Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-4891 State: PUBLISHED Published: 2024-05-18T04:30:53.061Z Last Updated: 2024-08-01T20:55:10.248Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tagName’ parameter in versions up to, and including, 4.5.12 due to insufficient input sanitization and output escaping. This makes it possible
ersions up to, and including, 4.5.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e1bcebb3-920b-40cc-aa5c-24a1f729b28d?source=cve - https://plugins.trac.wordpress.org/browser/essential-blocks/trunk/blocks/AdvancedHeading.php#L115 - https://plugins.trac.wordpress.org/changeset/3087677/
CVE ID: CVE-2024-4892 State: PUBLISHED Published: 2024-06-12T01:55:22.241Z Last Updated: 2024-08-01T20:55:10.169Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: buddypress Products: BuddyPress Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The BuddyPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘display_name’ parameter in versions up to, and including, 12.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages
sible for authenticated attackers, with subscriber-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/113c154d-94a0-41da-a5ed-d9b2617e1c2c?source=cve - https://plugins.trac.wordpress.org/browser/buddypress/tags/12.4.1/bp-members/bp-members-blocks.php#L249 - https://plugins.trac.wordpress.org/changeset/3100815/buddypress/trunk/bp-members/bp-members-blocks.php
CVE ID: CVE-2024-4893 State: PUBLISHED Published: 2024-05-15T02:31:29.475Z Last Updated: 2024-08-01T20:55:10.269Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: DigiWin Products: EasyFlow .NET Problem Types: CWE-89 Description: DigiWin EasyFlow .NET lacks validation for certain input parameters, allowing remote attackers to inject arbitrary SQL commands. This vulnerability enables unauthorized access to read, modify, and delete database records, as well as execute system commands. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7800-843f1-1.html - https://www.twcert.org.tw/en/cp
Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7800-843f1-1.html - https://www.twcert.org.tw/en/cp-139-7801-67d07-2.html
CVE ID: CVE-2024-4894 State: PUBLISHED Published: 2024-05-15T02:53:45.648Z Last Updated: 2024-08-01T20:55:10.323Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ITPison Products: OMICARD EDM Problem Types: CWE-918 Description: ITPison OMICARD EDM fails to properly filter specific URL parameter, allowing unauthenticated remote attackers to modify the parameters and conduct Server-Side Request Forgery (SSRF) attacks. This vulnerability enables attackers to probe internal network information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7802-18f3c-1.html - https://www.twcert.org.t
- CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-7802-18f3c-1.html - https://www.twcert.org.tw/en/cp-139-7803-c0f73-2.html
CVE ID: CVE-2024-4895 State: PUBLISHED Published: 2024-05-23T02:33:06.431Z Last Updated: 2024-08-01T20:55:10.244Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: wpdatatables Products: wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The wpDataTables – WordPress Data Table, Dynamic Tables & Table Charts Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the CSV import functionality in all versions up to, and including, 3.4.2.12 due to insufficient input sanitization and output escaping. Thi
tionality in all versions up to, and including, 3.4.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0c944e08-1b70-4b56-80eb-f588c0fab5b6?source=cve - https://plugins.trac.wordpress.org/changeset/3089897/ - https://wordpress.org/plugins/wpdatatables/#developers
CVE ID: CVE-2024-4896 State: PUBLISHED Published: 2024-05-22T08:31:20.807Z Last Updated: 2024-08-01T20:55:10.256Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpbean Products: WPB Elementor Addons Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WPB Elementor Addons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in
kes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/103dea33-0c30-460e-80e4-fead18928a62?source=cve - https://plugins.trac.wordpress.org/browser/wpb-elementor-addons/trunk/templates/videos_grid.php#L323 - https://plugins.trac.wordpress.org/changeset/3088737/#file26
CVE ID: CVE-2024-4897 State: PUBLISHED Published: 2024-07-02T14:37:36.135Z Last Updated: 2024-08-01T20:55:10.244Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: parisneo Products: parisneo/lollms-webui Problem Types: CWE-76 Description: parisneo/lollms-webui, in its latest version, is vulnerable to remote code execution due to an insecure dependency on llama-cpp-python version llama_cpp_python-0.2.61+cpuavx2-cp311-cp311-manylinux_2_31_x86_64. The vulnerability arises from the application's 'binding_zoo' feature, which allows attackers to upload and interact with a malicious model file hosted on hugging-face, leading to remote code execution. The issue is link
oad and interact with a malicious model file hosted on hugging-face, leading to remote code execution. The issue is linked to a known vulnerability in llama-cpp-python, CVE-2024-34359, which has not been patched in lollms-webui as of commit b454f40a. The vulnerability is exploitable through the application's handling of model files in the 'bindings_zoo' feature, specifically when processing gguf format model files. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://huntr.com/bounties/ecf386df-4b6a-40b2-9000-db0974355acc
CVE ID: CVE-2024-4898 State: PUBLISHED Published: 2024-06-12T11:05:07.625Z Last Updated: 2024-08-01T20:55:10.271Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: instawp Products: InstaWP Connect – 1-click WP Staging & Migration Problem Types: CWE-862 Missing Authorization Description: The InstaWP Connect – 1-click WP Staging & Migration plugin for WordPress is vulnerable to arbitrary option updates due to a missing authorization checks on the REST API calls in all versions up to, and including, 0.1.0.38. This makes it possible for unauthenticated attackers to connect the site to InstaWP API, edit arbitrary site options and create administrator accounts. A
enticated attackers to connect the site to InstaWP API, edit arbitrary site options and create administrator accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/92a00fb4-7b50-43fd-ac04-5d6e29336e9c?source=cve - https://plugins.trac.wordpress.org/browser/instawp-connect/tags/0.1.0.38/includes/class-instawp-rest-api.php#L926
CVE ID: CVE-2024-4899 State: PUBLISHED Published: 2024-06-24T06:00:01.586Z Last Updated: 2024-08-01T20:55:10.228Z Vendors: Unknown Products: SEOPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The SEOPress WordPress plugin before 7.8 does not sanitise and escape some of its Post settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/15346ae9-9a29-4968-a6a9-81d1116ac448/
CVE ID: CVE-2024-4900 State: PUBLISHED Published: 2024-06-24T06:00:01.863Z Last Updated: 2024-12-04T21:01:49.983Z Vendors: Unknown Products: SEOPress Problem Types: CWE-601 URL Redirection to Untrusted Site ('Open Redirect') Description: The SEOPress WordPress plugin before 7.8 does not validate and escape one of its Post settings, which could allow contributor and above role to perform Open redirect attacks against any user viewing a malicious post Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/a56ad272-e2ed-4064-9b5d-114a834dd8b3/
CVE ID: CVE-2024-4901 State: PUBLISHED Published: 2024-06-26T23:31:05.422Z Last Updated: 2024-09-17T17:02:23.803Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-79 Description: An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, where a stored XSS vulnerability could be imported from a project with malicious commit notes. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/461773 - https://hackerone.com/reports/2
Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/461773 - https://hackerone.com/reports/2500163
CVE ID: CVE-2024-4902 State: PUBLISHED Published: 2024-06-07T04:33:25.127Z Last Updated: 2024-08-09T19:44:13.254Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: themeum Products: Tutor LMS – eLearning and online course solution Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to time-based SQL Injection via the ‘course_id’ parameter in all versions up to, and including, 2.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This ma
sufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with admin access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f00e8169-3b8f-44a0-9af2-e81777a913f8?source=cve - https://plugins.trac.wordpress.org/browser/tutor/tags/2.7.0/classes/Utils.php#L1936 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3098465%4
7.0/classes/Utils.php#L1936 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3098465%40tutor%2Ftrunk&old=3086489%40tutor%2Ftrunk&sfp_email=&sfph_mail=#file8
CVE ID: CVE-2024-4903 State: PUBLISHED Published: 2024-05-15T15:31:04.575Z Last Updated: 2024-08-01T20:55:10.260Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Tongda Products: OA Problem Types: CWE-89 Description: A vulnerability was found in Tongda OA 2017. It has been declared as critical. This vulnerability affects unknown code of the file /general/meeting/manage/delete.php. The manipulation of the argument M_ID_STR leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264436. NOTE: The vendor was contacted early about this disclosure but did not respond in any
this vulnerability is VDB-264436. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264436 - https://vuldb.com/?ctiid.264436 - https://vuldb.com/?submit.330632 - https://github.com/Hefei-Coffee/cve/blob/main/sql3.md
CVE ID: CVE-2024-4904 State: PUBLISHED Published: 2024-05-15T19:31:03.731Z Last Updated: 2024-08-01T20:55:10.226Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Byzoro Products: Smart S200 Management Platform Problem Types: CWE-434 Description: A vulnerability was found in Byzoro Smart S200 Management Platform up to 20240507. It has been rated as critical. This issue affects some unknown processing of the file /useratte/userattestation.php. The manipulation of the argument web_img leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264437 was assigned to this vulnerability. NOTE: Th
has been disclosed to the public and may be used. The identifier VDB-264437 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264437 - https://vuldb.com/?ctiid.264437 - https://vuldb.com/?submit.330636 - https://github.com/Hefei-Coffee/cve/blob/main/upload.md
CVE ID: CVE-2024-4905 State: PUBLISHED Published: 2024-05-15T17:31:04.584Z Last Updated: 2024-08-01T20:55:10.321Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Kashipara Products: College Management System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in Kashipara College Management System 1.0. Affected is an unknown function of the file view_students_each_detail.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-264438 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnr
and may be used. VDB-264438 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264438 - https://vuldb.com/?ctiid.264438 - https://vuldb.com/?submit.332543 - https://github.com/E1CHO/cve_hub/blob/main/College%20Management%20System/College%20Management%20System%20-%20vuln%201.pdf
CVE ID: CVE-2024-4906 State: PUBLISHED Published: 2024-05-15T18:31:04.662Z Last Updated: 2024-08-01T20:55:10.234Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Complete Web-Based School Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in Campcodes Complete Web-Based School Management System 1.0. This affects an unknown part of the file /view/show_student1.php. The manipulation of the argument grade leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264441 was assigned to this vulnerability. Ad
ploit has been disclosed to the public and may be used. The identifier VDB-264441 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264441 - https://vuldb.com/?ctiid.264441 - https://vuldb.com/?submit.333292 - https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%202.pdf
CVE ID: CVE-2024-4907 State: PUBLISHED Published: 2024-05-15T18:31:06.174Z Last Updated: 2024-08-01T20:55:10.308Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Complete Web-Based School Management System Problem Types: CWE-89 Description: A vulnerability has been found in Campcodes Complete Web-Based School Management System 1.0 and classified as critical. This vulnerability affects unknown code of the file /view/show_student2.php. The manipulation of the argument grade leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-264442 is the identifier assigned to this vulnerability. Addit
oit has been disclosed to the public and may be used. VDB-264442 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264442 - https://vuldb.com/?ctiid.264442 - https://vuldb.com/?submit.333293 - https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%203.pdf
CVE ID: CVE-2024-4908 State: PUBLISHED Published: 2024-05-15T19:00:04.698Z Last Updated: 2024-08-01T20:55:10.259Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Complete Web-Based School Management System Problem Types: CWE-89 Description: A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /view/student_attendance_history1.php. The manipulation of the argument index leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB
ly. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-264443. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264443 - https://vuldb.com/?ctiid.264443 - https://vuldb.com/?submit.333294 - https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%204.pdf
CVE ID: CVE-2024-4909 State: PUBLISHED Published: 2024-05-15T19:00:06.294Z Last Updated: 2024-08-01T20:55:10.231Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Complete Web-Based School Management System Problem Types: CWE-89 Description: A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been classified as critical. Affected is an unknown function of the file /view/student_due_payment.php. The manipulation of the argument due_year leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264444. A
ely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-264444. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264444 - https://vuldb.com/?ctiid.264444 - https://vuldb.com/?submit.333295 - https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%205.pdf
CVE ID: CVE-2024-4910 State: PUBLISHED Published: 2024-05-15T20:00:06.027Z Last Updated: 2024-08-01T20:55:10.286Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Complete Web-Based School Management System Problem Types: CWE-89 Description: A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /view/student_exam_mark_insert_form1.php. The manipulation of the argument grade leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264445 was
ck can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-264445 was assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264445 - https://vuldb.com/?ctiid.264445 - https://vuldb.com/?submit.333296 - https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%206.pdf
CVE ID: CVE-2024-4911 State: PUBLISHED Published: 2024-05-15T20:31:04.293Z Last Updated: 2024-08-01T20:55:10.232Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Complete Web-Based School Management System Problem Types: CWE-89 Description: A vulnerability was found in Campcodes Complete Web-Based School Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /view/student_exam_mark_update_form.php. The manipulation of the argument exam leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-264446 is the identifier assigned to
aunched remotely. The exploit has been disclosed to the public and may be used. VDB-264446 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264446 - https://vuldb.com/?ctiid.264446 - https://vuldb.com/?submit.333297 - https://github.com/E1CHO/cve_hub/blob/main/Complete%20Web-Based%20School%20Management%20System%20-%20sql/Complete%20Web-Based%20School%20Management%20System%20-%20vuln%207.pdf
CVE ID: CVE-2024-4912 State: PUBLISHED Published: 2024-05-15T20:31:05.765Z Last Updated: 2024-08-01T20:55:10.318Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Campcodes Products: Online Examination System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in Campcodes Online Examination System 1.0. This affects an unknown part of the file addExamExe.php. The manipulation of the argument examTitle leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-264447. Additional Analyst Notes: - CISA ADP Vulnrichment
e used. The associated identifier of this vulnerability is VDB-264447. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.264447 - https://vuldb.com/?ctiid.264447 - https://vuldb.com/?submit.333402 - https://github.com/yylmm/CVE/blob/main/Online%20Examination%20System%20With%20Timer/SQL_addExamExe.md