Overview 631 matches · 73 in Waratek scope · 15 protected · 12 exploited · 5 CISA KEV · 63 public PoC · 14 EPSS ≥ 0.5
631matches
73in Waratek scope11.6%
15protected2.4%
12exploited1.9%
5CISA KEV0.8%
63public PoC10.0%
14EPSS ≥ 0.52.2%
Protected by Waratek
15
2.4%
Rule in development
0
0.0%
Mitigation candidate
1
0.2%
No exploit published
57
9.0%
Outside Waratek scope
4
0.6%
Not applicable
554
87.8%
Withdrawn CVE
0
0.0%
blocked by ARMR today
15
2.4%
partly blocked
0
0.0%
not blocked
616
97.6%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 108 / year
19991
Not applicable1
Medium1
not blocked1
No public exploit1
20000
20010
20022
Not applicable2
High1
Medium1
not blocked2
Working exploit published1
No public exploit1
20033
Not applicable3
Medium3
not blocked3
No public exploit3
20045
Not applicable5
High4
Medium1
not blocked5
Working exploit published1
No public exploit4
20052
Not applicable2
High1
Medium1
not blocked2
No public exploit2
200614
Not applicable14
High5
Medium8
Low1
not blocked14
Working exploit published6
No public exploit8
200735
Not applicable35
High18
Medium16
Low1
not blocked35
Working exploit published11
No public exploit24
20087
No exploit published2
Not applicable5
High2
Medium5
not blocked7
Working exploit published3
No public exploit4
200910
Not applicable10
High9
Medium1
not blocked10
Working exploit published5
No public exploit5
201010
Not applicable10
High8
Medium2
not blocked10
Working exploit published3
No public exploit7
20113
Not applicable3
High1
Medium2
not blocked3
Working exploit published2
No public exploit1
20126
No exploit published1
Not applicable5
High2
Medium4
not blocked6
Working exploit published1
No public exploit5
20132
Not applicable2
Medium1
Low1
not blocked2
No public exploit2
201416
Not applicable16
High1
Medium14
Low1
not blocked16
No public exploit16
201525
Not applicable25
Critical5
High12
Medium8
not blocked25
Working exploit published3
No public exploit22
201612
No exploit published8
Outside Waratek scope1
Not applicable3
Critical1
High2
Medium9
not blocked12
Forecast only1
No public exploit11
201722
Protected by Waratek1
Mitigation candidate1
No exploit published6
Outside Waratek scope1
Not applicable13
Critical3
High10
Medium9
blocked by ARMR today1
not blocked21
Working exploit published5
Proof of concept only1
No public exploit16
201821
Protected by Waratek5
No exploit published4
Outside Waratek scope1
Not applicable11
Critical7
High9
Medium5
blocked by ARMR today5
not blocked16
Working exploit published3
Proof of concept only1
Forecast only2
No public exploit15
201923
Protected by Waratek2
No exploit published3
Outside Waratek scope1
Not applicable17
Critical7
High5
Medium10
Low1
blocked by ARMR today2
not blocked21
Exploited4
Working exploit published2
No public exploit17
202021
No exploit published5
Not applicable16
Critical7
High7
Medium7
not blocked21
Exploited2
No public exploit19
202122
Protected by Waratek2
No exploit published2
Not applicable18
Critical7
High9
Medium6
blocked by ARMR today2
not blocked20
Exploited2
Working exploit published1
Proof of concept only4
No public exploit15
2022108
Protected by Waratek1
No exploit published2
Not applicable105
Critical28
High64
Medium16
blocked by ARMR today1
not blocked107
Exploited1
Working exploit published2
Proof of concept only44
No public exploit61
202376
No exploit published3
Not applicable73
Critical10
High32
Medium33
Low1
not blocked76
Exploited2
Proof of concept only26
No public exploit48
202469
Protected by Waratek2
No exploit published5
Not applicable62
Critical15
High22
Medium30
Low2
blocked by ARMR today2
not blocked67
Exploited1
Working exploit published1
Proof of concept only22
No public exploit45
202580
Protected by Waratek2
No exploit published3
Not applicable75
Critical4
High9
Medium46
Low21
blocked by ARMR today2
not blocked78
Working exploit published1
Proof of concept only58
No public exploit21
202636
No exploit published13
Not applicable23
Critical5
High20
Medium8
Low3
not blocked36
Proof of concept only8
No public exploit28
1999200220052008201120142017202020232026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2025-2831 | Medium | 2025-03-27 | Not applicable | Proof of concept only | A vulnerability has been found in mingyuefusu 明月复苏 tushuguanlixitong 图书管理系统 up to d4836f6b49cd0ac79a4021b15ce99ff7229d4694 and classified as critical. This vulnerability affects the function getBookList of the file /admin/bookList?page=1&limit=10. The manipulation of the argument condition leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2025-2093 | Low | 2025-03-07 | Not applicable | Proof of concept only | A vulnerability was found in PHPGurukul Online Library Management System 3.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /change-password.php. The manipulation of the argument email/phone number leads to weak password recovery. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. |
| CVE-2024-13624 | High | 2025-02-26 | Not applicable | Working exploit published | The WPMovieLibrary WordPress plugin through 2.1.4.8 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. |
| CVE-2025-26200 | High | 2025-02-24 | Not applicable | Proof of concept only | SQL injection in SLIMS v.9.6.1 allows a remote attacker to escalate privileges via the month parameter in the visitor_report_day.php component. |
| CVE-2024-13464 | Medium | 2025-02-18 | Not applicable | No public exploit | The Library Bookshelves plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'bookshelf' shortcode in all versions up to, and including, 5.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2025-1356 | Medium | 2025-02-16 | Not applicable | Proof of concept only | A vulnerability was found in needyamin Library Card System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file card.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2025-1355 | Medium | 2025-02-16 | Not applicable | No public exploit | A vulnerability was found in needyamin Library Card System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /signup.php of the component Add Picture. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. |
| CVE-2025-0935 | Medium | 2025-02-15 | Not applicable | No public exploit | The Media Library Folders plugin for WordPress is vulnerable to unauthorized plugin settings change due to a missing capability check on several AJAX actions in all versions up to, and including, 8.3.0. This makes it possible for authenticated attackers, with Author-level access and above, to change plugin settings related to things such as IP-blocking. |
| CVE-2025-0844 | Medium | 2025-01-30 | Not applicable | Proof of concept only | A vulnerability was found in needyamin Library Card System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file signup.php of the component Registration Page. The manipulation of the argument firstname/lastname/email/borrow/user_address leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. |
| CVE-2025-0843 | Medium | 2025-01-29 | Not applicable | Proof of concept only | A vulnerability was found in needyamin Library Card System 1.0. It has been classified as critical. Affected is an unknown function of the file admindashboard.php of the component Admin Panel. The manipulation of the argument email/password leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2025-0842 | Medium | 2025-01-29 | Not applicable | Proof of concept only | A vulnerability was found in needyamin Library Card System 1.0 and classified as critical. This issue affects some unknown processing of the file admin.php of the component Login. The manipulation of the argument email/password leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2025-22980 | Medium | 2025-01-22 | Not applicable | Proof of concept only | A SQL Injection vulnerability exists in Senayan Library Management System SLiMS 9 Bulian 9.6.1 via the tempLoanID parameter in the loan form on /admin/modules/circulation/loan.php. |
| CVE-2024-13404 | Medium | 2025-01-21 | Not applicable | No public exploit | The Link Library plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'searchll' parameter in all versions up to, and including, 7.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. |
| CVE-2024-57823 | Critical | 2025-01-10 | Not applicable | Proof of concept only | In Raptor RDF Syntax Library through 2.0.16, there is an integer underflow when normalizing a URI with the turtle parser in raptor_uri_normalize_path(). |
| CVE-2024-57822 | Medium | 2025-01-10 | Not applicable | Proof of concept only | In Raptor RDF Syntax Library through 2.0.16, there is a heap-based buffer over-read when parsing triples with the nquads parser in raptor_ntriples_parse_term_internal(). |
| CVE-2024-11974 | Medium | 2025-01-04 | Not applicable | No public exploit | The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘smc_settings_tab', 'unattachfixit-action', and 'woofixit-action’ parameters in all versions up to, and including, 3.23 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. |
| CVE-2024-49513 | High | 2024-12-10 | Not applicable | No public exploit | PDFL SDK versions 21.0.0.5 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. |
| CVE-2024-12188 | Medium | 2024-12-05 | Not applicable | Proof of concept only | A vulnerability was found in 1000 Projects Library Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /brains/stu.php. The manipulation of the argument useri leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2024-12187 | Medium | 2024-12-05 | Not applicable | Proof of concept only | A vulnerability was found in 1000 Projects Library Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /showbook.php. The manipulation of the argument q leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. |
| CVE-2024-52800 | Low | 2024-11-29 | Protected by Waratek | No public exploit | veraPDF is an open source PDF/A validation library. Executing policy checks using custom schematron files via the CLI invokes an XSL transformation that may theoretically lead to a remote code execution (RCE) vulnerability. This doesn't affect the standard validation and policy checks functionality, veraPDF's common use cases. Most veraPDF users don't insert any custom XSLT code into policy profiles, which are based on Schematron syntax rather than direct XSL transforms. For users who do, only load custom policy files from sources you trust. This issue has not yet been patched. Users are advised to be cautious of XSLT code until a patch is available. |
| CVE-2024-10482 | Medium | 2024-11-21 | Not applicable | Proof of concept only | The Media File Rename, Find Unused File, Add Alt text, Caption, Desc For Image SEO WordPress plugin before 1.5.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads. |
| CVE-2024-52554 | High | 2024-11-13 | No exploit published | No public exploit | Jenkins Shared Library Version Override Plugin 17.v786074c9fce7 and earlier declares folder-scoped library overrides as trusted, so that they're not executed in the Script Security sandbox, allowing attackers with Item/Configure permission on a folder to configure a folder-scoped library override that runs without sandbox protection. |
| CVE-2024-51661 | Critical | 2024-11-04 | Not applicable | No public exploit | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Command Injection.This issue affects Media LIbrary Assistant: from n/a through <= 3.19. |
| CVE-2024-50610 | Low | 2024-10-27 | Not applicable | Proof of concept only | GSL (GNU Scientific Library) through 2.8 has an integer signedness error in gsl_siman_solve_many in siman/siman.c. When params.n_tries is negative, incorrect memory allocation occurs. |
| CVE-2024-41445 | Medium | 2024-09-25 | Not applicable | No public exploit | Library MDF (mdflib) v2.1 is vulnerable to a heap-based buffer overread via a crafted mdf4 file is parsed using the ReadData function |
| CVE-2024-34057 | High | 2024-09-18 | Not applicable | No public exploit | Triangle Microworks TMW IEC 61850 Client source code libraries before 12.2.0 lack a buffer size check when processing received messages. The resulting buffer overflow can cause a crash, resulting in a denial of service. |
| CVE-2024-6876 | Medium | 2024-09-10 | Not applicable | No public exploit | Out-of-Bounds read vulnerability in OSCAT Basic Library allows an local, unprivileged attacker to access limited internal data of the PLC which may lead to a crash of the affected service. |
| CVE-2024-7858 | Medium | 2024-08-30 | Not applicable | No public exploit | The Media Library Folders plugin for WordPress is vulnerable to unauthorized access due to missing capability checks on several AJAX functions in the media-library-plus.php file in all versions up to, and including, 8.2.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform several actions related to managing media files and folder along with controlling settings. |
| CVE-2024-8297 | Medium | 2024-08-29 | Not applicable | No public exploit | A vulnerability was found in kitsada8621 Digital Library Management System 1.0. It has been classified as problematic. Affected is the function JwtRefreshAuth of the file middleware/jwt_refresh_token_middleware.go. The manipulation of the argument Authorization leads to improper output neutralization for logs. It is possible to launch the attack remotely. The name of the patch is 81b3336b4c9240f0bf50c13cb8375cf860d945f1. It is recommended to apply a patch to fix this issue. |
| CVE-2024-7857 | Medium | 2024-08-29 | Not applicable | No public exploit | The Media Library Folders plugin for WordPress is vulnerable to second order SQL Injection via the 'sort_type' parameter of the 'mlf_change_sort_type' AJAX action in all versions up to, and including, 8.2.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. |
| CVE-2024-28876 | Medium | 2024-08-14 | Not applicable | No public exploit | Uncontrolled search path for some Intel(R) MPI Library software before version 2021.12 may allow an authenticated user to potentially enable escalation of privilege via local access. |
| CVE-2024-6823 | High | 2024-08-13 | Not applicable | No public exploit | The Media Library Assistant plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation involving the mla-inline-edit-upload-scripts AJAX action in all versions up to, and including, 3.18. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. |
| CVE-2024-38711 | High | 2024-07-20 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Yannick Lefebvre Link Library allows Reflected XSS.This issue affects Link Library: from n/a through 7.7.1. |
| CVE-2024-5604 | Medium | 2024-07-19 | Not applicable | Proof of concept only | The Bug Library WordPress plugin before 2.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) |
| CVE-2024-40402 | Medium | 2024-07-17 | Not applicable | Proof of concept only | A SQL injection vulnerability was found in 'ajax.php' of Sourcecodester Simple Library Management System 1.0. This vulnerability stems from insufficient user input validation of the 'username' parameter, allowing attackers to inject malicious SQL queries. |
| CVE-2024-40394 | Critical | 2024-07-16 | Not applicable | Proof of concept only | Simple Library Management System Project Using PHP/MySQL v1.0 was discovered to contain an arbitrary file upload vulnerability via the component ajax.php. |
| CVE-2024-21128 | Medium | 2024-07-16 | No exploit published | No public exploit | Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: APIs). Supported versions that are affected are 12.2.6-12.2.13. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks require human interaction from a person other than the attacker and while the vulnerability is in Oracle Application Object Library, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Object Library accessible data as well as unauthorized read access to a subset of Oracle Application Object Library accessible data. CVSS 3.1 Base Score 5.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). |
| CVE-2024-5450 | Critical | 2024-07-13 | Not applicable | Working exploit published | The Bug Library WordPress plugin before 2.1.1 does not check the file type on user-submitted bug reports, allowing an unauthenticated user to upload PHP files |
| CVE-2024-5544 | Medium | 2024-07-02 | Not applicable | Exploited | The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the order parameter in all versions up to, and including, 3.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. |
| CVE-2024-5605 | High | 2024-06-20 | Not applicable | No public exploit | The Media Library Assistant plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter within the mla_tag_cloud Shortcode in all versions up to, and including, 3.16 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. |
| CVE-2024-35255 | Medium | 2024-06-11 | No exploit published | No public exploit | Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability |
| CVE-2024-35252 | High | 2024-06-11 | Not applicable | No public exploit | Azure Storage Movement Client Library Denial of Service Vulnerability |
| CVE-2024-35687 | High | 2024-06-08 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Yannick Lefebvre Link Library link-library allows Reflected XSS.This issue affects Link Library: from n/a through 7.6.3. |
| CVE-2024-2914 | High | 2024-06-06 | Not applicable | Proof of concept only | A TarSlip vulnerability exists in the deepjavalibrary/djl, affecting version 0.26.0 and fixed in version 0.27.0. This vulnerability allows an attacker to manipulate file paths within tar archives to overwrite arbitrary files on the target system. Exploitation of this vulnerability could lead to remote code execution, privilege escalation, data theft or manipulation, and denial of service. The vulnerability is due to improper validation of file paths during the extraction of tar files, as demonstrated in multiple occurrences within the library's codebase, including but not limited to the files_util.py and extract_imagenet.py scripts. |
| CVE-2024-3519 | Medium | 2024-05-22 | Not applicable | No public exploit | The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the lang parameter in all versions up to, and including, 3.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. |
| CVE-2024-3518 | High | 2024-05-22 | Not applicable | No public exploit | The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all versions up to, and including, 3.15 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. |
| CVE-2024-4281 | Medium | 2024-05-08 | Not applicable | No public exploit | The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'link-library' shortcode in all versions up to, and including, 7.6.11 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2024-2328 | Medium | 2024-05-02 | Not applicable | No public exploit | The Real Media Library: Media Library Folder & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image title and alt text in all versions up to, and including, 4.22.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author access and higher, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2024-3615 | Medium | 2024-04-19 | Not applicable | No public exploit | The Media Library Folders plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 8.2.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. |
| CVE-2024-3948 | Critical | 2024-04-18 | Not applicable | Proof of concept only | A vulnerability was found in SourceCodester Home Clean Service System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file \admin\student.add.php of the component Photo Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-261440. |
| CVE-2024-3566 | Critical | 2024-04-10 | Not applicable | Proof of concept only | A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied. |
| CVE-2024-31287 | Medium | 2024-04-10 | Not applicable | No public exploit | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Max Foundry Media Library Folders.This issue affects Media Library Folders: from n/a through 8.1.8. |
| CVE-2024-2871 | High | 2024-04-09 | Not applicable | No public exploit | The Media Library Assistant plugin for WordPress is vulnerable to SQL Injection via the plugin's shortcode(s) in all versions up to, and including, 3.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor access or higher, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. |
| CVE-2024-2325 | Medium | 2024-04-09 | Not applicable | No public exploit | The Link Library plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the searchll parameter in all versions up to, and including, 7.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. |
| CVE-2024-2027 | Medium | 2024-04-09 | Not applicable | No public exploit | The Real Media Library: Media Library Folder & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its style attributes in all versions up to, and including, 4.22.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2024-3365 | Medium | 2024-04-06 | Not applicable | Proof of concept only | A vulnerability was found in SourceCodester Online Library System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file admin/users/controller.php. The manipulation of the argument user_name leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259469 was assigned to this vulnerability. |
| CVE-2024-3364 | Medium | 2024-04-06 | Not applicable | Proof of concept only | A vulnerability was found in SourceCodester Online Library System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file admin/books/index.php. The manipulation of the argument id leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259468. |
| CVE-2024-3363 | Critical | 2024-04-06 | Not applicable | Proof of concept only | A vulnerability was found in SourceCodester Online Library System 1.0. It has been classified as critical. This affects an unknown part of the file admin/borrowed/index.php. The manipulation of the argument BookPublisher/BookTitle leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259467. |
| CVE-2024-3362 | High | 2024-04-06 | Not applicable | Proof of concept only | A vulnerability was found in SourceCodester Online Library System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file admin/books/controller.php. The manipulation of the argument IBSN leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-259466 is the identifier assigned to this vulnerability. |
| CVE-2024-3361 | High | 2024-04-06 | Not applicable | No public exploit | A vulnerability has been found in SourceCodester Online Library System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file admin/books/deweydecimal.php. The manipulation of the argument category leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-259465 was assigned to this vulnerability. |
| CVE-2024-3360 | Critical | 2024-04-06 | Not applicable | Proof of concept only | A vulnerability, which was classified as critical, was found in SourceCodester Online Library System 1.0. Affected is an unknown function of the file admin/books/index.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-259464. |
| CVE-2024-3359 | Critical | 2024-04-06 | Not applicable | No public exploit | A vulnerability, which was classified as critical, has been found in SourceCodester Online Library System 1.0. This issue affects some unknown processing of the file admin/login.php. The manipulation of the argument user_email leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259463. |
| CVE-2024-30486 | High | 2024-03-29 | Not applicable | No public exploit | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Max Foundry Media Library Folders.This issue affects Media Library Folders: from n/a through 8.1.7. |
| CVE-2024-2475 | Medium | 2024-03-29 | Not applicable | No public exploit | The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 3.13 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2024-28109 | High | 2024-03-28 | Protected by Waratek | No public exploit | veraPDF-library is a PDF/A validation library. Executing policy checks using custom schematron files invokes an XSL transformation that could lead to a remote code execution (RCE) vulnerability. This vulnerability is fixed in 1.24.2. |
| CVE-2024-29123 | High | 2024-03-19 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yannick Lefebvre Link Library allows Reflected XSS.This issue affects Link Library: from n/a through 7.6. |
| CVE-2023-7110 | Critical | 2024-02-29 | Not applicable | Proof of concept only | A vulnerability, which was classified as critical, has been found in code-projects Library Management System 2.0. This issue affects some unknown processing of the file login.php. The manipulation of the argument student leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249005 was assigned to this vulnerability. |
| CVE-2023-7109 | Critical | 2024-02-29 | Not applicable | Proof of concept only | A vulnerability classified as critical was found in code-projects Library Management System 2.0. This vulnerability affects unknown code of the file /admin/login.php. The manipulation of the argument username leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249004. |
| CVE-2024-1710 | High | 2024-02-26 | Not applicable | No public exploit | The Addon Library plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the onAjaxAction function action in all versions up to, and including, 1.3.76. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform several unauthorized actions including uploading arbitrary files. |
| CVE-2024-1830 | Critical | 2024-02-23 | Not applicable | Proof of concept only | A vulnerability was found in code-projects Library System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file Source/librarian/user/student/lost-password.php. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-254618 is the identifier assigned to this vulnerability. |
| CVE-2024-1829 | Critical | 2024-02-23 | Not applicable | No public exploit | A vulnerability was found in code-projects Library System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file Source/librarian/user/student/registration.php. The manipulation of the argument email/regno/phone/username leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-254617 was assigned to this vulnerability. |
| CVE-2024-1828 | Critical | 2024-02-23 | Not applicable | No public exploit | A vulnerability was found in code-projects Library System 1.0. It has been classified as critical. Affected is an unknown function of the file Source/librarian/user/teacher/registration.php. The manipulation of the argument email/idno/phone/username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-254616. |
| CVE-2024-1827 | Critical | 2024-02-23 | Not applicable | Proof of concept only | A vulnerability was found in code-projects Library System 1.0 and classified as critical. This issue affects some unknown processing of the file Source/librarian/user/teacher/login.php. The manipulation of the argument username/password leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-254615. |
| CVE-2024-1826 | Critical | 2024-02-23 | Not applicable | Proof of concept only | A vulnerability has been found in code-projects Library System 1.0 and classified as critical. This vulnerability affects unknown code of the file Source/librarian/user/student/login.php. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-254614 is the identifier assigned to this vulnerability. |
| CVE-2024-25288 | Medium | 2024-02-21 | Not applicable | Proof of concept only | SLIMS (Senayan Library Management Systems) 9 Bulian v9.6.1 is vulnerable to SQL Injection via pop-scope-vocabolary.php. |
| CVE-2024-1559 | Medium | 2024-02-20 | Not applicable | No public exploit | The Link Library plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'll_reciprocal' parameter in all versions up to, and including, 7.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2024-20929 | Medium | 2024-02-17 | No exploit published | No public exploit | Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized update, insert or delete access to some of Oracle Application Object Library accessible data as well as unauthorized read access to a subset of Oracle Application Object Library accessible data. CVSS 3.1 Base Score 6.5 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). |
| CVE-2024-20915 | Medium | 2024-02-17 | No exploit published | No public exploit | Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Login - SSO). Supported versions that are affected are 12.2.3-12.2.13. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Application Object Library. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of Oracle Application Object Library. CVSS 3.1 Base Score 5.3 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). |
| CVE-2023-41091 | High | 2024-02-14 | Not applicable | No public exploit | Uncontrolled search path for some Intel(R) MPI Library Software before version 2021.11 may allow an authenticated user to potentially enable escalation of privilege via local access. |
| CVE-2023-35121 | High | 2024-02-14 | Not applicable | No public exploit | Improper access control in the Intel(R) oneAPI DPC++/C++ Compiler before version 2022.2.1 for some Intel(R) oneAPI Toolkits before version 2022.3.1 may allow authenticated user to potentially enable escalation of privilege via local access. |
| CVE-2023-29162 | Medium | 2024-02-14 | Not applicable | No public exploit | Improper buffer restrictions the Intel(R) C++ Compiler Classic before version 2021.8 for Intel(R) oneAPI Toolkits before version 2022.3.1 may allow a privileged user to potentially enable escalation of privilege via local access. |
| CVE-2024-24875 | High | 2024-02-12 | Not applicable | No public exploit | Cross-Site Request Forgery (CSRF) vulnerability in Yannick Lefebvre Link Library.This issue affects Link Library: from n/a through 7.5.13. |
| CVE-2024-24879 | High | 2024-02-08 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Yannick Lefebvre Link Library allows Reflected XSS.This issue affects Link Library: from n/a through 7.5.13. |
| CVE-2024-20826 | Medium | 2024-02-06 | Not applicable | No public exploit | Implicit intent hijacking vulnerability in UPHelper library prior to version 4.0.0 allows local attackers to access sensitive information via implicit intent. |
| CVE-2023-6279 | High | 2024-01-29 | Not applicable | Proof of concept only | The Woostify Sites Library WordPress plugin before 1.4.8 does not have authorisation in an AJAX action, allowing any authenticated users, such as subscriber to update arbitrary blog options and set them to 'activated' which could lead to DoS when using a specific option name |
| CVE-2023-7179 | High | 2023-12-30 | Not applicable | No public exploit | A vulnerability, which was classified as critical, was found in Campcodes Online College Library System 1.0. Affected is an unknown function of the file /admin/category_row.php of the component HTTP POST Request Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249366 is the identifier assigned to this vulnerability. |
| CVE-2023-7178 | High | 2023-12-30 | Not applicable | No public exploit | A vulnerability, which was classified as critical, has been found in Campcodes Online College Library System 1.0. This issue affects some unknown processing of the file /admin/book_row.php of the component HTTP POST Request Handler. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249365 was assigned to this vulnerability. |
| CVE-2023-7177 | High | 2023-12-30 | Not applicable | No public exploit | A vulnerability classified as critical was found in Campcodes Online College Library System 1.0. This vulnerability affects unknown code of the file /admin/book_add.php of the component HTTP POST Request Handler. The manipulation of the argument category leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249364. |
| CVE-2023-7176 | High | 2023-12-30 | Not applicable | No public exploit | A vulnerability classified as critical has been found in Campcodes Online College Library System 1.0. This affects an unknown part of the file /admin/return_add.php of the component HTTP POST Request Handler. The manipulation of the argument student leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249363. |
| CVE-2023-7175 | Critical | 2023-12-30 | Not applicable | Proof of concept only | A vulnerability was found in Campcodes Online College Library System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/borrow_add.php of the component HTTP POST Request Handler. The manipulation of the argument student leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249362 is the identifier assigned to this vulnerability. |
| CVE-2023-7156 | Critical | 2023-12-29 | Not applicable | No public exploit | A vulnerability has been found in Campcodes Online College Library System 1.0 and classified as critical. This vulnerability affects unknown code of the file index.php of the component Search. The manipulation of the argument category leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-249178 is the identifier assigned to this vulnerability. |
| CVE-2023-32101 | Medium | 2023-12-29 | Not applicable | No public exploit | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Pexle Chris Library Viewer.This issue affects Library Viewer: from n/a through 2.0.6. |
| CVE-2023-7111 | Critical | 2023-12-26 | Not applicable | Proof of concept only | A vulnerability, which was classified as critical, was found in code-projects Library Management System 2.0. Affected is an unknown function of the file index.php. The manipulation of the argument category leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249006 is the identifier assigned to this vulnerability. |
| CVE-2023-50422 | Critical | 2023-12-12 | No exploit published | No public exploit | SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from 3.0.0 to before 3.3.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application. |
| CVE-2023-6659 | High | 2023-12-11 | Not applicable | No public exploit | A vulnerability, which was classified as critical, has been found in Campcodes Web-Based Student Clearance System 1.0. This issue affects some unknown processing of the file /libsystem/login.php. The manipulation of the argument student leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247367. |
| CVE-2023-48893 | High | 2023-12-01 | Not applicable | No public exploit | SLiMS (aka SENAYAN Library Management System) through 9.6.1 allows admin/modules/reporting/customs/staff_act.php SQL Injection via startDate or untilDate. |
| CVE-2023-48813 | High | 2023-12-01 | Not applicable | No public exploit | Senayan Library Management Systems (Slims) 9 Bulian v9.6.1 is vulnerable to SQL Injection via admin/modules/reporting/customs/fines_report.php. |
| CVE-2023-28741 | High | 2023-11-14 | Not applicable | No public exploit | Buffer overflow in some Intel(R) QAT drivers for Windows - HW Version 1.0 before version 1.10 may allow an authenticated user to potentially enable escalation of privilege via local access. |
| CVE-2023-28740 | High | 2023-11-14 | Not applicable | No public exploit | Uncontrolled search path element in some Intel(R) QAT drivers for Windows - HW Version 2.0 before version 2.0.4 may allow an authenticated user to potentially enable escalation of privilege via local access. |
| CVE-2023-28378 | High | 2023-11-14 | Not applicable | No public exploit | Improper authorization in some Intel(R) QAT drivers for Windows - HW Version 2.0 before version 2.0.4 may allow an authenticated user to potentially enable escalation of privilege via local access. |