Unrestricted file upload in Campcodes Online Recruitment Management System 1.0 allows authenticated attackers to upload arbitrary PHP files via the /admin/ajax.php?action=save_settings endpoint, leading to remote code execution. A public exploit is available, but no active exploitation has been reported (EPSS 0.12%).
SQL injection in PHPGurukul Art Gallery Management System 1.1 allows authenticated attackers to manipulate the awarddetails parameter in /admin/add-artist.php, potentially leading to data breach or system compromise. A public exploit is available, but no active exploitation has been reported.
SQL injection in PHPGurukul Art Gallery Management System 1.1 allows authenticated attackers to execute arbitrary SQL commands via the editid parameter in /admin/changeimage4.php. Public exploit code exists, increasing risk for instances with admin panel exposure.
SQL injection in PHPGurukul Art Gallery Management System 1.1 allows remote authenticated attackers to execute arbitrary SQL commands via the editid parameter in /admin/changeimage3.php. Public exploit code is available, but no active exploitation has been confirmed. EPSS score is low (0.08%), indicating limited exploitation likelihood.
SQL injection in PHPGurukul Art Gallery Management System 1.1 allows remote authenticated attackers to execute arbitrary SQL commands via the editid parameter in /admin/changeimage2.php. A public exploit is available, but no active exploitation has been reported (EPSS 0.08%).
SQL injection in PHPGurukul Art Gallery Management System 1.1 allows authenticated attackers to manipulate database queries via the editid parameter in /admin/changeimage1.php. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.08%), indicating limited exploitation likelihood.
SQL injection in PHPGurukul Art Gallery Management System 1.1 allows authenticated attackers to execute arbitrary SQL commands via the editid parameter in /admin/changeimage.php. A public exploit is available, but no active exploitation has been reported. The EPSS score is low (0.08%), indicating limited exploitation likelihood.
SQL injection in PHPGurukul Art Gallery Management System 1.1 allows remote authenticated attackers to manipulate the imageid parameter in /admin/changepropic.php, potentially leading to unauthorized data access or modification. A public exploit is available, but no active exploitation has been reported.
SQL injection in PHPGurukul Art Gallery Management System 1.1 allows authenticated attackers to execute arbitrary SQL commands via the 'editid' parameter in /admin/edit-art-medium-detail.php. Public exploit code is available, increasing the risk of targeted attacks.
Denial of service in TOTOLINK N300RH firmware 6.1c.1390_B20191101 via the /boafrm/formFilter endpoint allows an authenticated attacker on the local network to crash the device by manipulating the 'url' argument. A public exploit is available, but no active exploitation has been reported (not in CISA KEV). EPSS score is low (0.14%), indicating low exploitation likelihood.
Null pointer dereference in POCO C++ Libraries up to 1.14.1 allows local attackers to cause a denial of service via crafted multipart input. Public exploit code exists, but no active exploitation has been confirmed. EPSS score is low (0.05%), indicating limited exploitation likelihood.
PEAK-System Driver PCANFD_ADD_FILTERS Time-Of-Check Time-Of-Use Information Disclosure Vulnerability. This vulnerability allows local attackers to disclose sensitive information on affected installations of PEAK-System Driver. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of the PCANFD_ADD_FILTERS IOCTL. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the kernel. Was ZDI-CAN-24161.
A remote code execution vulnerability (CVSS 2.2). Remediation should follow standard vulnerability management procedures.