Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-10046 State: PUBLISHED Published: 2025-09-06T06:43:00.275Z Last Updated: 2025-09-08T14:53:11.179Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: elextensions Products: ELEX WooCommerce Google Shopping (Google Product Feed) Problem Types: CWE-89 Description: The ELEX WooCommerce Google Shopping (Google Product Feed) plugin for WordPress is vulnerable to SQL Injection via the 'file_to_delete' parameter in all versions up to, and including, 1.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level a
nt preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0afe37bb-fa8a-4e7b-93c6-c44b3fbeb904?source=cve - https://plugins.svn.wordpress.org/elex-woocommerce-google-product-feed-plugin-basic/tags/1.4.3/includes/elex-manage-feed-ajax.php#29 - https://plugins.trac.wordpress.org/changeset/3342699/elex-woocommerce-google-product-feed-plugin-basic/tags/1.4.4/includes/
ps://plugins.trac.wordpress.org/changeset/3342699/elex-woocommerce-google-product-feed-plugin-basic/tags/1.4.4/includes/elex-manage-feed-ajax.php
CVE ID: CVE-2025-10047 State: PUBLISHED Published: 2025-10-22T08:27:11.796Z Last Updated: 2025-10-22T20:35:31.715Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: pmbaldha Products: Email Tracker – Email Log, Email Open Tracking, Email Analytics & Email Management for WordPress Emails Problem Types: CWE-89 Description: The Email Tracker – Email Log, Email Open Tracking, Email Analytics & Email Management for WordPress Emails plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter in all versions up to, and including, 5.3.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing S
5.3.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ec4be524-a763-4f2b-8a1d-6189014b4d86?source=cve - https://plugins.svn.wordpress.org/email-tracker/trunk/src/admin/email-list/class-table.php%3A439
CVE ID: CVE-2025-10048 State: PUBLISHED Published: 2025-10-11T07:25:57.688Z Last Updated: 2025-10-14T14:12:07.777Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: wphocus Products: My auctions allegro Problem Types: CWE-89 Description: The My auctions allegro plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter in all versions up to, and including, 3.6.31 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries tha
attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8d81c8d5-3862-4401-9226-9c7380f364a7?source=cve - https://plugins.trac.wordpress.org/changeset/3375019/my-auctions-allegro-free-edition
CVE ID: CVE-2025-10049 State: PUBLISHED Published: 2025-09-10T06:38:44.763Z Last Updated: 2025-09-10T16:10:45.086Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: nik00726 Products: Responsive Filterable Portfolio Problem Types: CWE-434 Description: The Responsive Filterable Portfolio plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the HdnMediaSelection_image field in all versions up to, and including, 1.0.24. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Add
ss and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/017f5894-be0d-4b0f-82bd-13bf7e2ff53f?source=cve - https://plugins.trac.wordpress.org/changeset?old_path=/responsive-filterable-portfolio/tags/1.0.24&new_path=/responsive-filterable-portfolio/tags/1.0.25&sfp_email=&sfph_mail=
CVE ID: CVE-2025-10050 State: PUBLISHED Published: 2025-09-17T01:49:16.544Z Last Updated: 2025-09-17T13:10:31.308Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: eskapism Products: Developer Loggers for Simple History Problem Types: CWE-22 Description: The Developer Loggers for Simple History plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 0.5 via the enabled_loggers parameter. This makes it possible for authenticated attackers, with Administrator-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass
te arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b2ea3a9e-2a9a-4628-8ea1-e18e756f915f?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3361543%40developer-loggers-for-simple-history&new=3361543%40developer-loggers-for-simple-history&sfp_email=&sfph_mail=
CVE ID: CVE-2025-10051 State: PUBLISHED Published: 2025-10-15T08:25:54.412Z Last Updated: 2025-10-15T19:45:51.492Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: themeinwp Products: Demo Import Kit Problem Types: CWE-434 Description: The Demo Import Kit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.1.0 via the import functionality. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnric
n the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/465f2fd1-9eb3-43ca-8acc-74acf6bcde1a?source=cve - https://wordpress.org/plugins/demo-import-kit/
CVE ID: CVE-2025-10053 State: PUBLISHED Published: 2025-10-03T11:17:15.574Z Last Updated: 2025-10-03T18:12:21.209Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: exlac Products: TableGen – Data Table Generator Problem Types: CWE-79 Description: The TableGen – Data Table Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected
l permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8bea21d9-26d1-49a5-a130-26d99818d4d3?source=cve - https://wordpress.org/plugins/table-creator/
CVE ID: CVE-2025-10054 State: PUBLISHED Published: 2025-11-21T12:28:07.818Z Last Updated: 2025-11-21T17:44:39.824Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: elextensions Products: ELEX WordPress HelpDesk & Customer Ticketing System Problem Types: CWE-862 Description: The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'eh_crm_remove_agent' function in all versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to remove the role and capabilities of any user with an
authenticated attackers, with Subscriber-level access and above, to remove the role and capabilities of any user with an Administrator, WSDesk Supervisor, or WSDesk Agents role. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/07c92f79-94ac-4153-9ab2-9608601508b0?source=cve - https://plugins.trac.wordpress.org/browser/elex-helpdesk-customer-support-ticket-system/trunk/includes/class-crm-ajax-functions-two.php#L77 - https://plugins.trac.wordpress.org/changeset/3399391/
CVE ID: CVE-2025-10056 State: PUBLISHED Published: 2025-10-15T08:26:03.649Z Last Updated: 2025-10-15T13:49:14.458Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: miunosoft Products: Task Scheduler Problem Types: CWE-918 Description: The Task Scheduler plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.3 via the “Check Website” task. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. Additional Analyst Notes:
om the web application and can be used to query and modify information from internal services. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d5211437-9c6d-435f-a7f2-17ed754d0fab?source=cve - https://wordpress.org/plugins/task-scheduler/
CVE ID: CVE-2025-10057 State: PUBLISHED Published: 2025-09-17T05:18:45.276Z Last Updated: 2025-09-17T12:49:25.672Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: smackcoders Products: WP Import – Ultimate CSV XML Importer for WordPress Problem Types: CWE-94 Description: The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 7.28. This is due to the write_to_customfile() function writing unfiltered PHP code to a file. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject the customFunction.php file with PHP code tha
authenticated attackers, with Subscriber-level access and above, to inject the customFunction.php file with PHP code that can be accessed to trigger remote code execution. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/925af22b-a728-496e-a63a-5966347ebe6c?source=cve - https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/tags/7.25/importExtensions/ImportHelpers.php#L585 - https://plugins.trac.wordpress.org/changeset/3360428/wp-ultimate-csv-importer/trunk/uploadModules/DesktopUpload.php - https://plugins.trac.wordpress.org/changeset/3360428/wp-ultimate-csv-importer/trunk/importExtensions/ImportHelpers.ph
- https://plugins.trac.wordpress.org/changeset/3360428/wp-ultimate-csv-importer/trunk/importExtensions/ImportHelpers.php
CVE ID: CVE-2025-10058 State: PUBLISHED Published: 2025-09-17T05:18:44.816Z Last Updated: 2025-09-17T12:48:43.552Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: smackcoders Products: WP Import – Ultimate CSV XML Importer for WordPress Problem Types: CWE-73 Description: The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the upload_function() function in all versions up to, and including, 7.27. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to r
d attackers, with Subscriber-level access and above, to delete arbitrary files on the server, which can easily lead to remote code execution when the right file is deleted (such as wp-config.php). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5a6bcfa6-7a40-4566-b4d2-62b696ded2d6?source=cve - https://plugins.trac.wordpress.org/browser/wp-ultimate-csv-importer/tags/7.26/uploadModules/FtpUpload.php#L200 - https://plugins.trac.wordpress.org/changeset/3360611/ - https://plugins.trac.wordpress.org/changeset/3357936/wp-ultimate-csv-importer/trunk/uploadModules/FtpUpload.php
CVE ID: CVE-2025-10059 State: PUBLISHED Published: 2025-09-05T20:26:52.612Z Last Updated: 2025-09-05T20:44:22.665Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: MongoDB Inc Products: MongoDB Server Problem Types: CWE-732 Description: An improper setting of the lsid field on any sharded query can cause a crash in MongoDB routers. This issue occurs when a generic argument (lsid) is provided in a case when it is not applicable. This affects MongoDB Server v6.0 versions prior to 6.0.x, MongoDB Server v7.0 versions prior to 7.0.18 and MongoDB Server v8.0 versions prior to 8.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.mongo
Server v8.0 versions prior to 8.0.6. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/SERVER-100901 - https://jira.mongodb.org/browse/SERVER-100909
CVE ID: CVE-2025-10060 State: PUBLISHED Published: 2025-09-05T20:39:14.188Z Last Updated: 2025-09-05T21:08:05.687Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: MongoDB Inc Products: MongoDB Server Problem Types: CWE-672 Description: MongoDB Server may allow upsert operations retried within a transaction to violate unique index constraints, potentially causing an invariant failure and server crash during commit. This issue may be triggered by improper WriteUnitOfWork state management. This issue affects MongoDB Server v6.0 versions prior to 6.0.25, MongoDB Server v7.0 versions prior to 7.0.22 and MongoDB Server v8.0 versions prior to 8.0.12 Additional Anal
to 6.0.25, MongoDB Server v7.0 versions prior to 7.0.22 and MongoDB Server v8.0 versions prior to 8.0.12 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/SERVER-95524
CVE ID: CVE-2025-10061 State: PUBLISHED Published: 2025-09-05T20:48:25.215Z Last Updated: 2025-09-05T21:08:44.186Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: MongoDB Inc Products: MongoDB Server Problem Types: CWE-20 Description: An authorized user can cause a crash in the MongoDB Server through a specially crafted $group query. This vulnerability is related to the incorrect handling of certain accumulator functions when additional parameters are specified within the $group operation. This vulnerability could lead to denial of service if triggered repeatedly. This issue affects MongoDB Server v6.0 versions prior to 6.0.25, MongoDB Server v7.0 versions p
if triggered repeatedly. This issue affects MongoDB Server v6.0 versions prior to 6.0.25, MongoDB Server v7.0 versions prior to 7.0.22, MongoDB Server v8.0 versions prior to 8.0.12 and MongoDB Server v8.1 versions prior to 8.1.2 Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://jira.mongodb.org/browse/SERVER-99616
CVE ID: CVE-2025-10062 State: PUBLISHED Published: 2025-09-06T22:32:06.241Z Last Updated: 2025-09-08T14:33:58.040Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Student Information Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability was determined in itsourcecode Student Information Management System 1.0. This affects an unknown part of the file /admin/login.php. Executing manipulation of the argument uname can lead to sql injection. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/
licly disclosed and may be utilized. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322985 - https://vuldb.com/?ctiid.322985 - https://vuldb.com/?submit.641752 - https://github.com/hjsjbsg/record-for-own/issues/3 - https://itsourcecode.com/
CVE ID: CVE-2025-10063 State: PUBLISHED Published: 2025-09-06T23:02:07.868Z Last Updated: 2025-09-08T14:27:31.552Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: POS Point of Sale System Problem Types: CWE-79, CWE-94 Description: A vulnerability was identified in itsourcecode POS Point of Sale System 1.0. This vulnerability affects unknown code of the file /inventory/main/vendors/datatables/unit_testing/templates/deferred_table.php. The manipulation of the argument scripts leads to cross site scripting. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP V
n of the attack is possible. The exploit is publicly available and might be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322986 - https://vuldb.com/?ctiid.322986 - https://vuldb.com/?submit.643945 - https://github.com/AlphabugX/CVE-Report/blob/main/CVE-007.md - https://itsourcecode.com/
CVE ID: CVE-2025-10064 State: PUBLISHED Published: 2025-09-07T00:02:05.977Z Last Updated: 2025-09-08T14:01:59.963Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: POS Point of Sale System Problem Types: CWE-79, CWE-94 Description: A security flaw has been discovered in itsourcecode POS Point of Sale System 1.0. This issue affects some unknown processing of the file /inventory/main/vendors/datatables/unit_testing/templates/dom_data_two_headers.php. The manipulation of the argument scripts results in cross site scripting. The attack can be executed remotely. The exploit has been released to the public and may be exploited. Additional Analyst
e attack can be executed remotely. The exploit has been released to the public and may be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322987 - https://vuldb.com/?ctiid.322987 - https://vuldb.com/?submit.643946 - https://github.com/AlphabugX/CVE-Report/blob/main/CVE-008.md - https://itsourcecode.com/
CVE ID: CVE-2025-10065 State: PUBLISHED Published: 2025-09-07T00:32:06.963Z Last Updated: 2025-09-08T13:12:16.432Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: POS Point of Sale System Problem Types: CWE-79, CWE-94 Description: A weakness has been identified in itsourcecode POS Point of Sale System 1.0. Impacted is an unknown function of the file /inventory/main/vendors/datatables/unit_testing/templates/dom_data_th.php. This manipulation of the argument scripts causes cross site scripting. The attack is possible to be carried out remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes:
arried out remotely. The exploit has been made available to the public and could be exploited. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322988 - https://vuldb.com/?ctiid.322988 - https://vuldb.com/?submit.643947 - https://github.com/AlphabugX/CVE-Report/blob/main/CVE-009.md - https://itsourcecode.com/
CVE ID: CVE-2025-10066 State: PUBLISHED Published: 2025-09-07T01:02:07.393Z Last Updated: 2025-09-08T17:48:48.526Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: POS Point of Sale System Problem Types: CWE-79, CWE-94 Description: A security vulnerability has been detected in itsourcecode POS Point of Sale System 1.0. The affected element is an unknown function of the file /inventory/main/vendors/datatables/unit_testing/templates/dymanic_table.php. Such manipulation of the argument scripts leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Additional Analyst Notes
e attack may be performed from remote. The exploit has been disclosed publicly and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322989 - https://vuldb.com/?ctiid.322989 - https://vuldb.com/?submit.643948 - https://github.com/AlphabugX/CVE-Report/blob/main/CVE-010.md - https://itsourcecode.com/
CVE ID: CVE-2025-10067 State: PUBLISHED Published: 2025-09-07T01:32:06.941Z Last Updated: 2025-09-08T17:44:26.640Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: POS Point of Sale System Problem Types: CWE-79, CWE-94 Description: A vulnerability was detected in itsourcecode POS Point of Sale System 1.0. The impacted element is an unknown function of the file /inventory/main/vendors/datatables/unit_testing/templates/empty_table.php. Performing manipulation of the argument scripts results in cross site scripting. It is possible to initiate the attack remotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vu
ible to initiate the attack remotely. The exploit is now public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322990 - https://vuldb.com/?ctiid.322990 - https://vuldb.com/?submit.643955 - https://github.com/AlphabugX/CVE-Report/blob/main/CVE-011.md - https://itsourcecode.com/
CVE ID: CVE-2025-10068 State: PUBLISHED Published: 2025-09-07T04:32:06.674Z Last Updated: 2025-09-08T17:38:16.892Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR) Vendors: itsourcecode Products: Online Discussion Forum Problem Types: CWE-89, CWE-74 Description: A flaw has been found in itsourcecode Online Discussion Forum 1.0. This affects an unknown function of the file /admin/admin_forum/add_views.php. Executing manipulation of the argument ID can lead to sql injection. It is possible to launch the attack remotely. The exploit has been published and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322991 - https://vul
may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.322991 - https://vuldb.com/?ctiid.322991 - https://vuldb.com/?submit.644077 - https://github.com/JunGu-W/cve/issues/13 - https://itsourcecode.com/