A vulnerability classified as problematic was found in Open5GS up to 2.7.3. Affected by this vulnerability is the function ngap_recv_handler/s1ap_recv_handler/recv_handler of the component SCTP Partial Message Handler. The manipulation leads to reachable assertion. The attack needs to be approached locally. The patch is named cfa44575020f3fb045fd971358442053c8684d3d. It is recommended to apply a patch to fix this issue.
SQL injection in PHPGurukul Vehicle Parking Management System 1.13 allows remote attackers with low privileges to execute arbitrary SQL commands via the 'del' parameter in /admin/manage-incomingvehicle.php. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed by CISA KEV. The attack is launched remotely, with an EPSS likelihood of 0.06%, indicating very low exploitation probability despite a critical severity rating.
SQL injection in PHPGurukul Vehicle Parking Management System 1.13 allows low-privileged authenticated remote attackers to inject arbitrary SQL via the 'del' parameter of /admin/manage-outgoingvehicle.php. This can lead to unauthorized data access or manipulation. A publicly available exploit exists, but no active exploitation (CISA KEV) is confirmed.
SQL injection in PHPGurukul Vehicle Parking Management System 1.13 allows remote attackers to manipulate database queries via the 'vid' parameter in the /users/print.php endpoint. The vulnerability is publicly disclosed with exploit code available, though no active exploitation in the wild has been confirmed. It requires low-privilege authentication for exploitation.
SQL injection in PHPGurukul Vehicle Parking Management System version 1.13 allows authenticated low-privileged attackers to manipulate database queries via the 'del' parameter in the admin panel's user management page. Exploit code is publicly available, but no active exploitation has been reported, and the EPSS score (0.06%) indicates a low likelihood of widespread exploitation.
SQL injection in PHPGurukul Vehicle Parking Management System 1.13 permits an authenticated admin-panel user to manipulate the `searchdata` parameter on `/admin/search-vehicle.php`, enabling arbitrary database reads and writes against the underlying MySQL/MariaDB instance. A public proof-of-concept is documented on GitHub; no CISA KEV listing exists. EPSS sits at 0.06% (17th percentile), consistent with the product's niche deployment footprint.
SQL injection in PHPGurukul Vehicle Parking System 1.13 allows authenticated remote attackers to manipulate database queries via the 'viewid' parameter in /admin/view-outgoingvehicle-detail.php. Successful exploitation can result in unauthorized reading or modification of data, though only low-level impacts are expected. Public exploit code exists, but active exploitation is not confirmed.
SQL injection in PHPGurukul Vehicle Parking Management System 1.13 allows authenticated remote users to manipulate database queries by injecting malicious SQL syntax into the `firstname` parameter at `/users/profile.php`. The advisory notes additional parameters in the same file may be vulnerable, broadening the attack surface. A proof-of-concept is publicly available on GitHub, though no active exploitation is confirmed and EPSS sits at a very low 0.06%, reflecting limited real-world uptake.
SQL injection in PHPGurukul Vehicle Parking Management System 1.13 allows an authenticated attacker with low privileges to execute arbitrary SQL commands via the viewid parameter of /users/view--detail.php. A publicly available exploit exists, but no active exploitation has been reported in CISA KEV and EPSS probability is very low (0.06%).
Unrestricted file upload in Code-projects Simple Car Rental System 1.0 allows authenticated administrators to upload malicious files via /admin/add_cars.php, potentially leading to remote code execution. A public proof-of-concept exploit exists, but no active exploitation has been reported. EPSS score of 0.07% indicates low probability of widespread attacks.
A vulnerability classified as problematic has been found in osrg GoBGP up to 3.37.0. Affected is the function SplitRTR of the file pkg/packet/rtr/rtr.go. The manipulation leads to out-of-bounds read. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The name of the patch is e748f43496d74946d14fed85c776452e47b99d64. It is recommended to apply a patch to fix this issue.
Path traversal vulnerability in SpringBoot_MyBatisPlus up to commit a6a8255 allows remote authenticated attackers to read arbitrary files via the Name parameter in the /file/download endpoint. Public exploit code exists, but no active exploitation has been confirmed (not in CISA KEV). EPSS score is low (0.05%), indicating low exploitation likelihood.
Unrestricted file upload in SpringBoot_MyBatisPlus through commit a6a8255 allows authenticated remote attackers to upload arbitrary files via the portraitFile parameter at /file/upload. A public exploit exists, but EPSS indicates low exploitation probability (0.04%) and no active exploitation is confirmed. The impact is rated low by the provided CVSS vector, though typical unrestricted uploads can lead to code execution.