All CVEs — page 455 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
This vulnerability allows unauthenticated users to extract database information through SQL injection by manipulating the ratings parameter in the search functionality.
InvoicePlane contains a path traversal vulnerability in its XML configuration handling that allows low-privileged users to include arbitrary PHP files, potentially leading to remote code execution when combined with file upload capabilities.
InvoicePlane allows authenticated administrators to be tricked into deleting invoices or invoice tax records without their knowledge due to missing CSRF protection on state-changing routes. This creates a risk of unauthorized financial data deletion that can impact accounting and client records.
This vulnerability allows unauthenticated users to execute database upgrades and gain unauthorized access, leading to potential database integrity changes and service disruption.
The flaw allows an authenticated administrator to upload an image with a server-executable extension, leading to arbitrary command execution and other severe impacts.
The flaw allows a malicious PHP file to be executed with web-server privileges, enabling remote code execution.
IBM Guardium Data Protection's Universal Connector Oracle Wallet upload feature allows authenticated attackers to perform path traversal and write arbitrary files to the system, potentially leading to remote code execution or data compromise.