Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-42944 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-08-15T18:03:46.869Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromNatlimit function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1201/fromNatlimit.md
CVE ID: CVE-2024-42945 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-08-15T17:56:14.793Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromAddressNat function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1201/fromAddressNat_page.md
CVE ID: CVE-2024-42946 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-08-16T16:55:40.491Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromVirtualSer function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1201/fromVirtualSer.md
CVE ID: CVE-2024-42947 State: PUBLISHED Published: 2024-08-15T00:00:00.000Z Last Updated: 2025-03-13T13:36:53.179Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the handler function in /goform/telnet of Tenda FH1201 v1.2.0.14 (408) allows attackers to execute arbitrary commands via a crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1201/telnet.md
CVE ID: CVE-2024-42948 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-09-03T17:33:28.798Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the delno parameter in the fromPptpUserSetting function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1201/fromPptpUserSetting.md
CVE ID: CVE-2024-42949 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-08-15T17:34:00.541Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the qos parameter in the fromqossetting function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1201/fromqossetting_qos.md
CVE ID: CVE-2024-42950 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-08-21T16:42:45.692Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the Go parameter in the fromSafeClientFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1201/fromSafeClientFilter_Go.md
CVE ID: CVE-2024-42951 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-08-16T18:04:04.439Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the mit_pptpusrpw parameter in the fromWizardHandle function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1201/fromWizardHandle_mit_pptpusrpw.md
CVE ID: CVE-2024-42952 State: PUBLISHED Published: 2024-08-15T00:00:00.000Z Last Updated: 2025-03-18T15:17:38.400Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromqossetting function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1201/fromqossetting_page.md
CVE ID: CVE-2024-42953 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-08-15T18:02:21.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the PPW parameter in the fromWizardHandle function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1201/fromWizardHandle_PPW.md
CVE ID: CVE-2024-42954 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-08-15T17:54:54.423Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromwebExcptypemanFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1201/fromwebExcptypemanFilter.md
CVE ID: CVE-2024-42955 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-08-16T16:54:12.882Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1201 v1.2.0.14 (408) was discovered to contain a stack overflow via the page parameter in the fromSafeClientFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1201/fromSafeClientFilter_page.md
CVE ID: CVE-2024-42966 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-10-24T19:47:54.511Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in TOTOLINK N350RT V9.3.5u.6139_B20201216 allows attackers to obtain the apmib configuration file, which contains the username and the password, via a crafted request to /cgi-bin/ExportSettings.sh. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/TOTOLINK/N350R/ExportSettings.md
CVE ID: CVE-2024-42967 State: PUBLISHED Published: 2024-08-15T00:00:00.000Z Last Updated: 2025-03-13T15:29:04.042Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect access control in TOTOLINK LR350 V9.3.5u.6369_B20220309 allows attackers to obtain the apmib configuration file, which contains the username and the password, via a crafted request to /cgi-bin/ExportSettings.sh. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/TOTOLINK/LR350/ExportSettings.md
CVE ID: CVE-2024-42968 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-08-15T17:30:11.935Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the Go parameter in the fromSafeUrlFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/fromSafeMacFilter_Go.md
CVE ID: CVE-2024-42969 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-08-16T18:00:19.904Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromSafeUrlFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/fromSafeMacFilter%20_page.md
CVE ID: CVE-2024-42973 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-08-15T18:01:07.009Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromSetlpBind function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/fromSetIpBind.md
CVE ID: CVE-2024-42974 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-08-15T17:52:49.515Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromwebExcptypemanFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/fromwebExcptypemanFilter.md
CVE ID: CVE-2024-42976 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-08-16T16:52:50.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromSafeClientFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/fromSafeClientFilter_page.md
CVE ID: CVE-2024-42977 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-10-24T19:46:18.590Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the qos parameter in the fromqossetting function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/fromqossetting_qos.md
CVE ID: CVE-2024-42978 State: PUBLISHED Published: 2024-08-15T00:00:00.000Z Last Updated: 2025-03-25T16:59:03.176Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the handler function in /goform/telnet of Tenda FH1206 v02.03.01.35 allows attackers to execute arbitrary commands via a crafted HTTP request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/telnet.md
CVE ID: CVE-2024-42979 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-08-15T17:19:26.256Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the frmL7ProtForm function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/frmL7ProtForm.md
CVE ID: CVE-2024-42980 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-08-16T17:53:04.008Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the frmL7ImForm function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/frmL7ImForm.md
CVE ID: CVE-2024-42981 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-08-16T17:37:55.127Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the delno parameter in the fromPptpUserSetting function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/fromPptpUserSetting.md
CVE ID: CVE-2024-42982 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-08-16T13:49:46.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromVirtualSer function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/fromVirtualSer.md
CVE ID: CVE-2024-42983 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-08-15T17:59:15.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the pptpPPW parameter in the fromAdvSetWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/fromAdvSetWan_pptpPPW.md
CVE ID: CVE-2024-42984 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-08-15T17:51:14.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromP2pListFilter function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/fromP2pListFilter.md
CVE ID: CVE-2024-42985 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-08-16T16:51:29.762Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the page parameter in the fromNatlimit function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/fromNatlimit.md
CVE ID: CVE-2024-42986 State: PUBLISHED Published: 2024-08-15T00:00:00 Last Updated: 2024-10-24T19:45:22.676Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1206 v02.03.01.35 was discovered to contain a stack overflow via the PPPOEPassword parameter in the fromAdvSetWan function. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/fromAdvSetWan_PPPOEPassword.md
CVE ID: CVE-2024-42987 State: PUBLISHED Published: 2024-08-15T00:00:00.000Z Last Updated: 2025-09-02T16:50:24.750Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda FH1206 v02.03.01.35 was discovered to contain a stack-based buffer overflow vulnerability in the fromPptpUserAdd function. The vulnerability can be triggered via the modino, username, newpwd, or pptpdnetseg parameters, all of which are passed via HTTP POST and used in unsafe sprintf calls without proper length validation. A remote attacker can exploit this flaw through a crafted POST request, which may cause a Denial of Service (DoS). In certain scenarios, this issue could potentially be leveraged to achieve remote
h may cause a Denial of Service (DoS). In certain scenarios, this issue could potentially be leveraged to achieve remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/TTTJJJWWW/AHU-IoT-vulnerable/blob/main/Tenda/FH1206/fromPptpUserAdd.md - https://github.com/laohouzju/PoC/blob/main/Tenda%20FH1206%20fromPptpUserAdd_username.md - https://github.com/laohouzju/PoC/blob/main/Tenda%20FH1206%20fromPptpUserAdd_pptpdnetseg.md - https://github.com/laohouzju/PoC/blob/main/Tenda%20FH1206%20fromPptpUserAdd_newpwd.md
CVE ID: CVE-2024-42988 State: PUBLISHED Published: 2024-10-09T00:00:00.000Z Last Updated: 2025-02-10T22:49:11.301Z Vendors: n/a Products: n/a Problem Types: n/a Description: Lack of access control in ChallengeSolves (/api/v1/challenges/<challenge id>/solves) of CTFd v2.0.0 - v3.7.2 allows authenticated users to retrieve a list of users who have solved the challenge, regardless of the Account Visibility settings. The issue is fixed in v3.7.3+. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CTFd/CTFd/pull/2570 - https://github.com/CTFd/CTFd/releases/tag/3.7.3 - https://blog.ctfd.io/ctfd-3-7-3/
CVE ID: CVE-2024-42991 State: PUBLISHED Published: 2024-09-03T00:00:00 Last Updated: 2024-09-03T16:04:26.945Z Vendors: n/a Products: n/a Problem Types: n/a Description: MCMS v5.4.1 has front-end file upload vulnerability which can lead to remote command execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gitee.com/mingSoft/MCMS/issues/IAHN9F
CVE ID: CVE-2024-42992 State: REJECTED Published: 2024-08-23T00:00:00 Last Updated: 2024-08-26T14:33:05.281221 Description: No description available.
CVE ID: CVE-2024-42994 State: PUBLISHED Published: 2024-08-16T00:00:00 Last Updated: 2024-08-16T17:58:59.527Z Vendors: n/a Products: n/a Problem Types: n/a Description: VTiger CRM <= 8.1.0 does not properly sanitize user input before using it in a SQL statement, leading to a SQL Injection in the "CompanyDetails" operation of the "MailManager" module. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.shielder.com/advisories/vtiger-mailmanager-sqli/
CVE ID: CVE-2024-42995 State: PUBLISHED Published: 2024-08-16T00:00:00 Last Updated: 2024-08-16T17:53:33.090Z Vendors: n/a Products: n/a Problem Types: n/a Description: VTiger CRM <= 8.1.0 does not correctly check user privileges. A low-privileged user can interact directly with the "Migration" administrative module to disable arbitrary modules. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.shielder.com/advisories/vtiger-migration-bac/
CVE ID: CVE-2024-43005 State: PUBLISHED Published: 2024-08-16T00:00:00 Last Updated: 2024-08-19T17:28:26.959Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in the component dl_liuyan_save.php of ZZCMS v2023 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://zzcms.net - https://github.com/gkdgkd123/codeAudit/blob/main/CVE-2024-43005%20ZZCMS2023%E5%8F%8D%E5%B0%84%E5%9E%8BXSS2.md
CVE ID: CVE-2024-43006 State: PUBLISHED Published: 2024-08-16T00:00:00 Last Updated: 2024-08-19T17:23:58.468Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability exists in ZZCMS2023 in the ask/show.php file at line 21. An attacker can exploit this vulnerability by sending a specially crafted POST request to /user/ask_edit.php?action=add, which includes malicious JavaScript code in the 'content' parameter. When a user visits the ask/show_{newsid}.html page, the injected script is executed in the context of the user's browser, leading to potential theft of cookies, session tokens, or other sensitive information. Additional Analyst Notes:
rowser, leading to potential theft of cookies, session tokens, or other sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://www.zzcms.net/about/download.html - https://github.com/gkdgkd123/codeAudit/blob/main/CVE-2024-43006%20ZZCMS2023%E5%82%A8%E5%AD%98%E5%9E%8BXSS.md
CVE ID: CVE-2024-43009 State: PUBLISHED Published: 2024-08-16T00:00:00 Last Updated: 2024-08-19T14:10:34.136Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability exists in user/login.php at line 24 in ZZCMS 2023 and earlier. The application directly inserts the value of the HTTP_REFERER header into the HTML response without proper sanitization. An attacker can exploit this vulnerability by tricking a user into visiting a specially crafted URL, which includes a malicious Referer header. This can lead to the execution of arbitrary JavaScript code in the context of the victim's browser, potentially resulting in session hijacking, defac
n of arbitrary JavaScript code in the context of the victim's browser, potentially resulting in session hijacking, defacement, or other malicious activities. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://www.zzcms.net/about/download.html - https://github.com/gkdgkd123/codeAudit/blob/main/CVE-2024-43009%20ZZCMS2023%E5%8F%8D%E5%B0%84%E5%9E%8BXSS.md
CVE ID: CVE-2024-43011 State: PUBLISHED Published: 2024-08-16T00:00:00 Last Updated: 2024-08-19T14:02:35.099Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file deletion vulnerability exists in the admin/del.php file at line 62 in ZZCMS 2023 and earlier. Due to insufficient validation and sanitization of user input for file paths, an attacker can exploit this vulnerability by using directory traversal techniques to delete arbitrary files on the server. This can lead to the deletion of critical files, potentially disrupting the normal operation of the system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://www.zzcms.net/about/download.html - h
he system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://www.zzcms.net/about/download.html - https://github.com/gkdgkd123/codeAudit/blob/main/CVE-2024-43011%20ZZCMS2023%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E5%88%A0%E9%99%A4%E6%BC%8F%E6%B4%9E.md
CVE ID: CVE-2024-43018 State: PUBLISHED Published: 2025-07-29T00:00:00.000Z Last Updated: 2025-07-30T12:12:41.057Z Vendors: n/a Products: n/a Problem Types: n/a Description: Piwigo 13.8.0 and below is vulnerable to SQL Injection in the parameters max_level and min_register. These parameters are used in ws_user_gerList function from file include\ws_functions\pwg.users.php and this same function is called by ws.php file at some point can be used for searching users in advanced way in /admin.php?page=user_list. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Piwigo/Piwigo/issues/2197 - https://github.com/joaosilva21/CVE-2024-43018 - https://github.com/inesmar
ttps://github.com/Piwigo/Piwigo/issues/2197 - https://github.com/joaosilva21/CVE-2024-43018 - https://github.com/inesmarcal/CVE-2024-43018
CVE ID: CVE-2024-43022 State: PUBLISHED Published: 2024-08-21T00:00:00 Last Updated: 2024-08-21T17:57:32.215Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the downloader.php component of TOSEI online store management system v4.02, v4.03, and v4.04 allows attackers to execute a directory traversal. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/b0rgch3n/6ba0b04da7e48ead20f10b15088fd244