Path traversal in Langchain-Chatchat's backend file upload endpoint allows remote attackers to manipulate file paths via the 'flag' parameter, potentially reading or writing files outside the intended directory. Versions up to 0.3.1 are affected, and a publicly available exploit exists. No active exploitation has been reported through CISA KEV, and EPSS indicates low exploitation probability (0.18%).
Path traversal in Langchain-Chatchat version 0.3.1 and earlier allows authenticated low-privilege users to read arbitrary files from the server via the /v1/files endpoint. Public exploit code exists but exploitation probability is low (EPSS 0.15%), with no active exploitation reported in CISA KEV.
Path traversal in code-projects Simple Forum 1.0 allows authenticated attackers to read arbitrary files via the filename parameter of /forum_downloadfile.php. Exploit code is publicly available, but no active exploitation has been confirmed (not in CISA KEV). CVSS 4.0 base score is 2.1 (Low), reflecting limited impact on confidentiality only.
Unrestricted file upload in code-projects Library System 1.0's /profile.php allows authenticated remote attackers with low privileges to upload arbitrary files, likely resulting in remote code execution. Exploit code is publicly available, but active exploitation is not confirmed (no CISA KEV listing) and EPSS predicts a low exploitation probability (0.11%).
Unrestricted file upload in Simple Forum 1.0 allows remote authenticated attackers to upload arbitrary files via the File parameter in /forum1.php. Public exploit code is available, enabling low-privileged users to potentially place malicious scripts on the server.
SQL injection in Best Salon Management System 1.0 allows remote authenticated attackers to manipulate database queries via the 'Name' parameter of /panel/add-category.php. Publicly available exploit code exists, increasing the risk of opportunistic attacks. No active exploitation has been reported in CISA KEV, but the low-complexity flaw can lead to unauthorized data access or modification.
Limited SQL injection in SourceCodester Best Salon Management System 1.0 allows authenticated remote attackers to manipulate database queries via the editid parameter in /panel/edit-subscription.php. The vulnerability has a publicly available proof-of-concept exploit and may result in low-impact data access or modification, though no active exploitation has been confirmed by CISA KEV.
SQL injection in Best Salon Management System 1.0 via the user_id/plan_id parameters of /panel/add_subscribe.php allows remote attackers with low-privilege credentials to manipulate database queries, potentially leading to unauthorized data access or modification. A publicly available exploit exists, but no active exploitation has been reported in the wild. The CVSS 4.0 base metrics indicate only limited impact on confidentiality, integrity, and availability.
SQL injection in Best Salon Management System 1.0 via the /panel/pro_s
Cross-site request forgery vulnerability in DaiCuo CMS up to version 1.3.13 allows remote attackers to perform unintended actions on behalf of authenticated administrators by tricking them into clicking a malicious link while logged into the application. The exploit is publicly available, and affected installations may be manipulated via the /admin.php/addon/index endpoint. No active exploitation has been confirmed by CISA KEV, and EPSS score indicates low exploitation probability (0.08%).
Cross-site request forgery in SeaCMS admin panel (/admin_type.php) allows remote attackers to trick authenticated administrators into performing unintended actions. All versions up to 13.2 are affected. A public exploit is available, but the vulnerability is not known to be actively exploited; EPSS probability is very low (0.06%).
SQL injection in SourceCodester Best Salon Management System 1.0 allows authenticated remote attackers with low privileges to manipulate the editid parameter in /panel/edit_plan.php, leading to unauthorized database access or modification. Publicly available exploit code exists, but EPSS estimates a low 0.06% likelihood of exploitation, and it is not listed in CISA's Known Exploited Vulnerabilities catalog.
SQL injection in Best Salon Management System 1.0 allows authenticated remote attackers to manipulate database queries via plan_name, description, duration_days, and price parameters in /panel/add_plan.php. An attacker with low-privileged access can extract or modify data through publicly available exploit code, though no active exploitation has been confirmed.
Remote SQL injection in code-projects Simple Forum 1.0 allows authenticated low-privilege attackers to read, modify, or delete database contents via the File parameter in /forum1.php. Exploit code is publicly available but no active exploitation has been reported; EPSS indicates very low exploitation probability.
SQL injection in Simple Forum 1.0 allows remote attackers to manipulate the 'iii' parameter in /forum_edit.php, potentially leading to unauthorized database access. A public proof-of-concept exploit exists, though no active exploitation has been confirmed. The vulnerability affects an open-source PHP forum application.
SQL injection in Best Salon Management System 1.0 allows remote attackers to manipulate database queries via the fromdate/todate parameters in /panel/staff_commision.php. Public exploit code exists, but no active exploitation is confirmed. The CVSS 4.0 base score is 2.1 (Low), though the reporter assigns a critical severity, likely due to different scoring versions.
Path traversal vulnerability in Langchain-Chatchat up to 0.3.1 allows authenticated attackers with low privileges to read, modify, or delete files on the server via the /v1/file endpoint by manipulating the flag argument. Public exploit code is available, increasing risk for attackers on the same network. EPSS score is low (0.20%), suggesting limited active exploitation currently.
Unrestricted file upload in SourceCodester Simple Company Website 1.0 permits authenticated users with high privileges to upload arbitrary files via the 'img' parameter in /classes/Users.php, likely resulting in remote code execution if a malicious PHP script is placed in the webroot. A public exploit is available, but no active exploitation is reported.
Unrestricted file upload in Simple Company Website 1.0 allows authenticated administrators to upload arbitrary files via the settings update endpoint, leading to low-impact compromise. The vulnerability has
Unrestricted file upload in SourceCodester Simple Company Website 1.0 allows remote attackers to upload arbitrary files via the img parameter in /classes/Content.php?f=service, potentially leading to code execution. A publicly available exploit exists, though no active exploitation is confirmed. The CVSS vector indicates high privilege requirements, but the presence of an Authentication Bypass tag suggests this may be circumventable.
An SQL injection in Simple Company Website 1.0's admin testimonials management page allows authenticated administrators to execute arbitrary SQL commands. Remotely exploitable, this can lead to limited compromise of database confidentiality, integrity, and availability. Proof-of-concept code is publicly available, though current exploitation probability is low (EPSS 0.08%, no active
Cross-site scripting in code-projects Simple Forum 1.0 allows a low-privileged remote attacker to inject arbitrary JavaScript via the /forum_edit1.php text parameter. The attack can be carried out by an authenticated user and executes when another user views the manipulated page. Public exploit code is available, but EPSS data indicates very low exploitation probability.
SQL injection in SourceCodester Simple Company Website
Authenticated SQL injection in SourceCodester Simple Company Website 1.0 allows remote administrators to execute arbitrary SQL commands via the ID parameter in the admin/services/manage.php endpoint, potentially leading to data manipulation or information disclosure. Exploit code is publicly available, but EPSS indicates very low exploitation probability and no active exploitation is confirmed.
Authenticated SQL injection in Product Inventory System 1.0 via the ID parameter in /admin/edit_user.php allows high-privilege attackers to execute arbitrary SQL commands. A public proof-of-concept is available, but the very low EPSS score (0.06%) and absence of KEV listing indicate negligible real-world exploitation risk.
SQL injection in Product Inventory System 1.0 allows remote authenticated attackers with administrative privileges to modify database records via the ID parameter in /admin/edit_product.php. Exploit code is publicly available, but no evidence of active exploitation; the EPSS score is very low (0.06%), suggesting limited real-world risk at this time.
Local denial of service in HDF5 1.14.6 via null pointer dereference in the H5C__flush_single_entry function allows low-privileged attackers to crash applications using the library. A public proof-of-concept exists, but exploitation probability is very low (EPSS 0.04%) and no active exploitation has been reported. A vendor patch is available.
Stack-based buffer overflow in HDF5 1.14.6 allows local attackers with low privileges to cause denial of service by triggering a crash in the H5G__node_cmp3 function. A public exploit is available, but exploitation requires local access, limiting widespread impact. The vulnerability is rated low severity (CVSS 1.9) and has a very low EPSS exploitation probability (0.04%), despite a publicly available proof-of-concept.
Local denial of service in HDF5 1.14.6 via use-after-free in the memory garbage collection list manager. A public exploit is available, but EPSS indicates a very low exploitation probability (0.04%).
A security vulnerability in RLPx 5 (CVSS 3.4). Remediation should follow standard vulnerability management procedures.
Backdoor in Conjure Position Department Service Quality Evaluation System allows remote authenticated users with low privileges to execute arbitrary code via a crafted payload to the eval function in a PHP mixin file. A public proof-of-concept exploit exists, but EPSS probability is low (0.08%) and no active exploitation has been confirmed. The CVSS score (2.1) and vector indicate low impact, contradicting the 'critical' classification in the description.