Find the CVE cohort

A vulnerability classified as critical was found in code-projects Job Recruitment 1.0. This vulnerability affects unknown code of the file /_parse/_call_job/search_ajax.php of the component Job Post Handler. The manipulation of the argument n leads to sql injection. The attack can be initiated remotely. The exploit has…

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-02T08:31:05.202Z. Updated 2025-01-06T20:24:46.965Z.

The AHAthat Plugin WordPress plugin through 1.6 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-02T06:00:13.479Z. Updated 2025-01-06T20:26:50.598Z.

The goodlayers-core WordPress plugin before 2.0.10 does not sanitise and escape some of its settings, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-02T06:00:10.840Z. Updated 2025-01-06T20:28:18.246Z.

The wp-enable-svg WordPress plugin through 0.7 does not sanitize SVG files when uploaded, allowing for authors and above to upload SVGs containing malicious scripts

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-02T06:00:04.587Z. Updated 2025-01-06T20:30:08.869Z.

The Net::EasyTCP package before 0.15 for Perl always uses Perl's builtin rand(), which is not a strong random number generator, for cryptographic keys.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-02T00:00:00.000Z. Updated 2025-01-06T21:08:29.156Z.

Cross Site Scripting vulnerability in Audiocodes MP-202b v.4.4.3 allows a remote attacker to escalate privileges via the login page of the web interface.

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-02T00:00:00.000Z. Updated 2026-07-05T16:05:12.778Z.

Huang Yaoshi Pharmaceutical Management Software through 16.0 allows arbitrary file upload via a .asp filename in the fileName element of the UploadFile element in a SOAP request to /XSDService.asmx.

Excerpt language: en.

Severity critical: primary CNA CVSS 10 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-02T00:00:00.000Z. Updated 2025-01-06T20:36:04.563Z.

The Net::EasyTCP package 0.15 through 0.26 for Perl uses Perl's builtin rand() if no strong randomization module is present.

Excerpt language: en.

Severity medium: primary CNA CVSS 5.4 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-02T00:00:00.000Z. Updated 2025-04-08T09:03:27.274Z.

Landray EIS 2001 through 2006 allows Message/fi_message_receiver.aspx?replyid= SQL injection.

Excerpt language: en.

Severity medium: primary CNA CVSS 4.3 v3.1 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-02T00:00:00.000Z. Updated 2025-01-02T18:19:18.434Z.

A vulnerability classified as critical has been found in code-projects Job Recruitment 1.0. This affects an unknown part of the file /_parse/_feedback_system.php. The manipulation of the argument person leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public …

Excerpt language: en. Shortened to 320 code points; full text retained locally.

Severity medium: primary CNA CVSS 5.3 v4.0 (worst CNA-provided scenario) Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-01T13:31:05.466Z. Updated 2025-01-02T17:12:53.970Z.

The does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin

Excerpt language: en.

Unscored under this view's policy Not listed in this KEV snapshot. Forecast present in this snapshot.

Published 2025-01-01T06:00:08.702Z. Updated 2025-01-02T17:11:56.861Z.