CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2023-41506
https://notcve.org/view.php?id=CVE-2023-41506
27 Feb 2024 — An arbitrary file upload vulnerability in the Update/Edit Student's Profile Picture function of Student Enrollment In PHP v1.0 allows attackers to execute arbitrary code via uploading a crafted PHP file. Una vulnerabilidad de carga de archivos arbitrarios en la función Actualizar/Editar imagen de perfil del estudiante de Student Enrollment In PHP v1.0 permite a los atacantes ejecutar código arbitrario cargando un archivo PHP manipulado. • https://github.com/ASR511-OO7/CVE-2023-41506 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2024-25218
https://notcve.org/view.php?id=CVE-2024-25218
14 Feb 2024 — A cross-site scripting (XSS) vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Project Name parameter /TaskManager/Projects.php. Una vulnerabilidad de Cross-Site Scripting (XSS) en la aplicación Task Manager v1.0 permite a los atacantes ejecutar scripts o HTML arbitrarios a través de un payload manipulado inyectado en el parámetro Nombre del proyecto /TaskManager/Projects.php. • https://github.com/BurakSevben/CVEs/blob/main/Task%20Manager%20App/Task%20Manager%20App%20-%20Cross-Site-Scripting%20-1.md • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2024-25222
https://notcve.org/view.php?id=CVE-2024-25222
14 Feb 2024 — Task Manager App v1.0 was discovered to contain a SQL injection vulnerability via the projectID parameter at /TaskManager/EditProject.php. Se descubrió que la aplicación Task Manager v1.0 contiene una vulnerabilidad de inyección SQL a través del parámetro projectID en /TaskManager/EditProject.php. • https://github.com/BurakSevben/CVEs/blob/main/Task%20Manager%20App/Task%20Manager%20App%20-%20SQL%20Injection%20-%201.md • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2024-25219
https://notcve.org/view.php?id=CVE-2024-25219
14 Feb 2024 — A cross-site scripting (XSS) vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Task Name parameter /TaskManager/Task.php. Una vulnerabilidad de Cross-Site Scripting (XSS) en la aplicación Task Manager v1.0 permite a los atacantes ejecutar scripts web o HTML arbitrarios a través de un payload manipulado inyectado en el parámetro Nombre de tarea /TaskManager/Task.php. • https://github.com/BurakSevben/CVEs/blob/main/Task%20Manager%20App/Task%20Manager%20App%20-%20Cross-Site-Scripting%20-%202.md • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2024-25220
https://notcve.org/view.php?id=CVE-2024-25220
14 Feb 2024 — Task Manager App v1.0 was discovered to contain a SQL injection vulnerability via the taskID parameter at /TaskManager/EditTask.php. Se descubrió que la aplicación Task Manager v1.0 contenía una vulnerabilidad de inyección SQL a través del parámetro taskID en /TaskManager/EditTask.php. • https://github.com/BurakSevben/CVEs/blob/main/Task%20Manager%20App/Task%20Manager%20App%20-%20SQL%20Injection%20-%202.md • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 1CVE-2024-25221
https://notcve.org/view.php?id=CVE-2024-25221
14 Feb 2024 — A cross-site scripting (XSS) vulnerability in Task Manager App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Note Section parameter at /TaskManager/Tasks.php. Se descubrió que la aplicación Simple Admin Panel v1.0 contiene una vulnerabilidad de inyección SQL a través del parámetro orderID en /adminView/viewEachOrder.php. • https://github.com/BurakSevben/CVEs/blob/main/Task%20Manager%20App/Task%20Manager%20App%20-%20Cross-Site-Scripting%20-3.md • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 2CVE-2023-6165 – Restrict Usernames Emails Characters Plugin < 3.1.4 - Admin+ Stored XSS
https://notcve.org/view.php?id=CVE-2023-6165
29 Jan 2024 — The Restrict Usernames Emails Characters WordPress plugin before 3.1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed El complemento de WordPress Restrict Usernames Emails Characters anterior a 3.1.4 no sanitiza ni escapa a algunas de sus configuraciones, lo que podría permitir a usuarios con altos privilegios, como el administrador, realizar ataques de cross site scriptin... • https://github.com/youki992/youki992.github.io/blob/master/others/apply2.md • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.2EPSS: 0%CPEs: 14EXPL: 0CVE-2022-4900 – Potential buffer overflow in php_cli_server_startup_workers
https://notcve.org/view.php?id=CVE-2022-4900
02 Nov 2023 — A vulnerability was found in PHP where setting the environment variable PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer overflow. Se encontró una vulnerabilidad en PHP donde establecer la variable de entorno PHP_CLI_SERVER_WORKERS en un valor grande provoca un desbordamiento del búfer del heap. USN-6757-1 fixed vulnerabilities in PHP. Unfortunately these fixes were incomplete for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 23.10. This update fixes the problem. • https://access.redhat.com/security/cve/CVE-2022-4900 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-787: Out-of-bounds Write •
CVSS: 9.9EPSS: 4%CPEs: 1EXPL: 1CVE-2023-5199 – PHP to Page <= 0.3 - Authenticated (Subscriber+) Local File Inclusion to Remote Code Execution via Shortcode
https://notcve.org/view.php?id=CVE-2023-5199
29 Oct 2023 — The PHP to Page plugin for WordPress is vulnerable Local File Inclusion to Remote Code Execution in versions up to, and including, 0.3 via the 'php-to-page' shortcode. This allows authenticated attackers with subscriber-level permissions or above, to include local file and potentially execute code on the server. While subscribers may need to poison log files or otherwise get a file installed in order to achieve remote code execution, author and above users can upload files by default and achieve remote code... • https://plugins.trac.wordpress.org/browser/php-to-page/trunk/php-to-page.php?rev=441028#L22 • CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') CWE-552: Files or Directories Accessible to External Parties •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2023-42359
https://notcve.org/view.php?id=CVE-2023-42359
18 Sep 2023 — SQL injection vulnerability in Exam Form Submission in PHP with Source Code v.1.0 allows a remote attacker to escalate privileges via the val-username parameter in /index.php. Vulnerabilidad de inyección SQL en el Exam Form Submission en PHP con Código Fuente v.1.0 permite a un atacante remoto escalar privilegios a través del parámetro val-username en /index.php. • https://upbeat-washer-def.notion.site/Exam-Form-Submission-In-PHP-SQL-Injection-in-index-php-bd71962db712459488019d531ab2f6f2?pvs=4 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •