains a path traversal vulnerability in the unzip_pre_name() function within app/function/helper.function.php, where a single non-recursive str_replace() sanitization pass can be bypassed using crafted filenames like "....//", combined with PclZip's extract() call in…

CVSS 7,2 · EPSS 0,77 % · rekomendacja wg zapisanej polityki

Unauthenticated Broken Authentication in eRoom <= 1.7.1 versions.

CVSS 7,3 · EPSS 0,27 % · rekomendacja wg zapisanej polityki

Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12.

CVSS 7,3 · EPSS 0,27 % · rekomendacja wg zapisanej polityki

A vulnerability was found in AdithyaYelloju Restaurant-Management-System up to 7f0e7e84255e8fcfd488e83f8f91451bbbff6b9c. This issue affects some unknown processing of the file User/forgot3.php of the component Password Reset. Performing a manipulation of the argument email/password results in sql…

CVSS 7,3 · EPSS 0,26 % · rekomendacja wg zapisanej polityki

F´ (F Prime) is a framework that enables development and deployment of spaceflight and other embedded software applications. Prior to 4.2.0, Svc::FpySequencer STORE directive stack write validation the bounds check adds attacker-controlled offset and size before memcpy, allowing integer wraparound…

CVSS 7,2 · EPSS 0,75 % · rekomendacja wg zapisanej polityki

Session Fixation vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Session Hijacking.This issue affects Broadcast Live Video: from n/a through 7.3.2.

CVSS 7,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the attacker-controlled HTTP 'Host' header. This makes it possible for…

CVSS 7,3 · EPSS 0,24 % · rekomendacja wg zapisanej polityki

MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessing_file path read from inference_information.json without confining it to the results directory. Attackers who can modify inference_information.json can point it at a…

CVSS 7,3 · EPSS 0,23 % · rekomendacja wg zapisanej polityki

Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.

CVSS 7,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the _crossnote namespace, and invokes…

CVSS 7,3 · EPSS 0,22 % · rekomendacja wg zapisanej polityki

MultiTail is a utility for monitoring multiple log files in one terminal. In version 7.1.5 and earlier, the -ex and -eX execute-on-match feature appended attacker-controlled matched input to a configured command inside double quotes, then check_filter_exec() in mt.c passed the constructed command…

CVSS 7,3 · EPSS 0,21 % · rekomendacja wg zapisanej polityki

MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could…

CVSS 7,2 · EPSS 0,71 % · rekomendacja wg zapisanej polityki