Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2023-1290
A vulnerability, which was classified as critical, has been found in SourceCodester Sales Tracker Management System 1.0. Affected by this issue is some unknown functionality of the file admin/clients/view_client.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222644.
Affected Products: Sales Tracker Management System
References: [{'url': 'https://vuldb.com/?id.222644', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222644', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/Mart1nD0t/vul-test/blob/main/sts-1.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1291
A vulnerability, which was classified as critical, was found in SourceCodester Sales Tracker Management System 1.0. This affects an unknown part of the file admin/clients/manage_client.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222645 was assigned to this vulnerability.
Affected Products: Sales Tracker Management System
References: [{'url': 'https://vuldb.com/?id.222645', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222645', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/Mart1nD0t/vul-test/blob/main/sts-2.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1292
A vulnerability has been found in SourceCodester Sales Tracker Management System 1.0 and classified as critical. This vulnerability affects the function delete_client of the file classes/Master.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-222646 is the identifier assigned to this vulnerability.
Affected Products: Sales Tracker Management System
References: [{'url': 'https://vuldb.com/?id.222646', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222646', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/Mart1nD0t/vul-test/blob/main/sts-3.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1293
A vulnerability was found in SourceCodester Online Graduate Tracer System 1.0 and classified as critical. This issue affects the function mysqli_query of the file admin_cs.php. The manipulation leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222647.
Affected Products: Online Graduate Tracer System
References: [{'url': 'https://vuldb.com/?id.222647', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222647', 'tags': ['signature', 'permissions-required']}, {'url': 'https://blog.csdn.net/weixin_43864034/article/details/129418770', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1294
A vulnerability was found in SourceCodester File Tracker Manager System 1.0. It has been classified as critical. Affected is an unknown function of the file /file_manager/login.php of the component POST Parameter Handler. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222648.
Affected Products: File Tracker Manager System
References: [{'url': 'https://vuldb.com/?id.222648', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222648', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/godownio/bug_report/blob/main/vendors/hemedy99/File%20Tracker%20Manager%20System/SQLi-1.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1295
A time-of-check to time-of-use issue exists in io_uring subsystem's IORING_OP_CLOSE operation in the Linux kernel's versions 5.6 - 5.11 (inclusive), which allows a local user to elevate their privileges to root. Introduced in b5dba59e0cf7e2cc4d3b3b1ac5fe81ddf21959eb, patched in 9eac1904d3364254d622bf2c771c4f85cd435fc2, backported to stable in 788d0824269bef539fe31a785b1517882eafed93.
Affected Products: Linux Kernel
References: [{'tags': ['patch'], 'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9eac1904d3364254d622bf2c771c4f85cd435fc2'}, {'tags': ['patch'], 'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=788d0824269bef539fe31a785b1517882eafed93'}, {'url': 'https://kernel.dance/9eac1904d3364254d622bf2c771c4f85cd435fc2'}, {'url': 'https://kernel.dance/788d0824269bef539fe31a785b1517882eafed93'}, {'tags': ['related'], 'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b5dba59e0cf7e2cc4d3b3b1ac5fe81ddf21959eb'}, {'url': 'https://security.netapp.com/advisory/ntap-20230731-0006/'}]
CVE State: PUBLISHED
Explain CVE-2023-1296
HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.5.0 did not correctly enforce deny policies applied to a workload’s variables. Fixed in 1.4.6 and 1.5.1.
Affected Products: Nomad
References: [{'url': 'https://discuss.hashicorp.com/t/hcsec-2023-09-nomad-acls-can-not-deny-access-to-workloads-own-variables/51390'}]
CVE State: PUBLISHED
Explain CVE-2023-1297
Consul and Consul Enterprise's cluster peering implementation contained a flaw whereby a peer cluster with service of the same name as a local service could corrupt Consul state, resulting in denial of service. This vulnerability was resolved in Consul 1.14.5, and 1.15.3
Affected Products: Consul
References: [{'url': 'https://discuss.hashicorp.com/t/hcsec-2023-15-consul-cluster-peering-can-result-in-denial-of-service/54515'}]
CVE State: PUBLISHED
Explain CVE-2023-1298
ServiceNow has released upgrades and patches that address a Reflected Cross-Site scripting (XSS) vulnerability that was identified in the ServiceNow Polaris Layout. This vulnerability would enable an authenticated user to inject arbitrary scripts.

Affected Products: Now User Experience
References: [{'tags': ['vendor-advisory'], 'url': 'https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1310230'}, {'url': 'https://www.linkedin.com/in/osamay/'}]
CVE State: PUBLISHED
Explain CVE-2023-1299
HashiCorp Nomad and Nomad Enterprise 1.5.0 allow a job submitter to escalate to management-level privileges using workload identity and task API. Fixed in 1.5.1.
Affected Products: Nomad
References: [{'url': 'https://discuss.hashicorp.com/t/hcsec-2023-08-nomad-job-submitter-privilege-escalation-using-workload-identity/51389'}]
CVE State: PUBLISHED
Explain CVE-2023-1300
A vulnerability classified as critical was found in SourceCodester COVID 19 Testing Management System 1.0. Affected by this vulnerability is an unknown functionality of the file patient-report.php of the component POST Parameter Handler. The manipulation of the argument searchdata leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222661 was assigned to this vulnerability.
Affected Products: COVID 19 Testing Management System
References: [{'url': 'https://vuldb.com/?id.222661', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222661', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/mhz2846415362/bug_report/blob/main/vendors/unyasoft/COVID%2019%20Testing%20Management%20System/SQLi-1.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1301
A vulnerability, which was classified as critical, has been found in SourceCodester Friendly Island Pizza Website and Ordering System 1.0. Affected by this issue is some unknown functionality of the file deleteorder.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-222662 is the identifier assigned to this vulnerability.
Affected Products: Friendly Island Pizza Website and Ordering System
References: [{'url': 'https://vuldb.com/?id.222662', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222662', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/a-xsg/bug_report/blob/main/vendors/Skynidnine/Friendly%20Island%20Pizza%20Website%20and%20Ordering%20System/SQLi-1.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1302
A vulnerability, which was classified as problematic, was found in SourceCodester File Tracker Manager System 1.0. This affects an unknown part of the file normal/borrow1.php. The manipulation of the argument id with the input 1"><script>alert(1111)</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222663.
Affected Products: File Tracker Manager System
References: [{'url': 'https://vuldb.com/?id.222663', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222663', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/godownio/bug_report/blob/main/vendors/hemedy99/File%20Tracker%20Manager%20System/XSS-1.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1303
A vulnerability was found in UCMS 1.6 and classified as critical. This issue affects some unknown processing of the file sadmin/fileedit.php of the component System File Management Module. The manipulation of the argument file leads to unrestricted upload. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-222683.
Affected Products: UCMS
References: [{'url': 'https://vuldb.com/?id.222683', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222683', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/yztale/taley/blob/main/README.md', 'tags': ['related']}]
CVE State: PUBLISHED
Explain CVE-2023-1304
An authenticated attacker can leverage an exposed getattr() method via a Jinja template to smuggle OS commands and perform other actions that are normally expected to be private methods. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the Self-Managed version of InsightCloudSec.


Affected Products: InsightCloudSec
References: [{'tags': ['release-notes'], 'url': 'https://docs.divvycloud.com/changelog/23321-release-notes'}, {'tags': ['third-party-advisory'], 'url': 'https://nephosec.com/exploiting-rapid7s-insightcloudsec/'}]
CVE State: PUBLISHED
Explain CVE-2023-1305
An authenticated attacker can leverage an exposed “box” object to read and write arbitrary files from disk, provided those files can be parsed as yaml or JSON. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the Self-Managed version of InsightCloudSec.


Affected Products: InsightCloudSec
References: [{'tags': ['release-notes'], 'url': 'https://docs.divvycloud.com/changelog/23321-release-notes'}, {'tags': ['third-party-advisory'], 'url': 'https://nephosec.com/exploiting-rapid7s-insightcloudsec/'}]
CVE State: PUBLISHED
Explain CVE-2023-1306
An authenticated attacker can leverage an exposed resource.db() accessor method to smuggle Python method calls via a Jinja template, which can lead to code execution. This issue was resolved in the Managed and SaaS deployments on February 1, 2023, and in version 23.2.1 of the Self-Managed version of InsightCloudSec.

Affected Products: InsightCloudSec
References: [{'tags': ['release-notes'], 'url': 'https://docs.divvycloud.com/changelog/23321-release-notes'}, {'tags': ['third-party-advisory'], 'url': 'https://nephosec.com/exploiting-rapid7s-insightcloudsec/'}]
CVE State: PUBLISHED
Explain CVE-2023-1307
Authentication Bypass by Primary Weakness in GitHub repository froxlor/froxlor prior to 2.0.13.
Affected Products: froxlor/froxlor
References: [{'url': 'https://huntr.dev/bounties/5fe85af4-a667-41a9-a00d-f99e07c5e2f1'}, {'url': 'https://github.com/froxlor/froxlor/commit/6777fbf229200f4fd566022e186548391219ab23'}]
CVE State: PUBLISHED
Explain CVE-2023-1308
A vulnerability classified as critical has been found in SourceCodester Online Graduate Tracer System 1.0. Affected is an unknown function of the file admin/adminlog.php. The manipulation of the argument user leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222696.
Affected Products: Online Graduate Tracer System
References: [{'url': 'https://vuldb.com/?id.222696', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222696', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/gtest1112/111/blob/main/sqli-1.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1309
A vulnerability classified as critical was found in SourceCodester Online Graduate Tracer System 1.0. Affected by this vulnerability is an unknown functionality of the file admin/search_it.php. The manipulation of the argument input leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222697 was assigned to this vulnerability.
Affected Products: Online Graduate Tracer System
References: [{'url': 'https://vuldb.com/?id.222697', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222697', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/gtest1112/111/blob/main/sqli-2.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1310
A vulnerability, which was classified as critical, has been found in SourceCodester Online Graduate Tracer System 1.0. Affected by this issue is some unknown functionality of the file admin/prof.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-222698 is the identifier assigned to this vulnerability.
Affected Products: Online Graduate Tracer System
References: [{'url': 'https://vuldb.com/?id.222698', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222698', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/gtest1112/111/blob/main/sqli-3.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1311
A vulnerability, which was classified as critical, was found in SourceCodester Friendly Island Pizza Website and Ordering System 1.0. This affects an unknown part of the file large.php of the component GET Parameter Handler. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222699.
Affected Products: Friendly Island Pizza Website and Ordering System
References: [{'url': 'https://vuldb.com/?id.222699', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222699', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/tangtangtang123456/bug_report/blob/main/vendors/Skynidnine/Friendly%20Island%20Pizza%20Website%20and%20Ordering%20System/SQLi-1.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1312
Cross-site Scripting (XSS) - Reflected in GitHub repository pimcore/pimcore prior to 10.5.19.
Affected Products: pimcore/pimcore
References: [{'url': 'https://huntr.dev/bounties/2a64a32d-b1cc-4def-91da-18040d59f356'}, {'url': 'https://github.com/pimcore/pimcore/commit/d35d0712858f24d0ec96ddfd4cbe82ff4b5a5fbb'}]
CVE State: PUBLISHED
Explain CVE-2023-1313
Unrestricted Upload of File with Dangerous Type in GitHub repository cockpit-hq/cockpit prior to 2.4.1.
Affected Products: cockpit-hq/cockpit
References: [{'url': 'https://huntr.dev/bounties/f73eef49-004f-4b3b-9717-90525e65ba61'}, {'url': 'https://github.com/cockpit-hq/cockpit/commit/becca806c7071ecc732521bb5ad0bb9c64299592'}]
CVE State: PUBLISHED
Explain CVE-2023-1314
A vulnerability has been discovered in cloudflared's installer (<= 2023.3.0) for Windows 32-bits devices that allows a local attacker with no administrative permissions to escalate their privileges on the affected device. This vulnerability exists because the MSI installer used by cloudflared relied on a world-writable directory.

An attacker with local access to the device (without Administrator rights) can use symbolic links to trick the MSI installer into deleting files in locations that the attacker would otherwise have no access to. By creating a symlink from the world-writable directory to the target file, the attacker can manipulate the MSI installer's repair functionality to delete the target file during the repair process.

Exploitation of this vulnerability could allow an attacker to delete important system files or replace them with malicious files, potentially leading to the affected device being compromised.

The cloudflared client itself is not affected by this vulnerability, only the installer for 32-bit Windows devices.


Affected Products: cloudflared
References: [{'url': 'https://github.com/cloudflare/cloudflared/security/advisories/GHSA-7mjv-x3jf-545x'}, {'url': 'https://github.com/cloudflare/cloudflared/releases'}]
CVE State: PUBLISHED
Explain CVE-2023-1315
Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to v1.16.6.
Affected Products: osticket/osticket
References: [{'url': 'https://huntr.dev/bounties/70a7fd8c-7e6f-4a43-9f8c-163b8967b16e'}, {'url': 'https://github.com/osticket/osticket/commit/ec6043935b4e30b5c0dfa544e256717182808a2e'}]
CVE State: PUBLISHED
Explain CVE-2023-1316
Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6.
Affected Products: osticket/osticket
References: [{'url': 'https://huntr.dev/bounties/c6353bab-c382-47f6-937b-56d253f2e8d3'}, {'url': 'https://github.com/osticket/osticket/commit/091ddba965132d26bdbeb004fcc44bd8fd056b71'}]
CVE State: PUBLISHED
Explain CVE-2023-1317
Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to v1.16.6.
Affected Products: osticket/osticket
References: [{'url': 'https://huntr.dev/bounties/c3e27af2-358b-490b-9baf-e451663e4e5f'}, {'url': 'https://github.com/osticket/osticket/commit/daee20fdd8ac926d9aee700b201ac2cb35d448ca'}]
CVE State: PUBLISHED
Explain CVE-2023-1318
Cross-site Scripting (XSS) - Generic in GitHub repository osticket/osticket prior to v1.16.6.
Affected Products: osticket/osticket
References: [{'url': 'https://huntr.dev/bounties/e58b38e0-4897-4bb0-84e8-a7ad8efab338'}, {'url': 'https://github.com/osticket/osticket/commit/343a2b47e164dd9090a3c9477ef273f0efa16a7d'}]
CVE State: PUBLISHED
Explain CVE-2023-1319
Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6.
Affected Products: osticket/osticket
References: [{'url': 'https://huntr.dev/bounties/a822067a-d90d-4c3e-b9ef-9b2a5c2bc97f'}, {'url': 'https://github.com/osticket/osticket/commit/9fb01bc12fbae06aa2c2b4d1bc9b4a08db4bb3e0'}]
CVE State: PUBLISHED
Explain CVE-2023-1320
Cross-site Scripting (XSS) - Stored in GitHub repository osticket/osticket prior to v1.16.6.
Affected Products: osticket/osticket
References: [{'url': 'https://huntr.dev/bounties/c2bb34ac-452d-4624-a1b9-c5b54f52f0cd'}, {'url': 'https://github.com/osticket/osticket/commit/86f9693dc64ed54220ed6c10e13e824ca4f6aacf'}]
CVE State: PUBLISHED
Explain CVE-2023-1321
A vulnerability has been found in lmxcms 1.41 and classified as critical. Affected by this vulnerability is the function update of the file AcquisiAction.class.php. The manipulation of the argument id with the input -1 and updatexml(0,concat(0x7e,user()),1)# leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222727.
Affected Products: lmxcms
References: [{'url': 'https://vuldb.com/?id.222727', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222727', 'tags': ['signature', 'permissions-required']}]
CVE State: PUBLISHED
Explain CVE-2023-1322
A vulnerability was found in lmxcms 1.41 and classified as critical. Affected by this issue is the function reply of the file BookAction.class.php. The manipulation of the argument id with the input 1) and updatexml(0,concat(0x7e,user()),1)# leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222728.
Affected Products: lmxcms
References: [{'url': 'https://vuldb.com/?id.222728', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222728', 'tags': ['signature', 'permissions-required']}]
CVE State: PUBLISHED
Explain CVE-2023-1323
The Easy Forms for Mailchimp WordPress plugin before 6.8.9 does not sanitise and escape some of its from parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Affected Products: Easy Forms for Mailchimp
References: [{'url': 'https://wpscan.com/vulnerability/d3a2af00-719c-4b86-8877-b1d68a589192', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-1324
The Easy Forms for Mailchimp WordPress plugin before 6.8.8 does not sanitise and escape some parameters before outputting them back in the response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Affected Products: Easy Forms for Mailchimp
References: [{'url': 'https://wpscan.com/vulnerability/8f510b8c-b97a-44c9-a36d-2d775a4f7b81', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-1325
The Easy Forms for Mailchimp WordPress plugin before 6.8.7 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Affected Products: Easy Forms for Mailchimp
References: [{'url': 'https://wpscan.com/vulnerability/5f37cbf3-2388-4582-876c-6a7b0943c2a7', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-1326
A privilege escalation attack was found in apport-cli 2.26.0 and earlier which is similar to CVE-2023-26604. If a system is specially configured to allow unprivileged users to run sudo apport-cli, less is configured as the pager, and the terminal size can be set: a local attacker can escalate privilege. It is extremely unlikely that a system administrator would configure sudo to allow unprivileged users to perform this class of exploit.
Affected Products: Apport
References: [{'tags': ['patch'], 'url': 'https://github.com/canonical/apport/commit/e5f78cc89f1f5888b6a56b785dddcb0364c48ecb'}, {'url': 'https://ubuntu.com/security/notices/USN-6018-1', 'tags': ['vendor-advisory']}]
CVE State: PUBLISHED
Explain CVE-2023-1327
Netgear RAX30 (AX2400), prior to version 1.0.6.74, was affected by an authentication bypass vulnerability, allowing an unauthenticated attacker to gain administrative access to the device's web management interface by resetting the admin password.
Affected Products: Netgear RAX30 (AX2400)
References: [{'url': 'https://drupal9.tenable.com/security/research/tra-2023-10'}]
CVE State: PUBLISHED
Explain CVE-2023-1328
A vulnerability was found in Guizhou 115cms 4.2. It has been classified as problematic. Affected is an unknown function of the file /admin/content/index. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-222738 is the identifier assigned to this vulnerability.
Affected Products: 115cms
References: [{'url': 'https://vuldb.com/?id.222738', 'tags': ['vdb-entry']}, {'url': 'https://vuldb.com/?ctiid.222738', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/niukongkong/asdasd/blob/master/115cmsArbitrary%20file%20upload%20vulnerability.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1329
A potential security vulnerability has been identified for certain HP multifunction printers (MFPs). The vulnerability may lead to Buffer Overflow and/or Remote Code Execution when running HP Workpath solutions on potentially affected products.
Affected Products: HP multifunction printers
References: [{'url': 'https://support.hp.com/us-en/document/ish_8585737-8585769-16/hpsbpi03849'}]
CVE State: PUBLISHED
Explain CVE-2023-1330
The Redirection WordPress plugin before 1.1.4 does not add nonce verification in place when adding the redirect, which could allow attackers to add redirects via a CSRF attack.
Affected Products: Redirection
References: [{'url': 'https://wpscan.com/vulnerability/de4cff6d-0030-40e6-8221-fef56e12b4de', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-1331
The Redirection WordPress plugin before 1.1.5 does not have CSRF checks in the uninstall action, which could allow attackers to make logged in admins delete all the redirections through a CSRF attack.
Affected Products: Redirection
References: [{'url': 'https://wpscan.com/vulnerability/f81d9340-cf7e-46c4-b669-e61f2559cb8c', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-1333
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the clear_page_cache function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to delete the plugin's cache.
Affected Products: RapidLoad Power-Up for Autoptimize
References: [{'url': 'https://www.wordfence.com/threat-intel/vulnerabilities/id/2cba74f7-7183-4297-8f04-4818c01358ef'}, {'url': 'https://plugins.trac.wordpress.org/changeset/2877726/unusedcss/trunk/includes/modules/unused-css/UnusedCSS_Admin.php?contextall=1&old=2847136&old_path=%2Funusedcss%2Ftrunk%2Fincludes%2Fmodules%2Funused-css%2FUnusedCSS_Admin.php'}]
CVE State: PUBLISHED
Explain CVE-2023-1334
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized cache modification due to a missing capability check on the queue_posts function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to modify the plugin's cache.
Affected Products: RapidLoad Power-Up for Autoptimize
References: [{'url': 'https://www.wordfence.com/threat-intel/vulnerabilities/id/f3108ef4-f889-4ae1-b86f-cedf46dcea19'}, {'url': 'https://plugins.trac.wordpress.org/changeset/2877726/unusedcss/trunk/includes/modules/unused-css/UnusedCSS_Admin.php?contextall=1&old=2847136&old_path=%2Funusedcss%2Ftrunk%2Fincludes%2Fmodules%2Funused-css%2FUnusedCSS_Admin.php'}]
CVE State: PUBLISHED
Explain CVE-2023-1335
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the ucss_connect function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to connect a new license key to the site.
Affected Products: RapidLoad Power-Up for Autoptimize
References: [{'url': 'https://www.wordfence.com/threat-intel/vulnerabilities/id/eba48c51-87d9-4e7e-b4c1-0205cd96d033'}, {'url': 'https://plugins.trac.wordpress.org/changeset/2877726/unusedcss/trunk/includes/modules/unused-css/UnusedCSS_Admin.php?contextall=1&old=2847136&old_path=%2Funusedcss%2Ftrunk%2Fincludes%2Fmodules%2Funused-css%2FUnusedCSS_Admin.php'}]
CVE State: PUBLISHED
Explain CVE-2023-1336
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check on the ajax_deactivate function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to disable caching.
Affected Products: RapidLoad Power-Up for Autoptimize
References: [{'url': 'https://www.wordfence.com/threat-intel/vulnerabilities/id/b2296800-93d6-48fa-aa09-3d28fa6371d7'}, {'url': 'https://plugins.trac.wordpress.org/changeset/2877726/unusedcss/trunk/includes/modules/unused-css/UnusedCSS_Admin.php?contextall=1&old=2847136&old_path=%2Funusedcss%2Ftrunk%2Fincludes%2Fmodules%2Funused-css%2FUnusedCSS_Admin.php'}]
CVE State: PUBLISHED
Explain CVE-2023-1337
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the clear_uucss_logs function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to delete plugin log files.
Affected Products: RapidLoad Power-Up for Autoptimize
References: [{'url': 'https://www.wordfence.com/threat-intel/vulnerabilities/id/a52325f9-51b5-469c-865e-73a22002d46f'}, {'url': 'https://plugins.trac.wordpress.org/changeset/2877726/unusedcss/trunk/includes/modules/unused-css/UnusedCSS_Admin.php?contextall=1&old=2847136&old_path=%2Funusedcss%2Ftrunk%2Fincludes%2Fmodules%2Funused-css%2FUnusedCSS_Admin.php'}]
CVE State: PUBLISHED
Explain CVE-2023-1338
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized cache modification due to a missing capability check on the attach_rule function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to modify cache rules.
Affected Products: RapidLoad Power-Up for Autoptimize
References: [{'url': 'https://www.wordfence.com/threat-intel/vulnerabilities/id/1bb55b22-a0d0-424f-8e4f-57d3f239c149'}, {'url': 'https://plugins.trac.wordpress.org/changeset/2877726/unusedcss/trunk/includes/modules/unused-css/UnusedCSS_Admin.php?contextall=1&old=2847136&old_path=%2Funusedcss%2Ftrunk%2Fincludes%2Fmodules%2Funused-css%2FUnusedCSS_Admin.php'}]
CVE State: PUBLISHED
Explain CVE-2023-1339
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check on the uucss_update_rule function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to update caching rules.
Affected Products: RapidLoad Power-Up for Autoptimize
References: [{'url': 'https://www.wordfence.com/threat-intel/vulnerabilities/id/19f126f8-1d59-44b5-8e0e-c37f1fbedf5a'}, {'url': 'https://plugins.trac.wordpress.org/changeset/2877726/unusedcss/trunk/includes/modules/unused-css/UnusedCSS_Admin.php?contextall=1&old=2847136&old_path=%2Funusedcss%2Ftrunk%2Fincludes%2Fmodules%2Funused-css%2FUnusedCSS_Admin.php'}]
CVE State: PUBLISHED
Explain CVE-2023-1340
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the clear_uucss_logs function. This makes it possible for unauthenticated attackers to clear plugin logs via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Products: RapidLoad Power-Up for Autoptimize
References: [{'url': 'https://www.wordfence.com/threat-intel/vulnerabilities/id/488e26e2-d4d7-4036-a672-53c2d4c9d39b'}, {'url': 'https://plugins.trac.wordpress.org/changeset/2877726/unusedcss/trunk/includes/modules/unused-css/UnusedCSS_Admin.php?contextall=1&old=2847136&old_path=%2Funusedcss%2Ftrunk%2Fincludes%2Fmodules%2Funused-css%2FUnusedCSS_Admin.php'}]
CVE State: PUBLISHED
Explain CVE-2023-1341
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the ajax_deactivate function. This makes it possible for unauthenticated attackers to turn off caching via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Products: RapidLoad Power-Up for Autoptimize
References: [{'url': 'https://www.wordfence.com/threat-intel/vulnerabilities/id/d95b01c3-5db4-40ac-8787-0db58a9cc3a6'}, {'url': 'https://plugins.trac.wordpress.org/changeset/2877726/unusedcss/trunk/includes/modules/unused-css/UnusedCSS_Admin.php?contextall=1&old=2847136&old_path=%2Funusedcss%2Ftrunk%2Fincludes%2Fmodules%2Funused-css%2FUnusedCSS_Admin.php'}]
CVE State: PUBLISHED
Explain CVE-2023-1342
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the ucss_connect function. This makes it possible for unauthenticated attackers to connect the site to a new license key via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Products: RapidLoad Power-Up for Autoptimize
References: [{'url': 'https://www.wordfence.com/threat-intel/vulnerabilities/id/7c66894a-8d0f-4946-ae4d-bffd35f3ffb7'}, {'url': 'https://plugins.trac.wordpress.org/changeset/2877726/unusedcss/trunk/includes/modules/unused-css/UnusedCSS_Admin.php?contextall=1&old=2847136&old_path=%2Funusedcss%2Ftrunk%2Fincludes%2Fmodules%2Funused-css%2FUnusedCSS_Admin.php'}]
CVE State: PUBLISHED
Explain CVE-2023-1343
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the attach_rule function. This makes it possible for unauthenticated attackers to modify the plugin's cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Products: RapidLoad Power-Up for Autoptimize
References: [{'url': 'https://www.wordfence.com/threat-intel/vulnerabilities/id/11f74b86-a050-4247-b310-045bf48fd4bd'}, {'url': 'https://plugins.trac.wordpress.org/changeset/2877726/unusedcss/trunk/includes/modules/unused-css/UnusedCSS_Admin.php?contextall=1&old=2847136&old_path=%2Funusedcss%2Ftrunk%2Fincludes%2Fmodules%2Funused-css%2FUnusedCSS_Admin.php'}]
CVE State: PUBLISHED
Explain CVE-2023-1344
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the uucss_update_rule function. This makes it possible for unauthenticated attackers to modify the plugin's cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Products: RapidLoad Power-Up for Autoptimize
References: [{'url': 'https://www.wordfence.com/threat-intel/vulnerabilities/id/263153c9-61c5-4df4-803b-8d274e2a5e35'}, {'url': 'https://plugins.trac.wordpress.org/changeset/2877726/unusedcss/trunk/includes/modules/unused-css/UnusedCSS_Admin.php?contextall=1&old=2847136&old_path=%2Funusedcss%2Ftrunk%2Fincludes%2Fmodules%2Funused-css%2FUnusedCSS_Admin.php'}]
CVE State: PUBLISHED
Explain CVE-2023-1345
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the queue_posts function. This makes it possible for unauthenticated attackers to modify the plugin's cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Products: RapidLoad Power-Up for Autoptimize
References: [{'url': 'https://www.wordfence.com/threat-intel/vulnerabilities/id/d16fa590-1409-4f04-b8b7-0cce17412a5f'}, {'url': 'https://plugins.trac.wordpress.org/changeset/2877726/unusedcss/trunk/includes/modules/unused-css/UnusedCSS_Admin.php?contextall=1&old=2847136&old_path=%2Funusedcss%2Ftrunk%2Fincludes%2Fmodules%2Funused-css%2FUnusedCSS_Admin.php'}]
CVE State: PUBLISHED
Explain CVE-2023-1346
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the clear_page_cache function. This makes it possible for unauthenticated attackers to clear the plugin's cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Affected Products: RapidLoad Power-Up for Autoptimize
References: [{'url': 'https://www.wordfence.com/threat-intel/vulnerabilities/id/b228f8b1-dd68-41ee-bc49-6a62e5267233'}, {'url': 'https://plugins.trac.wordpress.org/changeset/2877726/unusedcss/trunk/includes/modules/unused-css/UnusedCSS_Admin.php?contextall=1&old=2847136&old_path=%2Funusedcss%2Ftrunk%2Fincludes%2Fmodules%2Funused-css%2FUnusedCSS_Admin.php'}]
CVE State: PUBLISHED
Explain CVE-2023-1347
The Customizer Export/Import WordPress plugin before 0.9.6 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present
Affected Products: Customizer Export/Import
References: [{'url': 'https://wpscan.com/vulnerability/356a5977-c90c-4fc6-98ed-032d5b27f272', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2023-1349
A vulnerability, which was classified as problematic, has been found in Hsycms 3.1. Affected by this issue is some unknown functionality of the file controller\cate.php of the component Add Category Module. The manipulation of the argument title leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-222842 is the identifier assigned to this vulnerability.
Affected Products: Hsycms
References: [{'url': 'https://vuldb.com/?id.222842', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222842', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/yztale/hsycms/blob/main/README.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1350
A vulnerability was found in liferea. It has been rated as critical. Affected by this issue is the function update_job_run of the file src/update.c of the component Feed Enrichment. The manipulation of the argument source with the input |date &gt;/tmp/bad-item-link.txt leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-222848.
Affected Products: liferea
References: [{'url': 'https://vuldb.com/?id.222848', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222848', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/lwindolf/liferea/commit/8d8b5b963fa64c7a2122d1bbfbb0bed46e813e59', 'tags': ['patch']}]
CVE State: PUBLISHED
Explain CVE-2023-1351
A vulnerability classified as critical has been found in SourceCodester Computer Parts Sales and Inventory System 1.0. This affects an unknown part of the file cust_transac.php. The manipulation of the argument phonenumber leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222849 was assigned to this vulnerability.
Affected Products: Computer Parts Sales and Inventory System
References: [{'url': 'https://vuldb.com/?id.222849', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222849', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/chenxing0903/CveHub/blob/main/Computer-Parts-Sales-And-Inventory-System-Sql-Vulnerability.pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1352
A vulnerability, which was classified as critical, has been found in SourceCodester Design and Implementation of Covid-19 Directory on Vaccination System 1.0. This issue affects some unknown processing of the file /admin/login.php. The manipulation of the argument txtusername/txtpassword leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222851.
Affected Products: Design and Implementation of Covid-19 Directory on Vaccination System
References: [{'url': 'https://vuldb.com/?id.222851', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222851', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/E1CHO/cve_hub/blob/main/covid-19-vaccination%20vlun%20pdf/covid-19-vaccination%20sql(6).pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1353
A vulnerability, which was classified as problematic, was found in SourceCodester Design and Implementation of Covid-19 Directory on Vaccination System 1.0. Affected is an unknown function of the file verification.php. The manipulation of the argument txtvaccinationID leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222852.
Affected Products: Design and Implementation of Covid-19 Directory on Vaccination System
References: [{'url': 'https://vuldb.com/?id.222852', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222852', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/E1CHO/cve_hub/blob/main/covid-19-vaccination%20vlun%20pdf/covid-19-vaccination%20xss(1).pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1354
A vulnerability has been found in SourceCodester Design and Implementation of Covid-19 Directory on Vaccination System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file register.php. The manipulation of the argument txtfullname/txtage/txtaddress/txtphone leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222853 was assigned to this vulnerability.
Affected Products: Design and Implementation of Covid-19 Directory on Vaccination System
References: [{'url': 'https://vuldb.com/?id.222853', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222853', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/E1CHO/cve_hub/blob/main/covid-19-vaccination%20vlun%20pdf/covid-19-vaccination%20xss(2).pdf', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1355
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.1402.
Affected Products: vim/vim
References: [{'url': 'https://huntr.dev/bounties/4d0a9615-d438-4f5c-8dd6-aa22f4b716d9'}, {'url': 'https://github.com/vim/vim/commit/d13dd30240e32071210f55b587182ff48757ea46'}, {'name': 'FEDORA-2023-030318ca00', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IE44W6WMMREYCW3GJHPSYP7NK2VT5NY6/'}]
CVE State: PUBLISHED
Explain CVE-2023-1357
A vulnerability, which was classified as critical, has been found in SourceCodester Simple Bakery Shop Management System 1.0. Affected by this issue is some unknown functionality of the component Admin Login. The manipulation of the argument username/password with the input admin' or 1=1 -- leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-222860.
Affected Products: Simple Bakery Shop Management System
References: [{'url': 'https://vuldb.com/?id.222860', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222860', 'tags': ['signature', 'permissions-required']}]
CVE State: PUBLISHED
Explain CVE-2023-1358
A vulnerability, which was classified as critical, was found in SourceCodester Gadget Works Online Ordering System 1.0. This affects an unknown part of the file /philosophy/admin/login.php of the component POST Parameter Handler. The manipulation of the argument user_email leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-222861 was assigned to this vulnerability.
Affected Products: Gadget Works Online Ordering System
References: [{'url': 'https://vuldb.com/?id.222861', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222861', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/heitaoa999/bug_report/blob/main/vendors/janobe/Gadget%20Works%20Online%20Ordering%20System/SQLi-1.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1359
A vulnerability has been found in SourceCodester Gadget Works Online Ordering System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /philosophy/admin/user/controller.php?action=add of the component Add New User. The manipulation of the argument U_NAME leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-222862 is the identifier assigned to this vulnerability.
Affected Products: Gadget Works Online Ordering System
References: [{'url': 'https://vuldb.com/?id.222862', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222862', 'tags': ['signature', 'permissions-required']}, {'url': 'https://github.com/heitaoa999/bug_report/blob/main/vendors/janobe/Gadget%20Works%20Online%20Ordering%20System/XSS-1.md', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1360
A vulnerability was found in SourceCodester Employee Payslip Generator with Sending Mail 1.2.0 and classified as critical. This issue affects some unknown processing of the file classes/Users.php?f=save of the component New User Creation. The manipulation of the argument username leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-222863.
Affected Products: Employee Payslip Generator with Sending Mail
References: [{'url': 'https://vuldb.com/?id.222863', 'tags': ['vdb-entry', 'technical-description']}, {'url': 'https://vuldb.com/?ctiid.222863', 'tags': ['signature', 'permissions-required']}, {'url': 'https://blog.0xgabe.com/?p=90', 'tags': ['exploit']}]
CVE State: PUBLISHED
Explain CVE-2023-1361
SQL Injection in GitHub repository unilogies/bumsys prior to v2.0.2.
Affected Products: unilogies/bumsys
References: [{'url': 'https://huntr.dev/bounties/1b1dbc5a-df16-421f-9a0d-de83e43146c4'}, {'url': 'https://github.com/unilogies/bumsys/commit/6a328eb5bf9dbb44329a3df82e95683b77c4730d'}]
CVE State: PUBLISHED
Explain CVE-2023-1362
Improper Restriction of Rendered UI Layers or Frames in GitHub repository unilogies/bumsys prior to v2.0.2.
Affected Products: unilogies/bumsys
References: [{'url': 'https://huntr.dev/bounties/e5959166-c8ef-4ada-9bb1-0ff5a9693bac'}, {'url': 'https://github.com/unilogies/bumsys/commit/8c5b27d54707f9805b27ef26ad741f2801e30e1f'}]
CVE State: PUBLISHED