Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-4445 State: PUBLISHED Published: 2024-05-14T05:32:59.624Z Last Updated: 2024-08-01T20:40:47.209Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) Vendors: smartersite Products: WP Compress – Image Optimizer [All-In-One] Problem Types: CWE-862 Missing Authorization Description: The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the several functions in versions up to, and including, 6.20.01. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to edit plugin settings, including storing cross-site scripting
attackers, with subscriber-level permissions and above, to edit plugin settings, including storing cross-site scripting, in multisite environments. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/830f53a4-da3b-4a95-99f1-c4a4c8e6944c?source=cve - https://plugins.trac.wordpress.org/browser/wp-compress-image-optimizer/trunk/classes/mu.class.php?rev=2946135 - https://plugins.trac.wordpress.org/changeset/3082085/#file655
CVE ID: CVE-2024-4446 State: PUBLISHED Published: 2024-05-09T20:03:29.569Z Last Updated: 2024-08-01T20:40:47.186Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: pt-guy Products: Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Content Views – Post Grid & Filter, Recent Posts, Category Posts, & More (Gutenberg Blocks and Shortcode) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pagingType’ parameter in all versions up to, and including, 3.7.1 due to ins
ble to Stored Cross-Site Scripting via the ‘pagingType’ parameter in all versions up to, and including, 3.7.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/65504747-7f1b-43f9-be4d-48b9547e7c45?source=cve - https://plugins.trac.wordpress.org/browser/content-views-query-and-display-post-page/tags/3.7.1/includes/html.php#L803
CVE ID: CVE-2024-4447 State: PUBLISHED Published: 2024-07-26T02:02:32.506Z Last Updated: 2024-08-01T20:40:47.160Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: dotCMS Products: dotCMS core Problem Types: CWE-863 Description: In the System → Maintenance tool, the Logged Users tab surfaces sessionId data for all users via the Direct Web Remoting API (UserSessionAjax.getSessionList.dwr) calls. While this is information that would and should be available to admins who possess "Sign In As" powers, admins who otherwise lack this privilege would still be able to utilize the session IDs to imitate other users. While this is a very small attack vector that requires
still be able to utilize the session IDs to imitate other users. While this is a very small attack vector that requires very high permissions to execute, its danger lies principally in obfuscating attribution; all Sign In As operations are attributed appropriately in the log files, and a malicious administrator could use this information to render their dealings untraceable — including those admins who have not been granted this ability — such as by using a session ID to generate an API token. Fixed in: 24.07.12 / 23.01.20 LTS / 23.10.24v13 LTS / 24.04.24v5 LTS Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.dotcms.com/security/SI-72
CVE ID: CVE-2024-4448 State: PUBLISHED Published: 2024-05-10T07:33:37.184Z Last Updated: 2024-08-01T20:40:47.216Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: wpdevteam Products: Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Dual Color Header', 'Event Calendar', & 'Advanced Data Table' widgets in all version
ss-Site Scripting via the plugin's 'Dual Color Header', 'Event Calendar', & 'Advanced Data Table' widgets in all versions up to, and including, 5.9.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/21e12c72-7898-4896-9852-ebb10e5f9a3b?source=cve - https://plugins.trac.wordpress.org/changeset/3083162/essential-addon
d/21e12c72-7898-4896-9852-ebb10e5f9a3b?source=cve - https://plugins.trac.wordpress.org/changeset/3083162/essential-addons-for-elementor-lite/tags/5.9.20/includes/Elements/Dual_Color_Header.php - https://plugins.trac.wordpress.org/changeset/3083162/essential-addons-for-elementor-lite/tags/5.9.20/includes/Elements/Event_Calendar.php - https://plugins.trac.wordpress.org/changeset/3083162/essential-addons-for-elementor-lite/tags/5.9.20/includes/Elements/Advanced_Data_Table.php
CVE ID: CVE-2024-4449 State: PUBLISHED Published: 2024-05-10T07:33:37.890Z Last Updated: 2024-08-01T20:40:47.184Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'Fancy Text', 'Filter Gallery', 'Sticky Video', 'Content Ticker', 'Woo Product Galler
ss-Site Scripting via the plugin's 'Fancy Text', 'Filter Gallery', 'Sticky Video', 'Content Ticker', 'Woo Product Gallery', & 'Twitter Feed' widgets in all versions up to, and including, 5.9.19 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/57ed6c7e-ca8d-476d-adce-905b2cd2eda8?source=cve - https://plugins.trac.word
ordfence.com/threat-intel/vulnerabilities/id/57ed6c7e-ca8d-476d-adce-905b2cd2eda8?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3083162%40essential-addons-for-elementor-lite&new=3083162%40essential-addons-for-elementor-lite&sfp_email=&sfph_mail=
CVE ID: CVE-2024-4450 State: PUBLISHED Published: 2024-06-19T03:12:27.467Z Last Updated: 2024-08-01T20:40:47.189Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: ali2woo Products: AliExpress Dropshipping with AliNext Lite Problem Types: CWE-862 Missing Authorization Description: The AliExpress Dropshipping with AliNext Lite plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the ImportAjaxController.php file in all versions up to, and including, 3.3.5. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform several actions like importing and modifyi
r authenticated attackers, with subscriber-level access and above, to perform several actions like importing and modifying products. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/01836c2c-0976-493e-8b13-1c7c702d1d2c?source=cve - https://plugins.trac.wordpress.org/browser/ali2woo-lite/trunk/includes/classes/controller/ImportAjaxController.php
CVE ID: CVE-2024-4451 State: PUBLISHED Published: 2024-06-07T06:52:21.626Z Last Updated: 2024-08-01T20:40:47.151Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: extendthemes Products: Colibri Page Builder Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's colibri_video_player shortcode in all versions up to, and including, 1.0.276 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributo
ion and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0afd981e-3ae8-4450-9750-23ff6fe612dc?source=cve - https://plugins.trac.wordpress.org/changeset/3097694/colibri-page-builder/trunk/extend-builder/shortcodes/video.php
CVE ID: CVE-2024-4452 State: PUBLISHED Published: 2024-05-21T13:51:50.526Z Last Updated: 2024-08-01T20:40:47.082Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpmet Products: ElementsKit Pro Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The ElementsKit Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages tha
for authenticated attackers, with contributor-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/488ac848-786e-4100-a387-5a40e8fc4175?source=cve - https://wpmet.com/plugin/elementskit/
CVE ID: CVE-2024-4453 State: PUBLISHED Published: 2024-05-22T19:18:02.927Z Last Updated: 2025-02-13T17:53:35.191Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GStreamer Products: GStreamer Problem Types: CWE-190 Description: GStreamer EXIF Metadata Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of EXIF metadata. The issue results from the lack of proper validati
tation. The specific flaw exists within the parsing of EXIF metadata. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. . Was ZDI-CAN-23896. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-467/ - https://gitlab.freedesktop.org/tpm/gstreamer/-/commit/e68eccff103ab0e91e6d77a892f57131b33902f5 - https://lists.debian.org/debian-lts-announce/2024/05/msg00019.html
CVE ID: CVE-2024-4454 State: PUBLISHED Published: 2024-05-22T19:13:53.373Z Last Updated: 2024-08-01T20:40:47.114Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: WithSecure Products: Elements Problem Types: CWE-59 Description: WithSecure Elements Endpoint Protection Link Following Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of WithSecure Elements Endpoint Protection. User interaction on the part of an administrator is required to exploit this vulnerability. The specific flaw exists within the WithSecure plugin hosting service. By creating a symbolic link, an attacker can a
y. The specific flaw exists within the WithSecure plugin hosting service. By creating a symbolic link, an attacker can abuse the service to create a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-23035. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-491/
CVE ID: CVE-2024-4455 State: PUBLISHED Published: 2024-05-24T10:58:38.573Z Last Updated: 2024-08-01T20:40:47.133Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: yithemes Products: YITH WooCommerce Ajax Search Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The YITH WooCommerce Ajax Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘item’ parameter in versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute wh
ping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cf0f5fd4-cd06-4d11-9f22-1f417b546afb?source=cve - https://plugins.trac.wordpress.org/browser/yith-woocommerce-ajax-search/trunk/includes/admin/class-yith-wcas-admin-statistic-list-table.php#L213 - https://plugins.trac.wordpress.org/changeset/3091321
CVE ID: CVE-2024-4456 State: PUBLISHED Published: 2024-05-08T00:46:31.887Z Last Updated: 2025-01-16T06:45:47.638Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: Octopus Deploy Products: Octopus Server Problem Types: Stored XSS in Audit Page Description: In affected versions of Octopus Server with certain access levels it was possible to embed a Cross-Site Scripting payload on the audit page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://advisories.octopus.com/post/2024/sa2024-04/
CVE ID: CVE-2024-4458 State: PUBLISHED Published: 2024-06-06T03:32:55.900Z Last Updated: 2024-08-01T20:40:47.195Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themesflat Products: Themesflat Addons For Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting in several widgets via URL parameters in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above,
anitization and output escaping. This makes it possible for authenticated attackers, with contributor access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f0ff03ab-eeb9-4445-92c8-326783d4b10e?source=cve - https://wordpress.org/plugins/themesflat-addons-for-elementor/
CVE ID: CVE-2024-4459 State: PUBLISHED Published: 2024-06-06T03:32:54.427Z Last Updated: 2024-08-01T20:40:47.151Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: themesflat Products: Themesflat Addons For Elementor Problem Types: CWE-87 Improper Neutralization of Alternate XSS Syntax Description: The Themesflat Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's widget's titles in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to injec
pplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ce7c2f30-188a-4ae7-976f-c7f0aaf96eee?source=cve - https://plugins.trac.wordpress.org/browser/themesflat-addons-for-elementor/trunk/widgets/widget-simple-slide.php#L1117
CVE ID: CVE-2024-4460 State: REJECTED Published: 2024-06-24T06:58:10.591Z Last Updated: 2024-07-17T11:09:48.895Z Description: No description available.
CVE ID: CVE-2024-4461 State: PUBLISHED Published: 2024-05-03T10:52:25.899Z Last Updated: 2024-08-01T20:40:47.107Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: SugarSync Products: SugarSync Problem Types: CWE-428 Description: Unquoted path or search item vulnerability in SugarSync versions prior to 4.1.3 for Windows. This misconfiguration could allow an unauthorized local user to inject arbitrary code into the unquoted service path, resulting in privilege escalation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/unquoted-path-or-search-item-vulnerability-sugarsync
CVE ID: CVE-2024-4462 State: PUBLISHED Published: 2024-06-04T05:32:17.542Z Last Updated: 2024-08-01T20:40:47.225Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: freephp-1 Products: Nafeza Prayer Time Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Nafeza Prayer Time plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts i
possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/efbf83d9-ce5e-4139-ba12-b00df4d9ad89?source=cve - https://wordpress.org/plugins/nafeza-prayer-time/
CVE ID: CVE-2024-4463 State: PUBLISHED Published: 2024-05-09T20:03:39.164Z Last Updated: 2024-08-01T20:40:47.359Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: squelch Products: Squelch Tabs and Accordions Shortcodes Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Squelch Tabs and Accordions Shortcodes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.4.7. This is due to missing or incorrect nonce validation when saving plugin settings. This makes it possible for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrato
for unauthenticated attackers to modify plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cd9490f2-ad52-477e-ae3b-be49984e8189?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3082482%40squelch-tabs-and-accordions-shortcodes%2Ftrunk&old=3067680%40squelch-tabs-and-accordions-shortcodes%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2024-4464 State: PUBLISHED Published: 2024-12-18T06:00:18.463Z Last Updated: 2024-12-18T16:21:15.401Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Synology Products: Media Server Problem Types: CWE-639 Description: Authorization bypass through user-controlled key vulnerability in streaming service in Synology Media Server before 1.4-2680, 2.0.5-3152 and 2.2.0-3325 allows remote attackers to read specific files via unspecified vectors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.synology.com/en-global/security/advisory/Synology_SA_24_28
CVE ID: CVE-2024-4465 State: PUBLISHED Published: 2024-09-11T14:45:21.671Z Last Updated: 2024-09-20T12:21:58.811Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: Nozomi Networks Products: Guardian, CMC Problem Types: CWE-863 Description: An access control vulnerability was discovered in the Reports section due to a specific access restriction not being properly enforced for users with limited privileges. If a logged-in user with reporting privileges learns how to create a specific application request, they might be able to make limited changes to the reporting configuration. This could result in a partial loss of data integrity. In Guardian/CMC instances with
s to the reporting configuration. This could result in a partial loss of data integrity. In Guardian/CMC instances with a reporting configuration, there could be limited Denial of Service (DoS) impacts, as the reports may not reach their intended destination, and there could also be limited information disclosure impacts. Furthermore, modifying the destination SMTP server for the reports could lead to the compromise of external credentials, as they might be sent to an unauthorized server. This could expand the scope of the attack. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.nozominetworks.com/NN-2024:2-01
CVE ID: CVE-2024-4466 State: PUBLISHED Published: 2024-05-03T11:44:41.270Z Last Updated: 2024-08-01T20:40:47.177Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Centros Digitales Products: Gescen Problem Types: CWE-89 Description: SQL injection vulnerability in Gescen on the centrosdigitales.net platform. This vulnerability allows an attacker to send a specially crafted SQL query to the pass parameter and retrieve all the data stored in the database. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/sql-injection-vulnerability-gescen