Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-9944 State: PUBLISHED Published: 2024-10-15T05:31:31.921Z Last Updated: 2024-10-15T13:53:15.085Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: woothemes Products: WooCommerce Problem Types: CWE-79 Description: The WooCommerce plugin for WordPress is vulnerable to HTML Injection in all versions up to, and including, 9.0.2. This is due to the plugin not properly neutralizing HTML elements from submitted order forms. This makes it possible for unauthenticated attackers to inject arbitrary HTML that will render when the administrator views order form submissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.word
istrator views order form submissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b5dfe2a5-612f-4e6c-a639-4afcff2ffa4c?source=cve - https://github.com/woocommerce/woocommerce/pull/49370 - https://raw.githubusercontent.com/woocommerce/woocommerce/trunk/changelog.txt - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3115837%40woocommerce%2Ftrunk&old=3106873%40woocommerce%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-9945 State: PUBLISHED Published: 2024-12-13T15:22:31.536Z Last Updated: 2025-08-29T20:18:10.908Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Fortra Products: GoAnywhere MFT Problem Types: CWE-200, CWE-425, CWE-552 Description: An information-disclosure vulnerability exists in Fortra's GoAnywhere MFT application prior to version 7.7.0 that allows external access to the resources in certain admin root folders. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.fortra.com/security/advisories/product-security/fi-2024-014
CVE ID: CVE-2024-9946 State: PUBLISHED Published: 2024-11-06T06:43:31.951Z Last Updated: 2025-02-19T17:43:47.726Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: the_champ Products: Social Share, Social Login and Social Comments Plugin – Super Socializer Problem Types: CWE-287 Description: The Social Share, Social Login and Social Comments Plugin – Super Socializer plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.13.68. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, i
e social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, if they have access to the email and the user does not have an already-existing account for the service returning the token. An attacker cannot authenticate as an administrator by default, but these accounts are also at risk if authentication for administrators has explicitly been allowed via the social login. The vulnerability was partially patched in version 7.13.68. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c394b8b6-b7f6-4ba7-8a2b-98160cc286a8?source=cve - https://plugins.trac.wordpress.org/c
m/threat-intel/vulnerabilities/id/c394b8b6-b7f6-4ba7-8a2b-98160cc286a8?source=cve - https://plugins.trac.wordpress.org/changeset/3172935/ - https://plugins.trac.wordpress.org/changeset/3180581/
CVE ID: CVE-2024-9947 State: PUBLISHED Published: 2024-10-23T06:45:06.442Z Last Updated: 2025-02-19T17:41:44.129Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ProfilePress Team Products: ProfilePress Pro Problem Types: CWE-287 Description: The ProfilePress Pro plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.11.1. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email and the user does not have an already-existing
on the site, such as an administrator, if they have access to the email and the user does not have an already-existing account for the service returning the token. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/61b477c3-88b7-45a4-9fc4-6bca6f7c3604?source=cve - https://profilepress.com/
CVE ID: CVE-2024-9949 State: PUBLISHED Published: 2024-10-23T17:37:42.978Z Last Updated: 2024-11-07T16:36:26.432Z Vendors: Forescout Products: SecureConnector Problem Types: CWE-1188 Description: Denial of Service in Forescout SecureConnector 11.1.02.1019 on Windows allows Unprivileged user to corrupt the configuration file and cause Denial of Service in the application. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://forescout.my.site.com/support/s/article/High-Severity-Vulnerability-in-Secure-Connector-HPS-Inspection-Engine-v11-3-5-and-lower
CVE ID: CVE-2024-9950 State: PUBLISHED Published: 2025-01-02T15:40:36.374Z Last Updated: 2025-06-03T13:49:49.865Z Vendors: Forescout Products: SecureConnector Problem Types: CWE-379 Description: A vulnerability in Forescout SecureConnector v11.3.07.0109 on Windows allows unauthenticated user to modify compliance scripts due to insecure temporary directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://support.forescout.com/
CVE ID: CVE-2024-9951 State: PUBLISHED Published: 2024-10-17T07:34:44.389Z Last Updated: 2024-10-17T18:21:53.827Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: opajaap Products: WP Photo Album Plus Problem Types: CWE-79 Description: The WP Photo Album Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wppa-tab' parameter in all versions up to, and including, 8.8.05.003 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. A
ipts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3a4f0c06-db88-4950-b1f5-b2aab480c974?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3170202%40wp-photo-album-plus&new=3170202%40wp-photo-album-plus&sfp_email=&sfph_mail=
CVE ID: CVE-2024-9952 State: PUBLISHED Published: 2024-10-15T02:00:06.101Z Last Updated: 2024-10-15T15:51:22.229Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: SourceCodester Products: Online Eyewear Shop Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Online Eyewear Shop 1.0 and classified as problematic. This issue affects some unknown processing of the file /admin/?page=system_info/contact_info of the component Contact Information Page. The manipulation of the argument Address leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as
initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280319 - https://vuldb.com/?ctiid.280319 - https://vuldb.com/?submit.423229 - https://gist.github.com/higordiego/bedd395e74a335f0145872c96d7cb92d - https://www.sourcecodester.com/
CVE ID: CVE-2024-9953 State: PUBLISHED Published: 2024-10-14T21:19:26.517Z Last Updated: 2025-03-20T18:58:47.620Z Vendors: CERT/CC Products: VINCE - Vulnerability Information and Coordination Environment Problem Types: CWE-502 Description: A potential denial-of-service (DoS) vulnerability exists in CERT VINCE software versions prior to 3.0.8. An authenticated administrative user can inject an arbitrary pickle object into a user’s profile, which may lead to a DoS condition when the profile is accessed. While the Django server restricts unpickling to prevent server crashes, this vulnerability could still disrupt operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https
his vulnerability could still disrupt operations. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CERTCC/VINCE/issues?q=label%3Asecurity
CVE ID: CVE-2024-9954 State: PUBLISHED Published: 2024-10-15T20:14:53.842Z Last Updated: 2024-10-22T19:37:49.126Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in AI in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html - https://issues.chromium.org/issues/367755363
CVE ID: CVE-2024-9955 State: PUBLISHED Published: 2024-10-15T20:14:54.251Z Last Updated: 2024-10-16T19:46:17.303Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in WebAuthentication in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html - https://issues.chromium.org/issues/370133761
CVE ID: CVE-2024-9956 State: PUBLISHED Published: 2024-10-15T20:14:54.455Z Last Updated: 2025-11-03T20:56:40.492Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in WebAuthentication in Google Chrome on Android prior to 130.0.6723.58 allowed a local attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html - https://issues.chromium.org/issues/370482421
CVE ID: CVE-2024-9957 State: PUBLISHED Published: 2024-10-15T20:14:54.835Z Last Updated: 2024-10-16T20:00:50.208Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in UI in Google Chrome on iOS prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html - https://issues.chromium.org/issues/358151317
CVE ID: CVE-2024-9958 State: PUBLISHED Published: 2024-10-15T20:14:55.120Z Last Updated: 2025-03-25T16:30:46.589Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in PictureInPicture in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html - https://issues.chromium.org/issues/40076120
CVE ID: CVE-2024-9959 State: PUBLISHED Published: 2024-10-15T20:14:55.331Z Last Updated: 2024-10-16T19:58:21.281Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in DevTools in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html - https://issues.chromium.org/issues/368672129
CVE ID: CVE-2024-9960 State: PUBLISHED Published: 2024-10-15T20:14:55.534Z Last Updated: 2024-10-16T19:56:45.907Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in Dawn in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html - https://issues.chromium.org/issues/354748063
CVE ID: CVE-2024-9961 State: PUBLISHED Published: 2024-10-15T20:14:55.755Z Last Updated: 2024-10-16T19:54:53.852Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in ParcelTracking in Google Chrome on iOS prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html - https://issues.chromium.org/issues/357776197
CVE ID: CVE-2024-9962 State: PUBLISHED Published: 2024-10-15T20:14:55.983Z Last Updated: 2025-03-25T16:30:46.273Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Permissions in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html - https://issues.chromium.org/issues/364508693
CVE ID: CVE-2024-9963 State: PUBLISHED Published: 2024-10-15T20:14:56.219Z Last Updated: 2025-03-25T16:30:44.733Z Vendors: Google Products: Chrome Problem Types: Insufficient data validation Description: Insufficient data validation in Downloads in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html - https://issues.chromium.org/issues/328278718
CVE ID: CVE-2024-9964 State: PUBLISHED Published: 2024-10-15T20:14:56.437Z Last Updated: 2025-03-25T16:20:45.160Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Payments in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html - https://issues.chromium.org/issues/361711121
CVE ID: CVE-2024-9965 State: PUBLISHED Published: 2024-10-15T20:14:56.644Z Last Updated: 2025-03-13T16:16:22.995Z Vendors: Google Products: Chrome Problem Types: Insufficient data validation Description: Insufficient data validation in DevTools in Google Chrome on Windows prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html - https://issues.chromium.org/issues/352651673
CVE ID: CVE-2024-9966 State: PUBLISHED Published: 2024-10-15T20:14:56.858Z Last Updated: 2025-03-25T16:20:45.866Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Navigations in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/10/stable-channel-update-for-desktop_15.html - https://issues.chromium.org/issues/364773822
CVE ID: CVE-2024-9967 State: PUBLISHED Published: 2024-10-26T08:35:59.304Z Last Updated: 2024-10-28T19:19:26.335Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: renemaurer Products: WP show more Problem Types: CWE-79 Description: The WP show more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's show_more shortcode in all versions up to, and including, 1.0.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an inj
butor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/1de269b5-7262-45c8-8819-00982f196597?source=cve - https://wordpress.org/plugins/wp-show-more/#developers - https://plugins.trac.wordpress.org/browser/wp-show-more/trunk/wp-show-more.php#L16 - https://plugins.trac.wordpress.org/browser/wp-show-more/trunk/wp-show-more.php#L23 - https://plugins.trac.wordpress.org/browser/wp-show-more/trunk/wp-show-more.php#L27 - https://plugins.trac.wordpress.org/browser/wp-show-more/trunk/wp-show-more.php#L31
CVE ID: CVE-2024-9968 State: PUBLISHED Published: 2024-10-15T02:40:44.637Z Last Updated: 2024-10-15T13:39:38.622Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: NewType Products: WebEIP Problem Types: CWE-89 Description: WebEIP v3.0 from NewType does not properly validate user input, allowing remote attackers with regular privilege to inject SQL commands to read, modify, and delete data stored in database. The affected product is no longer maintained. It is recommended to upgrade to the new product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8132-160bb-1.html - https://www.twcert.org.tw/en/cp-139-8133-
ichment: References: - https://www.twcert.org.tw/tw/cp-132-8132-160bb-1.html - https://www.twcert.org.tw/en/cp-139-8133-2cc3a-2.html
CVE ID: CVE-2024-9969 State: PUBLISHED Published: 2024-10-15T03:26:33.730Z Last Updated: 2024-10-15T15:34:43.325Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: NewType Products: WebEIP Problem Types: CWE-79 Description: NewType WebEIP v3.0 does not properly validate user input, allowing a remote attacker with regular privileges to insert JavaScript into specific parameters, resulting in a Reflected Cross-site Scripting (XSS) attack. The affected product is no longer maintained. It is recommended to upgrade to the new product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8134-c476d-1.html - https://www
nalyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8134-c476d-1.html - https://www.twcert.org.tw/en/cp-139-8135-ce1e6-2.html
CVE ID: CVE-2024-9970 State: PUBLISHED Published: 2024-10-15T03:36:15.595Z Last Updated: 2024-10-15T15:27:17.681Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: NewType Products: FlowMaster BPM Plus Problem Types: CWE-565 Description: The FlowMaster BPM Plus system from NewType has a privilege escalation vulnerability. Remote attackers with regular privileges can elevate their privileges to administrator by tampering with a specific cookie. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8136-4d5b4-1.html - https://www.twcert.org.tw/en/cp-139-8137-ea537-2.html
CVE ID: CVE-2024-9971 State: PUBLISHED Published: 2024-10-15T03:39:56.141Z Last Updated: 2024-10-15T14:05:33.351Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: NewType Products: FlowMaster BPM Plus Problem Types: CWE-89 Description: The specific query functionality in the FlowMaster BPM Plus from NewType does not properly restrict user input, allowing remote attackers with regular privileges to inject SQL commands to read, modify, or delete database contents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8138-d2bb7-1.html - https://www.twcert.org.tw/en/cp-139-8139-4daab-2.html
CVE ID: CVE-2024-9972 State: PUBLISHED Published: 2024-10-15T06:32:06.151Z Last Updated: 2025-01-09T17:27:56.816Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ChanGate Products: Property Management System Problem Types: CWE-89 Description: Property Management System from ChanGate has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read, modify, and delete database contents. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-8140-ee91e-1.html - https://www.twcert.org.tw/en/cp-139-8141-9b045-2.html - https://www.chtsecurity.com/news/8585c924-4a27
40-ee91e-1.html - https://www.twcert.org.tw/en/cp-139-8141-9b045-2.html - https://www.chtsecurity.com/news/8585c924-4a27-4337-bb44-684adc206432 - https://www.chtsecurity.com/news/4552fc54-18af-4c18-972d-394a68e44a39
CVE ID: CVE-2024-9973 State: PUBLISHED Published: 2024-10-15T09:31:05.293Z Last Updated: 2024-10-15T13:40:05.537Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Eyewear Shop Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been classified as critical. Affected is an unknown function of the file /admin/?page=reports of the component Report Viewing Page. The manipulation of the argument date leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
it has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280338 - https://vuldb.com/?ctiid.280338 - https://vuldb.com/?submit.423167 - https://gist.github.com/higordiego/b9699573de61b26f2290e69f38d23fd0 - https://www.sourcecodester.com/
CVE ID: CVE-2024-9974 State: PUBLISHED Published: 2024-10-15T09:31:07.285Z Last Updated: 2024-10-15T13:38:39.869Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Online Eyewear Shop Problem Types: CWE-89 Description: A vulnerability was found in SourceCodester Online Eyewear Shop 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file classes/Master.php?f=add_to_card of the component POST Request Handler. The manipulation of the argument product_id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA
can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.280339 - https://vuldb.com/?ctiid.280339 - https://vuldb.com/?submit.423231 - https://gist.github.com/higordiego/2373b9e3e89f03e5f8888efd38eb4b48 - https://www.sourcecodester.com/