Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-8489 State: PUBLISHED Published: 2025-10-31T06:42:55.486Z Last Updated: 2025-10-31T06:42:55.486Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: kingaddons Products: King Addons for Elementor – 4,000+ ready Elementor sections, 650+ templates, 70+ FREE widgets for Elementor Problem Types: CWE-269 Description: The King Addons for Elementor – Free Elements, Widgets, Templates, and Features for Elementor plugin for WordPress is vulnerable to privilege escalation in versions 24.12.92 to 51.1.14 . This is due to the plugin not properly restricting the roles that users can register with. This makes it possible for unauthenticated attackers to reg
properly restricting the roles that users can register with. This makes it possible for unauthenticated attackers to register with administrator-level user accounts. References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a1bb2b06-9a3b-4428-8624-26a1202fe3b0?source=cve - https://plugins.trac.wordpress.org/browser/king-addons/tags/24.12.93/includes/widgets/Login_Register_Form/Login_Register_Form_Ajax.php#L353 - https://plugins.trac.wordpress.org/browser/king-addons/tags/51.1.35/includes/widgets/Login_Register_Form/Login_Register_Form_Ajax.php#L160
CVE ID: CVE-2025-8490 State: PUBLISHED Published: 2025-08-26T23:22:40.976Z Last Updated: 2025-08-27T19:44:20.860Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: servmask Products: All-in-One WP Migration and Backup Problem Types: CWE-79 Description: The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Import in all versions up to, and including, 7.97 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This
evel access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/85930893-d415-4131-bcda-54a20644eddc?source=cve - https://plugins.trac.wordpress.org/browser/all-in-one-wp-migration/tags/7.97/lib/controller/class-ai1wm-import-controller.php#L144
CVE ID: CVE-2025-8491 State: PUBLISHED Published: 2025-08-13T03:42:04.071Z Last Updated: 2025-08-13T14:02:40.232Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: nikelschubert Products: Easy restaurant menu manager Problem Types: CWE-352 Description: The Easy restaurant menu manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on the nsc_eprm_save_menu() function. This makes it possible for unauthenticated attackers to upload a menu file via a forged request granted they can trick a site administrator into performing an action such as clickin
d a menu file via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a349b220-5b42-4b98-869f-ce8399fe7ec9?source=cve - https://plugins.trac.wordpress.org/browser/easy-pdf-restaurant-menu-upload/tags/2.0.2/class/class-admin-settings-nsc_eprm.php#L95 - https://plugins.trac.wordpress.org/changeset/3338246/easy-pdf-restaurant-menu-upload/trunk/class/class_admin_easy_pdf_restaurant_menu.php
CVE ID: CVE-2025-8492 State: PUBLISHED Published: 2025-09-11T07:24:56.874Z Last Updated: 2025-09-11T14:38:51.236Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: wordpresschef Products: Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses Problem Types: CWE-862 Description: The Salon Booking System, Appointment Scheduling for Salons, Spas & Small Businesses plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax function in all versions up to, and including, 10.20. This makes it possible for unauthenticated attackers to execute AJAX actions, including limited file uploa
uding, 10.20. This makes it possible for unauthenticated attackers to execute AJAX actions, including limited file uploads. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9a63a4ec-80e6-48cc-a778-97fa3917817e?source=cve - https://plugins.trac.wordpress.org/browser/salon-booking-system/tags/10.20/src/SLN/Plugin.php#L232
CVE ID: CVE-2025-8493 State: PUBLISHED Published: 2025-08-02T22:32:07.790Z Last Updated: 2025-08-04T13:19:23.820Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Intern Membership Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in code-projects Intern Membership Management System 1.0. This vulnerability affects unknown code of the file /admin/edit_student_query.php. The manipulation of the argument ID leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Ref
ly. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318592 - https://vuldb.com/?ctiid.318592 - https://vuldb.com/?submit.626716 - https://www.yuque.com/gongzi-jsnek/xb2q3a/dpgm5r79h1o8mp1b?singleDoc - https://code-projects.org/
CVE ID: CVE-2025-8494 State: PUBLISHED Published: 2025-08-02T23:32:09.041Z Last Updated: 2025-08-04T13:28:57.512Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Intern Membership Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in code-projects Intern Membership Management System 1.0. This issue affects some unknown processing of the file /admin/delete_student.php. The manipulation of the argument ID leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP V
initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318593 - https://vuldb.com/?ctiid.318593 - https://vuldb.com/?submit.626721 - https://www.yuque.com/gongzi-jsnek/xb2q3a/ckkctkqfirwk2bsd?singleDoc# - https://code-projects.org/
CVE ID: CVE-2025-8495 State: PUBLISHED Published: 2025-08-03T01:32:10.379Z Last Updated: 2025-08-04T18:22:59.133Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Intern Membership Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in code-projects Intern Membership Management System 1.0. Affected is an unknown function of the file /admin/edit_admin_query.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP V
he attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318594 - https://vuldb.com/?ctiid.318594 - https://vuldb.com/?submit.626722 - https://www.yuque.com/gongzi-jsnek/xb2q3a/dctpzq93gcaop8qo?singleDoc - https://code-projects.org/
CVE ID: CVE-2025-8496 State: PUBLISHED Published: 2025-08-03T03:02:04.978Z Last Updated: 2025-08-04T18:09:12.492Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: projectworlds Products: Online Admission System Problem Types: CWE-89, CWE-74 Description: A vulnerability has been found in projectworlds Online Admission System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /viewform.php. The manipulation of the argument ID leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
it has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318595 - https://vuldb.com/?ctiid.318595 - https://vuldb.com/?submit.626766 - https://github.com/huangtinlin/CVE/issues/1
CVE ID: CVE-2025-8497 State: PUBLISHED Published: 2025-08-03T03:32:16.301Z Last Updated: 2025-09-05T12:58:48.478Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Medicine Guide Problem Types: CWE-89, CWE-74 Description: A weakness has been identified in code-projects Online Medicine Guide 1.0. This affects an unknown part of the file /cusfindphar2.php. This manipulation of the argument Search causes sql injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318596 - htt
could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318596 - https://vuldb.com/?ctiid.318596 - https://vuldb.com/?submit.626776 - https://github.com/shokaku-cyb/cve/issues/2 - https://code-projects.org/
CVE ID: CVE-2025-8498 State: PUBLISHED Published: 2025-08-03T04:02:05.385Z Last Updated: 2025-09-05T12:58:26.625Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Medicine Guide Problem Types: CWE-89, CWE-74 Description: A security vulnerability has been detected in code-projects Online Medicine Guide 1.0. This vulnerability affects unknown code of the file /cart/index.php. Such manipulation of the argument uname leads to sql injection. The attack can be executed remotely. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318597 - https://
nd may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318597 - https://vuldb.com/?ctiid.318597 - https://vuldb.com/?submit.626777 - https://github.com/shokaku-cyb/cve/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-8499 State: PUBLISHED Published: 2025-08-03T04:32:06.129Z Last Updated: 2025-08-04T13:10:14.690Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Medicine Guide Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Online Medicine Guide 1.0. It has been declared as critical. This vulnerability affects unknown code of the file /cusfindambulence2.php. The manipulation of the argument Search leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://v
been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318598 - https://vuldb.com/?ctiid.318598 - https://vuldb.com/?submit.626778 - https://github.com/joker-vip/cvesubmit/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-8500 State: PUBLISHED Published: 2025-08-03T05:02:05.263Z Last Updated: 2025-08-04T13:09:41.107Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Human Resource Integrated System Problem Types: CWE-89, CWE-74 Description: A vulnerability was found in code-projects Human Resource Integrated System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /insert-and-view/action.php. The manipulation of the argument content leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichm
d remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318599 - https://vuldb.com/?ctiid.318599 - https://vuldb.com/?submit.626791 - https://github.com/shenxianyuguitian/hris-vuln-sqli/blob/main/README.md - https://code-projects.org/
CVE ID: CVE-2025-8501 State: PUBLISHED Published: 2025-08-03T06:02:05.573Z Last Updated: 2025-08-04T13:08:44.233Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Human Resource Integrated System Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic has been found in code-projects Human Resource Integrated System 1.0. Affected is an unknown function of the file /insert-and-view/action.php. The manipulation of the argument content leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnric
ack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318600 - https://vuldb.com/?ctiid.318600 - https://vuldb.com/?submit.626792 - https://github.com/shenxianyuguitian/hris-vuln-XSS/blob/main/README.md - https://code-projects.org/
CVE ID: CVE-2025-8502 State: PUBLISHED Published: 2025-08-03T06:32:05.227Z Last Updated: 2025-08-04T13:07:15.969Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Medicine Guide Problem Types: CWE-89, CWE-74 Description: A vulnerability classified as critical was found in code-projects Online Medicine Guide 1.0. Affected by this vulnerability is an unknown functionality of the file /changepass.php. The manipulation of the argument ups leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuld
n disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318601 - https://vuldb.com/?ctiid.318601 - https://vuldb.com/?submit.626920 - https://github.com/freshfish-hust/my-cves/issues/1 - https://code-projects.org/
CVE ID: CVE-2025-8503 State: PUBLISHED Published: 2025-08-03T07:02:05.328Z Last Updated: 2025-08-04T13:05:41.979Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Online Medicine Guide Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in code-projects Online Medicine Guide 1.0. Affected by this issue is some unknown functionality of the file /adaddmed.php. The manipulation of the argument mname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
oit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318602 - https://vuldb.com/?ctiid.318602 - https://vuldb.com/?submit.626923 - https://github.com/freshfish-hust/my-cves/issues/2 - https://code-projects.org/
CVE ID: CVE-2025-8504 State: PUBLISHED Published: 2025-08-03T07:32:05.151Z Last Updated: 2025-08-04T13:04:45.186Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: code-projects Products: Kitchen Treasure Problem Types: CWE-434, CWE-284 Description: A vulnerability, which was classified as critical, was found in code-projects Kitchen Treasure 1.0. This affects an unknown part of the file /userregistration.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb
disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318603 - https://vuldb.com/?ctiid.318603 - https://vuldb.com/?submit.626935 - https://github.com/freshfish-hust/my-cves/issues/4 - https://code-projects.org/
CVE ID: CVE-2025-8505 State: PUBLISHED Published: 2025-08-03T08:02:05.563Z Last Updated: 2025-08-04T17:40:21.823Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: 495300897 Products: wx-shop Problem Types: CWE-352, CWE-862 Description: A vulnerability has been found in 495300897 wx-shop up to de1b66331368695779cfc6e4d11a64caddf8716e and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affec
be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318604 - https://vuldb.com/?ctiid.318604 - https://vuldb.com/?submit.627322 - https://github.com/Bemcliu/cve-reports/blob/main/cve-08-wx-shop-CSRF/readme.md
CVE ID: CVE-2025-8506 State: PUBLISHED Published: 2025-08-03T09:02:04.908Z Last Updated: 2025-08-04T17:37:14.334Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: 495300897 Products: wx-shop Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in 495300897 wx-shop up to de1b66331368695779cfc6e4d11a64caddf8716e and classified as problematic. This issue affects some unknown processing of the file /user/editUI. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, v
public and may be used. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318605 - https://vuldb.com/?ctiid.318605 - https://vuldb.com/?submit.627323 - https://github.com/Bemcliu/cve-reports/blob/main/cve-07-wx-shop-Stored%20XSS/readme.md
CVE ID: CVE-2025-8507 State: PUBLISHED Published: 2025-08-03T10:02:05.615Z Last Updated: 2025-08-04T17:30:25.581Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Portabilis i-Educar 2.9. It has been classified as problematic. Affected is an unknown function of the file /intranet/educar_funcao_lst.php. The manipulation of the argument nm_funcao/abreviatura leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond
s been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318606 - https://vuldb.com/?ctiid.318606 - https://vuldb.com/?submit.618677 - https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-8507.md - https://github.com/marcelomulder/CVE/blob/main/i-educar/Reflected%20XXS%20educar_funcao_lst.md
CVE ID: CVE-2025-8508 State: PUBLISHED Published: 2025-08-03T10:32:05.100Z Last Updated: 2025-08-04T17:23:35.814Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Portabilis i-Educar 2.9. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /intranet/educar_avaliacao_desempenho_cad.php. The manipulation of the argument titulo_avaliacao/descricao leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about
e launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318607 - https://vuldb.com/?ctiid.318607 - https://vuldb.com/?submit.618678 - https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-8508.md - https://github.com/marcelomulder/CVE/blob/main/i-educar/Stored%20XSS%20educar_avaliacao_desempenho_cad.php%20parameters%20titulo_avaliacao%20and%20descricao.md
CVE ID: CVE-2025-8509 State: PUBLISHED Published: 2025-08-03T12:32:04.725Z Last Updated: 2025-08-04T16:51:23.266Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: Portabilis Products: i-Educar Problem Types: CWE-79, CWE-94 Description: A vulnerability was found in Portabilis i-Educar 2.9. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /intranet/educar_servidor_cad.php. The manipulation of the argument matricula leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in
een disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318608 - https://vuldb.com/?ctiid.318608 - https://vuldb.com/?submit.618679 - https://github.com/marcelomulder/CVE/blob/main/i-educar/CVE-2025-8509.md - https://github.com/marcelomulder/CVE/blob/main/i-educar/Stored%20XSS%20educar_servidor_cad.php%20parameter%20matricula.md
CVE ID: CVE-2025-8510 State: PUBLISHED Published: 2025-08-03T13:02:06.743Z Last Updated: 2025-08-04T18:59:22.406Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N/E:POC/RL:OF/RC:C) Vendors: Portabilis Products: i-Educar Problem Types: CWE-79, CWE-94 Description: A vulnerability classified as problematic has been found in Portabilis i-Educar 2.10. This affects the function Gerar of the file ieducar/intranet/educar_matricula_lst.php. The manipulation of the argument ref_cod_aluno leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is 82c288b9a4abb084bdfa1c0c4ef777ed45f98b46. It
en disclosed to the public and may be used. The identifier of the patch is 82c288b9a4abb084bdfa1c0c4ef777ed45f98b46. It is recommended to apply a patch to fix this issue. The vendor initially closed the original advisory without requesting a CVE. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.318609 - https://vuldb.com/?ctiid.318609 - https://vuldb.com/?submit.618964 - https://github.com/CVE-Hunters/CVE/blob/main/i-educar/Reflected%20Cross-Site%20Scripting%20(XSS)%20in%20educar_matricula_lst.php%20via%20ref_cod_aluno%20Parameter.md - https://github.com/portabilis/i-educar/compare/GHSA-88xc-64vw-g4xg - https://github.com/portabilis/i-educar/commit/82c28
https://github.com/portabilis/i-educar/compare/GHSA-88xc-64vw-g4xg - https://github.com/portabilis/i-educar/commit/82c288b9a4abb084bdfa1c0c4ef777ed45f98b46