CVE Vulnerability Advisory Database

[Affected Scope] Self-managed Grist deployments running versions prior to 1.7.9 with the GRIST_SANDBOX_FLAVOR environment variable configured to pyodide

[Impact] A remote attacker can execute arbitrary system processes on the hosting server by tricking a user into opening a maliciously crafted spreadsheet

[Mitigation] Upgrade Grist to version 1.7.9 or higher, or immediately change the sandbox flavor configuration to gvisor to enforce kernel-level isolation

[Affected Scope] EasyCMS versions up to and including 1.6, specifically affecting the '_order' parameter in '/UserAction.class.php'.

[Impact] Unauthenticated remote attackers can manipulate the '_order' parameter to execute arbitrary SQL commands, leading to complete database compromise, sensitive data exfiltration, or potential remote code execution.

[Mitigation] Since the vendor has not responded with an official patch, immediately deploy Web Application Firewall (WAF) rules and manually implement strict whitelist validation on the affected PHP source code.

[Affected Scope] FeMiner wms up to commit 9cad1f1b179a98b9547fd003c23b07c7594775fa

[Impact] Unauthenticated remote attackers can manipulate the Username parameter to execute arbitrary SQL commands and compromise the database

[Mitigation] Implement parameterized queries in the source code and deploy Web Application Firewall (WAF) rules to block malicious payloads

[Affected Scope] Administrator panel component (/Administrator/PHP/AdminViewSongs.php) in code-projects Online Music Site 1.0

[Impact] Unauthenticated remote attackers can manipulate the ID parameter to execute arbitrary SQL commands, leading to complete database compromise

[Mitigation] Implement parameterized queries (Prepared Statements) immediately and restrict external access to the administrator directory

[Affected Scope] code-projects Online Music Site 1.0, specifically the /FrontEnd/Albums.php endpoint

[Impact] Unauthenticated remote attackers can manipulate the ID parameter to extract sensitive database information or compromise the underlying system

[Mitigation] Implement parameterized queries (Prepared Statements) in the source code and deploy Web Application Firewall (WAF) rules to block malicious SQL patterns

[Affected Scope] code-projects Online Music Site 1.0, specifically the /login.php endpoint

[Impact] Unauthenticated remote attackers can bypass authentication, extract sensitive database records, or potentially execute arbitrary system commands via SQL injection

[Mitigation] Implement parameterized queries (Prepared Statements) in the source code and deploy Web Application Firewall (WAF) rules to block malicious payloads

[Affected Scope] Campcodes Supplier Management System version 1.0, specifically the /retailer/edit_profile.php endpoint.

[Impact] Unauthenticated remote attackers can manipulate the txtRetailerAddress parameter to compromise the database, extract sensitive data, or potentially achieve remote code execution.

[Mitigation] Implement parameterized queries (Prepared Statements), sanitize user inputs, and deploy Web Application Firewall (WAF) rules to block malicious SQL payloads.

[Affected Scope] code-projects Online Product Reservation System 1.0, specifically the /handgunner-administrator/register_code.php component

[Impact] Unauthenticated remote attackers can manipulate user registration parameters to execute arbitrary SQL commands, leading to full database compromise and potential remote code execution

[Mitigation] Implement parameterized queries (Prepared Statements) for all user inputs and restrict access to the registration endpoint using WAF or web server configurations

[Affected Scope] The /pages.php endpoint of code-projects Content Management System (CMS) version 1.0.

[Impact] Unauthenticated remote attackers can manipulate the ID parameter to extract sensitive database information or potentially execute remote code depending on database privileges.

[Mitigation] Implement input validation and parameterized queries (Prepared Statements), and deploy Web Application Firewall (WAF) rules to block malicious SQL payloads.

[Affected Scope] code-projects Content Management System 1.0

[Impact] Unauthenticated remote attackers can manipulate the 'del' parameter to compromise the database, extract sensitive data, or potentially execute remote code

[Mitigation] Restrict external access to the vulnerable admin script and implement parameterized queries (Prepared Statements) in the source code

[Affected Scope] code-projects Content Management System (CMS) version 1.0.

[Impact] Unauthenticated remote attackers can manipulate the 'Value' parameter in search.php to execute arbitrary SQL commands, leading to sensitive data exposure, administrative privilege escalation, or system compromise.

[Mitigation] Implement parameterized queries (Prepared Statements) in the source code and deploy Web Application Firewall (WAF) rules to block malicious SQL injection payloads.

[Affected Scope] itsourcecode School Management System 1.0, specifically the /student/index.php endpoint.

[Impact] Unauthenticated remote attackers can manipulate the ID parameter to execute arbitrary SQL commands, leading to sensitive data exposure or potential Remote Code Execution (RCE) depending on database privileges.

[Mitigation] Implement parameterized queries (Prepared Statements) in the source code and deploy Web Application Firewall (WAF) rules to block malicious SQL payloads.

[Affected Scope] Specific API endpoints of Cisco Identity Services Engine (ISE) and Cisco ISE-PIC

[Impact] An unauthenticated, remote attacker can execute arbitrary code with root privileges on the underlying operating system

[Mitigation] Immediately apply the official security patches provided by Cisco and restrict access to the API ports from untrusted networks

[Affected Scope] Specific API endpoints of Cisco Identity Services Engine (ISE) and Cisco ISE-PIC

[Impact] An unauthenticated, remote attacker can execute arbitrary code with root privileges on the underlying operating system by sending a crafted API request

[Mitigation] Immediately apply the official security patches provided by Cisco and restrict access to the management API ports

[Affected Scope] Older versions of Atlassian Confluence Data Center and Server (8.0.x, 8.1.x, 8.2.x, 8.3.x, 8.4.x, 8.5.0-8.5.3)

[Impact] Unauthenticated remote attackers can execute arbitrary system commands (RCE) on the affected instance by sending specially crafted HTTP requests.

[Mitigation] Immediately upgrade to the latest patched versions (8.5.4+ or newer LTS releases) provided by Atlassian.

[Affected Scope] Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x

[Impact] Remote attackers can inject malicious Spring templates via specific web services, leading to Server-Side Template Injection (SSTI) and arbitrary code execution.

[Mitigation] Immediately upgrade affected Pentaho instances to patched versions (9.4.0.1, 9.3.0.2 or higher) and restrict external access.