CVE Brief Security Intelligence

Information Disclosure in web-accessible backup file in SourceCodester Simple Online Book Store System allows a remote unauthenticated attacker to disclose full database contents (including schema and credential hashes) via an unauthenticated HTTP GET request to /obs/database/obs_db

The Brightpick Mission Control web application exposes hardcoded credentials in its client-side JavaScript bundle

The SNORDIAN's H5PxAPIkatchu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'insert_data' AJAX endpoint in all versions up to, and including, 0

Use after free in Internals in Google Chrome on iOS prior to 127

Nero BackItUp in the Nero Productline is vulnerable to a path parsing/UI rendering flaw (CWE-22) that, in combination with Windows ShellExecuteW fallback extension resolution, leads to arbitrary code execution when a user clicks a crafted entry

Inappropriate implementation in DevTools in Google Chrome prior to 126

The Creta Testimonial Showcase WordPress plugin before 1

General Industrial Controls Lynx+ Gateway is vulnerable to a weak password requirement vulnerability, which may allow an attacker to execute a brute-force attack resulting in unauthorized access and login

IQ-Support developed by IQ Service International has an Arbitrary File Read vulnerability, allowing unauthenticated remote attackers to exploit Relative Path Traversal to download arbitrary system files

General Industrial Controls Lynx+ Gateway is missing critical authentication in the embedded web server which could allow an attacker to send GET requests to obtain sensitive device information

General Industrial Controls Lynx+ Gateway is vulnerable to a cleartext transmission vulnerability that could allow an attacker to observe network traffic to obtain sensitive information, including plaintext credentials

Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-Immutable Data vulnerability in Optimus Software Brokerage Automation allows Exploiting Trust in Client, Authentication Bypass, Manipulate Registry Information

A vulnerability has been found in D-Link DIR-816L 2_06_b09_beta

A vulnerability was found in D-Link DIR-816L 2_06_b09_beta

A vulnerability was determined in D-Link DIR-816L 2_06_b09_beta

Brightpick Mission Control discloses device telemetry, configuration, and credential information via WebSocket traffic to unauthenticated users when they connect to a specific URL

The vulnerability, if exploited, could allow a miscreant with read access to Edge Project files or Edge Offline Cache files to reverse engineer Edge users' app-native or Active Directory passwords through computational brute-forcing of weak hashes

A Reflected Cross Site Scripting (XSS) vulnerability was found in the Application Server of Desktop Alert PingAlert version 6

An issue was found in the Application Server of Desktop Alert PingAlert version 6

A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses

A security vulnerability has been detected in code-projects Simple Online Hotel Reservation System 1

A vulnerability was detected in code-projects Simple Online Hotel Reservation System 1

npm package `expr-eval` is vulnerable to Prototype Pollution

A vulnerability was identified in code-projects Simple Cafe Ordering System 1

A weakness has been identified in code-projects Simple Cafe Ordering System 1

Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in NCP-HG100 1