Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ions up to, and including, 1.1.29 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6593b0de-db7a-4b7e-bd74-cc2b1e36ac60?source=cve - https://plugins.trac.wordpress.org/browser/embedalbum-pro/trunk/embedalbum_pro.php#L194
CVE ID: CVE-2024-3985 State: PUBLISHED Published: 2024-05-02T16:51:52.006Z Last Updated: 2024-08-01T20:26:57.282Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: timstrifler Products: Exclusive Addons for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Call to Action widget in all versions up to, and including, 2.6.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with
sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/206c5736-d9d9-4029-afdf-d76251cc81ac?source=cve - https://plugins.trac.wordpress.org/changeset/3074085/exclusive-addons-for-elementor/trunk/elements/call-to-action/call-to-action.php
CVE ID: CVE-2024-3986 State: PUBLISHED Published: 2024-07-30T06:00:07.510Z Last Updated: 2025-03-13T13:42:56.632Z Vendors: Unknown Products: SportsPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The SportsPress WordPress plugin before 2.7.22 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/76c78f8e-e3da-47d9-9bf4-70e9dd125b82/
CVE ID: CVE-2024-3987 State: PUBLISHED Published: 2024-06-07T02:39:28.156Z Last Updated: 2024-08-01T20:26:57.276Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: takanakui Products: WP Mobile Menu – The Mobile-Friendly Responsive Menu Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP Mobile Menu – The Mobile-Friendly Responsive Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 2.8.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author
to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7bcbc6b6-ed05-4709-bf05-214418798339?source=cve - https://plugins.trac.wordpress.org/changeset/3097563/mobile-menu/trunk/includes/class-wp-mobile-menu-core.php
CVE ID: CVE-2024-3988 State: PUBLISHED Published: 2024-04-25T07:33:59.403Z Last Updated: 2024-08-01T20:26:57.198Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: shaonsina Products: Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Sina Extension for Elementor (Slider, Gallery, Form, Modal, Data Table, Tab, Particle, Free Elementor Widgets & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sina Fancy
ts & Elementor Templates) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Sina Fancy Text Widget in all versions up to, and including, 3.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/78b24567-c185-4bef-b025-016b091be2e4?source=cve - https://plugins.trac.wordpress.org/browser/
t-intel/vulnerabilities/id/78b24567-c185-4bef-b025-016b091be2e4?source=cve - https://plugins.trac.wordpress.org/browser/sina-extension-for-elementor/tags/3.5.1/widgets/basic/sina-fancytext.php#L475 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3076054%40sina-extension-for-elementor&new=3076054%40sina-extension-for-elementor&sfp_email=&sfph_mail=
CVE ID: CVE-2024-3989 State: PUBLISHED Published: 2024-05-09T20:03:17.834Z Last Updated: 2024-08-01T20:26:57.296Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: devitemsllc Products: HT Mega – Absolute Addons For Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Gallery Justify Widget in all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated
nsufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/03fba6bb-ff30-42bb-936b-93c009a7e3f7?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3074490%40ht-mega-for-elementor&new=3074490%40ht-mega-for-elementor&sfp_email=&sfph_mail=#file3
CVE ID: CVE-2024-3990 State: PUBLISHED Published: 2024-05-09T20:03:35.304Z Last Updated: 2024-08-01T20:26:57.250Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: devitemsllc Products: HT Mega – Absolute Addons For Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The HT Mega – Absolute Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Tooltip & Popover Widget in all versions up to, and including, 2.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attack
ient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/98e74a23-b586-4d6a-b1ab-78838b0eed61?source=cve - https://plugins.trac.wordpress.org/browser/ht-mega-for-elementor/tags/2.5.0/includes/widgets/htmega_tooltip.php#L620 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3074490%40ht-mega-for-elementor&ne
20 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3074490%40ht-mega-for-elementor&new=3074490%40ht-mega-for-elementor&sfp_email=&sfph_mail=#file4 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3074490%40ht-mega-for-elementor&new=3074490%40ht-mega-for-elementor&sfp_email=&sfph_mail=#file5
CVE ID: CVE-2024-3991 State: PUBLISHED Published: 2024-05-02T16:52:08.334Z Last Updated: 2024-08-01T20:26:57.277Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: devitemsllc Products: ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The ShopLentor – WooCommerce Builder for Elementor & Gutenberg +12 Modules – All in One Solution (formerly WooLentor) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the _id attribute in the Horizontal Product Filter in all ve
WordPress is vulnerable to Stored Cross-Site Scripting via the _id attribute in the Horizontal Product Filter in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/563d44cd-5f5a-4914-8312-c554085b0821?source=cve - https://plugins.trac.wordpress.org/changeset/3080097/woolentor-a
es/id/563d44cd-5f5a-4914-8312-c554085b0821?source=cve - https://plugins.trac.wordpress.org/changeset/3080097/woolentor-addons/trunk/includes/addons/wl_product_horizontal_filter.php
CVE ID: CVE-2024-3992 State: PUBLISHED Published: 2024-06-14T06:00:03.910Z Last Updated: 2025-03-25T17:44:12.467Z Vendors: Unknown Products: Amen Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Amen WordPress plugin through 3.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/e9fe3101-8033-4eee-8b37-06856872e9ef/
CVE ID: CVE-2024-3993 State: PUBLISHED Published: 2024-06-14T06:00:04.102Z Last Updated: 2024-08-01T20:26:57.248Z Vendors: Unknown Products: AZAN Plugin Problem Types: CWE-352 Cross-Site Request Forgery (CSRF), CWE-79 Cross-Site Scripting (XSS) Description: The AZAN Plugin WordPress plugin through 0.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/19cd60dd-8599-4af3-99db-c42de504606c/
CVE ID: CVE-2024-3994 State: PUBLISHED Published: 2024-04-25T09:29:58.460Z Last Updated: 2024-08-01T20:26:57.212Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: themeum Products: Tutor LMS – eLearning and online course solution Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'tutor_instructor_list' shortcode in all versions up to, and including, 2.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it p
including, 2.6.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/324fc401-04ca-4707-8727-b8c3a66f7fd6?source=cve - https://plugins.trac.wordpress.org/changeset/3076302/tutor/tags/2.7.0/templates/shortcode/instructor-filter.php
CVE ID: CVE-2024-3995 State: PUBLISHED Published: 2024-06-28T19:46:47.992Z Last Updated: 2024-08-01T20:26:57.268Z Vendors: Perforce Products: Helix ALM Problem Types: CWE-94 Description: In Helix ALM versions prior to 2024.2.0, a local command injection was identified. Reported by Bryan Riggins. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://portal.perforce.com/s/detail/a91PA000001SU5pYAG
CVE ID: CVE-2024-3996 State: PUBLISHED Published: 2025-05-15T20:09:44.958Z Last Updated: 2025-11-13T21:02:22.786Z Vendors: Unknown Products: Smart Post Show Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Smart Post Show WordPress plugin before 2.4.28 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4035e3f9-89fe-49e1-8aa2-55ab3f1aa528/
CVE ID: CVE-2024-3997 State: PUBLISHED Published: 2024-05-23T11:02:38.420Z Last Updated: 2024-08-09T20:12:12.220Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: bdthemes Products: Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Prime Slider – Addons For Elementor (Revolution of a slider, Hero Slider, Ecommerce Slider) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Pagepiling widget in all versions up to, and including, 3.14.1 due to insufficient input sanit
cripting via the plugin's Pagepiling widget in all versions up to, and including, 3.14.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8736fb91-d05c-4f7e-81ff-00dfa44961f5?source=cve - https://plugins.trac.wordpress.org/changeset/3074395
CVE ID: CVE-2024-3998 State: PUBLISHED Published: 2024-08-30T04:29:55.950Z Last Updated: 2024-08-30T14:06:08.815Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: MuffinGroup Products: Betheme Problem Types: CWE-79 Description: The Betheme theme for WordPress is vulnerable to Stored Cross-Site Scripting via several of the plugin's shortcodes in all versions up to, and including, 27.5.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected p
evel access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5b655b04-1f2f-4745-8237-7ef3f8e31ace?source=cve - https://themeforest.net/item/betheme-responsive-multipurpose-wordpress-theme/7758048
CVE ID: CVE-2024-3999 State: PUBLISHED Published: 2024-07-02T06:00:02.531Z Last Updated: 2024-08-01T20:26:57.231Z Vendors: Unknown Products: EazyDocs Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The EazyDocs WordPress plugin before 2.5.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wpscan.com/vulnerability/6a8a1deb-6836-40f1-856b-7b3e4ba867d6/
CVE ID: CVE-2024-40034 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T04:33:11.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userLevel_deal.php?mudi=del Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/pangchunyuhack/cms/blob/main/59/csrf.md
CVE ID: CVE-2024-40035 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T04:33:11.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userLevel_deal.php?mudi=add. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/pangchunyuhack/cms/blob/main/60/csrf.md
CVE ID: CVE-2024-40036 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T04:33:11.533Z Vendors: n/a Products: n/a Problem Types: n/a Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userGroup_deal.php?mudi=add&nohrefStr=close Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/pangchunyuhack/cms/blob/main/61/csrf.md
CVE ID: CVE-2024-40037 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T04:33:11.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userScore_deal.php?mudi=del Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/pangchunyuhack/cms/blob/main/64/csrf.md
CVE ID: CVE-2024-40038 State: PUBLISHED Published: 2024-07-09T00:00:00 Last Updated: 2024-08-02T04:33:11.637Z Vendors: n/a Products: n/a Problem Types: n/a Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userScore_deal.php?mudi=rev Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/pangchunyuhack/cms/blob/main/63/csrf.md
CVE ID: CVE-2024-40039 State: PUBLISHED Published: 2024-07-09T00:00:00.000Z Last Updated: 2025-03-13T18:02:12.605Z Vendors: n/a Products: n/a Problem Types: n/a Description: idccms v1.35 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/userGroup_deal.php?mudi=del Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/pangchunyuhack/cms/blob/main/62/csrf.md
CVE ID: CVE-2024-40051 State: PUBLISHED Published: 2024-07-22T00:00:00 Last Updated: 2024-08-16T20:36:45.382Z Vendors: n/a Products: n/a Problem Types: n/a Description: IP Guard v4.81.0307.0 was discovered to contain an arbitrary file read vulnerability via the file name parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/mrfan6/Demo/blob/main/Analysis.md
CVE ID: CVE-2024-40060 State: PUBLISHED Published: 2024-07-23T00:00:00 Last Updated: 2024-08-16T20:21:35.511Z Vendors: n/a Products: n/a Problem Types: n/a Description: go-chart v2.1.1 was discovered to contain an infinite loop via the drawCanvas() function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/F3iG0n9/4d0d7c863eea6874eeeb26a3073aa5f8
CVE ID: CVE-2024-40068 State: PUBLISHED Published: 2025-04-16T00:00:00.000Z Last Updated: 2025-04-16T20:25:48.378Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Online ID Generator System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at id_generator/admin/?page=templates/manage_template&id=1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DiliLearngent/BugReport/blob/main/php/Online-ID-Generator-System/bug5-SQL-Injection-id2.md
CVE ID: CVE-2024-40069 State: PUBLISHED Published: 2025-04-16T00:00:00.000Z Last Updated: 2025-04-17T20:26:48.212Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Online ID Generator System 1.0 was discovered to contain Stored Cross Site Scripting (XSS) via id_generator/classes/Users.php?f=save, and the point of vulnerability is in the POST parameter 'firstname' and 'lastname'. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DiliLearngent/BugReport/blob/main/php/Online-ID-Generator-System/bug7-XSS-firstname-lastname.md
CVE ID: CVE-2024-40070 State: PUBLISHED Published: 2025-04-16T00:00:00.000Z Last Updated: 2025-04-16T20:24:40.000Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Online ID Generator System 1.0 was discovered to contain an arbitrary file upload vulnerability via id_generator/classes/Users.php?f=save. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DiliLearngent/BugReport/blob/main/php/Online-ID-Generator-System/bug6-File-upload-img2.md
CVE ID: CVE-2024-40071 State: PUBLISHED Published: 2025-04-16T00:00:00.000Z Last Updated: 2025-04-22T14:39:04.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Online ID Generator System 1.0 was discovered to contain an arbitrary file upload vulnerability via id_generator/classes/SystemSettings.php?f=update_settings. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DiliLearngent/BugReport/blob/main/php/Online-ID-Generator-System/bug2-File-upload-img.md
CVE ID: CVE-2024-40072 State: PUBLISHED Published: 2025-04-16T00:00:00.000Z Last Updated: 2025-04-22T14:37:49.985Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Online ID Generator System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at id_generator/admin/?page=generate/index&id=1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DiliLearngent/BugReport/blob/main/php/Online-ID-Generator-System/bug3-SQL-Injection-id1.md
CVE ID: CVE-2024-40073 State: PUBLISHED Published: 2025-04-16T00:00:00.000Z Last Updated: 2025-04-22T14:36:37.070Z Vendors: n/a Products: n/a Problem Types: n/a Description: Sourcecodester Online ID Generator System 1.0 was discovered to contain a SQL injection vulnerability via the template parameter at id_generator/admin/?page=generate&template=4. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/DiliLearngent/BugReport/blob/main/php/Online-ID-Generator-System/bug4-SQL-Injection-template.md