Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
lo R560, AP Solo H550, AP Solo H350, AP Solo T350c, AP Solo T350d, AP Solo T350se, AP Solo R350 Problem Types: Cross-site scripting (XSS) Description: A cross-site-scripting vulnerability exists in Ruckus Access Point products (ZoneDirector, SmartZone, and AP Solo). If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is logging in the product. As for the affected products/models/versions, see the information provided by the vendor listed under [References] section or the list under [Product Status] section. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.ruckuswireless.com/securit
nalyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.ruckuswireless.com/security_bulletins/323 - https://jvn.jp/en/jp/JVN45891816/
CVE ID: CVE-2023-49226 State: PUBLISHED Published: 2023-12-25T00:00:00 Last Updated: 2024-08-02T21:53:45.624Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Peplink Balance Two before 8.4.0. Command injection in the traceroute feature of the administration console allows users with admin privileges to execute arbitrary commands as root. Additional Analyst Notes: - CVE Program Container: References: - https://www.synacktiv.com/publications%253Ffield_tags_target_id%253D4 - https://www.synacktiv.com/sites/default/files/2023-12/synacktiv-peplink-multiple-vulnerabilities.pdf
CVE ID: CVE-2023-49228 State: PUBLISHED Published: 2023-12-28T00:00:00 Last Updated: 2024-11-26T14:49:47.643Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Peplink Balance Two before 8.4.0. Console port authentication uses hard-coded credentials, which allows an attacker with physical access and sufficient knowledge to execute arbitrary commands as root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.synacktiv.com/publications%253Ffield_tags_target_id%253D4 - https://www.synacktiv.com/sites/default/files/2023-12/synacktiv-peplink-multiple-vulnerabilities.pdf
CVE ID: CVE-2023-49229 State: PUBLISHED Published: 2023-12-28T00:00:00 Last Updated: 2024-08-02T21:53:44.725Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in the administration web service allows read-only, unprivileged users to obtain sensitive information about the device configuration. Additional Analyst Notes: - CVE Program Container: References: - https://www.synacktiv.com/publications%253Ffield_tags_target_id%253D4 - https://www.synacktiv.com/sites/default/files/2023-12/synacktiv-peplink-multiple-vulnerabilities.pdf
CVE ID: CVE-2023-49230 State: PUBLISHED Published: 2023-12-28T00:00:00 Last Updated: 2024-08-02T21:53:44.631Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in captive portals allows attackers to modify the portals' configurations without prior authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.synacktiv.com/publications%253Ffield_tags_target_id%253D4 - https://www.synacktiv.com/sites/default/files/2023-12/synacktiv-peplink-multiple-vulnerabilities.pdf
CVE ID: CVE-2023-49231 State: PUBLISHED Published: 2024-03-29T00:00:00 Last Updated: 2024-10-28T16:02:26.028Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to receive an administrative API token. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.visual-planning.com/en/support-portal/updates - https://www.schutzwerk.com/advisories/SCHUTZWERK-SA-2023-003.txt - https://www.schutzwerk.com/blog/schutzwerk-sa-2023-003/ - http://seclists.org/fulldisclosure/2024/Apr/1
CVE ID: CVE-2023-49232 State: PUBLISHED Published: 2024-03-29T00:00:00.000Z Last Updated: 2025-03-25T14:41:29.207Z Vendors: n/a Products: n/a Problem Types: n/a Description: An authentication bypass vulnerability was found in Stilog Visual Planning 8. It allows an unauthenticated attacker to brute-force the password reset PINs of administrative users. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.visual-planning.com/en/support-portal/updates - https://www.schutzwerk.com/blog/schutzwerk-sa-2023-004/ - https://www.schutzwerk.com/advisories/SCHUTZWERK-SA-2023-004.txt - http://seclists.org/fulldisclosure/2024/Apr/2
CVE ID: CVE-2023-49233 State: PUBLISHED Published: 2024-09-03T00:00:00 Last Updated: 2024-10-24T19:39:47.103Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insufficient access checks in Visual Planning Admin Center 8 before v.1 Build 240207 allow attackers in possession of a non-administrative Visual Planning account to utilize functions normally reserved for administrators. The affected functions allow attackers to obtain different types of configured credentials and potentially elevate their privileges to administrator level. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.visual-planning.com/en/support-portal/updates - https://www.schutzwerk.com/b
ADP Vulnrichment: References: - https://www.visual-planning.com/en/support-portal/updates - https://www.schutzwerk.com/blog/schutzwerk-sa-2023-005/
CVE ID: CVE-2023-49234 State: PUBLISHED Published: 2024-03-29T00:00:00.000Z Last Updated: 2025-03-27T17:45:16.737Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XML external entity (XXE) vulnerability was found in Stilog Visual Planning 8. It allows an authenticated attacker to access local server files and exfiltrate data to an external server. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.visual-planning.com/en/support-portal/updates - https://www.schutzwerk.com/blog/schutzwerk-sa-2023-006/ - https://www.schutzwerk.com/advisories/SCHUTZWERK-SA-2023-006.txt - http://seclists.org/fulldisclosure/2024/Apr/3
CVE ID: CVE-2023-49235 State: PUBLISHED Published: 2024-01-09T00:00:00.000Z Last Updated: 2025-06-20T15:24:27.005Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in libremote_dbg.so on TRENDnet TV-IP1314PI 5.5.3 200714 devices. Filtering of debug information is mishandled during use of popen. Consequently, an attacker can bypass validation and execute a shell command. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1lTloBkH_7zAz1ZbFVSZnfpoPd81aPaHx/view?usp=sharing - https://github.com/pcsle37/TRENDnet/blob/main/TRENDnet_vul.pdf
CVE ID: CVE-2023-49236 State: PUBLISHED Published: 2024-01-09T00:00:00.000Z Last Updated: 2025-06-20T15:25:37.479Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stack-based buffer overflow was discovered on TRENDnet TV-IP1314PI 5.5.3 200714 devices, leading to arbitrary command execution. This occurs because of lack of length validation during an sscanf of a user-entered scale field in the RTSP playback function of davinci. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1lTloBkH_7zAz1ZbFVSZnfpoPd81aPaHx/view?usp=sharing - https://github.com/pcsle37/TRENDnet/blob/main/TRENDnet_vul.pdf
CVE ID: CVE-2023-49237 State: PUBLISHED Published: 2024-01-09T00:00:00.000Z Last Updated: 2025-06-20T15:26:23.066Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered on TRENDnet TV-IP1314PI 5.5.3 200714 devices. Command injection can occur because the system function is used by davinci to unpack language packs without strict filtering of URL strings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1lTloBkH_7zAz1ZbFVSZnfpoPd81aPaHx/view?usp=sharing - https://github.com/pcsle37/TRENDnet/blob/main/TRENDnet_vul.pdf
CVE ID: CVE-2023-49238 State: PUBLISHED Published: 2024-01-09T00:00:00.000Z Last Updated: 2025-06-17T15:26:49.999Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation (in certain installation scenarios) because of a non-unique initial system user password. Although this password must be changed upon the first login, it is possible that an attacker logs in before the legitimate administrator logs in. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.gradle.com - https://security.gradle.com/advisory/2023-01 - https://security.net
ichment: References: - https://security.gradle.com - https://security.gradle.com/advisory/2023-01 - https://security.netapp.com/advisory/ntap-20240216-0003/
CVE ID: CVE-2023-49239 State: PUBLISHED Published: 2023-12-06T09:04:40.379Z Last Updated: 2024-12-02T15:02:06.497Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: Permissions, Privileges, and Access Controls Description: Unauthorized access vulnerability in the card management module. Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2023/12/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202312-0000001758430245
CVE ID: CVE-2023-49240 State: PUBLISHED Published: 2023-12-06T09:06:04.495Z Last Updated: 2024-08-02T21:53:44.836Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-601 Description: Unauthorized access vulnerability in the launcher module. Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2023/12/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202312-0000001758430245
CVE ID: CVE-2023-49241 State: PUBLISHED Published: 2023-12-06T08:48:18.923Z Last Updated: 2024-08-02T21:53:44.730Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: Exposure of Sensitive Information to an Unauthorized Actor Description: API permission control vulnerability in the network management module. Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2023/12/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202312-0000001758430245
CVE ID: CVE-2023-49242 State: PUBLISHED Published: 2023-12-06T08:49:41.628Z Last Updated: 2024-08-02T21:53:44.730Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: Permissions, Privileges, and Access Controls Description: Free broadcast vulnerability in the running management module. Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2023/12/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202312-0000001758430245
CVE ID: CVE-2023-49243 State: PUBLISHED Published: 2023-12-06T08:56:24.442Z Last Updated: 2024-08-02T21:53:44.846Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: Permissions, Privileges, and Access Controls Description: Vulnerability of unauthorized access to email attachments in the email module. Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2023/12/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202312-0000001758430245
CVE ID: CVE-2023-49244 State: PUBLISHED Published: 2023-12-06T08:58:41.728Z Last Updated: 2024-08-02T21:53:45.420Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: Improper Access Control Description: Permission management vulnerability in the multi-user module. Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2023/12/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202312-0000001758430245
CVE ID: CVE-2023-49245 State: PUBLISHED Published: 2023-12-06T09:00:03.721Z Last Updated: 2024-08-02T21:53:45.183Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: Permissions, Privileges, and Access Controls Description: Unauthorized access vulnerability in the Huawei Share module. Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2023/12/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202312-0000001758430245
CVE ID: CVE-2023-49246 State: PUBLISHED Published: 2023-12-06T09:01:24.648Z Last Updated: 2025-05-28T15:46:45.470Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: Permissions, Privileges, and Access Controls Description: Unauthorized access vulnerability in the card management module. Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://consumer.huawei.com/en/support/bulletin/2023/12/ - https://https://device.harmonyos.com/en/docs/security/update/security-bulletins-202312-0000001758430245
CVE ID: CVE-2023-49247 State: PUBLISHED Published: 2023-12-06T08:32:36.621Z Last Updated: 2024-08-02T21:53:45.371Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-295 Description: Permission verification vulnerability in distributed scenarios. Successful exploitation of this vulnerability may affect service confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2023/12/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202312-0000001758430245
CVE ID: CVE-2023-49248 State: PUBLISHED Published: 2023-12-06T08:34:22.774Z Last Updated: 2024-08-02T21:53:44.995Z Vendors: Huawei Products: HarmonyOS, EMUI Problem Types: CWE-20 Description: Vulnerability of unauthorized file access in the Settings app. Successful exploitation of this vulnerability may cause unauthorized file access. Additional Analyst Notes: - CVE Program Container: References: - https://consumer.huawei.com/en/support/bulletin/2023/12/ - https://device.harmonyos.com/en/docs/security/update/security-bulletins-202312-0000001758430245
CVE ID: CVE-2023-49250 State: PUBLISHED Published: 2024-02-20T10:00:06.733Z Last Updated: 2025-02-13T17:18:36.587Z Vendors: Apache Software Foundation Products: Apache DolphinScheduler Problem Types: CWE-295 Description: Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server. This issue affects Apache DolphinScheduler: before 3.2.0. Users are recommended to upgrade to version 3.2.1, which fixes the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/dolphinscheduler/pull/15288 - https://lists.apach
iner: - CISA ADP Vulnrichment: References: - https://github.com/apache/dolphinscheduler/pull/15288 - https://lists.apache.org/thread/wgs2jvhbmq8xnd6rmg0ymz73nyj7b3qn - http://www.openwall.com/lists/oss-security/2024/02/20/1
CVE ID: CVE-2023-49251 State: PUBLISHED Published: 2024-01-09T10:00:08.834Z Last Updated: 2024-11-14T15:13:08.903Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC CN 4100 Problem Types: CWE-639 Description: A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The "intermediate installation" system state of the affected application allows an attacker to add their own login credentials to the device. This allows an attacker to remotely login as root and take control of the device even after the affected device is fully set up. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichme
even after the affected device is fully set up. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-777015.pdf
CVE ID: CVE-2023-49252 State: PUBLISHED Published: 2024-01-09T10:00:10.226Z Last Updated: 2025-06-17T20:39:17.291Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC CN 4100 Problem Types: CWE-20 Description: A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7). The affected application allows IP configuration change without authentication to the device. This could allow an attacker to cause denial of service condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-777015.pdf
CVE ID: CVE-2023-49253 State: PUBLISHED Published: 2024-01-12T14:23:26.923Z Last Updated: 2025-06-20T16:39:18.776Z Vendors: Hongdian Products: H8951-4G-ESP Problem Types: CWE-798 Description: Root user password is hardcoded into the device and cannot be changed in the user interface. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2024/01/CVE-2023-49253/ - https://cert.pl/posts/2024/01/CVE-2023-49253/
CVE ID: CVE-2023-49254 State: PUBLISHED Published: 2024-01-12T14:23:41.508Z Last Updated: 2025-06-20T16:40:13.313Z Vendors: Hongdian Products: H8951-4G-ESP Problem Types: CWE-78 Description: Authenticated user can execute arbitrary commands in the context of the root user by providing payload in the "destination" field of the network test tools. This is similar to the vulnerability CVE-2021-28151 mitigated on the user interface level by blacklisting characters with JavaScript, however, it can still be exploited by sending POST requests directly. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2024/01/CVE-2023-49253/ - https:/
CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2024/01/CVE-2023-49253/ - https://cert.pl/posts/2024/01/CVE-2023-49253/
CVE ID: CVE-2023-49255 State: PUBLISHED Published: 2024-01-12T14:23:53.922Z Last Updated: 2025-06-03T14:05:17.122Z Vendors: Hongdian Products: H8951-4G-ESP Problem Types: CWE-306 Description: The router console is accessible without authentication at "data" field, and while a user needs to be logged in in order to modify the configuration, the session state is shared. If any other user is currently logged in, the anonymous user can execute commands in the context of the authenticated one. If the logged in user has administrative privileges, it is possible to use webadmin service configuration commands to create a new admin user with a chosen password. Additional Analyst Notes: - CVE Program
rvice configuration commands to create a new admin user with a chosen password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2024/01/CVE-2023-49253/ - https://cert.pl/posts/2024/01/CVE-2023-49253/
CVE ID: CVE-2023-49256 State: PUBLISHED Published: 2024-01-12T14:24:20.325Z Last Updated: 2025-06-20T16:40:49.793Z Vendors: Hongdian Products: H8951-4G-ESP Problem Types: CWE-321 Description: It is possible to download the configuration backup without authorization and decrypt included passwords using hardcoded static key. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2024/01/CVE-2023-49253/ - https://cert.pl/posts/2024/01/CVE-2023-49253/
CVE ID: CVE-2023-49257 State: PUBLISHED Published: 2024-01-12T14:24:32.311Z Last Updated: 2025-06-11T17:01:32.389Z Vendors: Hongdian Products: H8951-4G-ESP Problem Types: CWE-732 Description: An authenticated user is able to upload an arbitrary CGI-compatible file using the certificate upload utility and execute it with the root user privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2024/01/CVE-2023-49253/ - https://cert.pl/posts/2024/01/CVE-2023-49253/
CVE ID: CVE-2023-49258 State: PUBLISHED Published: 2024-01-12T14:24:57.134Z Last Updated: 2025-06-03T14:05:11.166Z Vendors: Hongdian Products: H8951-4G-ESP Problem Types: CWE-79 Description: User browser may be forced to execute JavaScript and pass the authentication cookie to the attacker leveraging the XSS vulnerability located at "/gui/terminal_tool.cgi" in the "data" parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2024/01/CVE-2023-49253/ - https://cert.pl/posts/2024/01/CVE-2023-49253/
CVE ID: CVE-2023-49259 State: PUBLISHED Published: 2024-01-12T14:25:12.037Z Last Updated: 2025-06-20T16:41:23.905Z Vendors: Hongdian Products: H8951-4G-ESP Problem Types: CWE-341 Description: The authentication cookies are generated using an algorithm based on the username, hardcoded secret and the up-time, and can be guessed in a reasonable time. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2024/01/CVE-2023-49253/ - https://cert.pl/posts/2024/01/CVE-2023-49253/
CVE ID: CVE-2023-49260 State: PUBLISHED Published: 2024-01-12T14:25:17.934Z Last Updated: 2025-06-03T14:05:05.756Z Vendors: Hongdian Products: H8951-4G-ESP Problem Types: CWE-79 Description: An XSS attack can be performed by changing the MOTD banner and pointing the victim to the "terminal_tool.cgi" path. It can be used together with the vulnerability CVE-2023-49255. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2024/01/CVE-2023-49253/ - https://cert.pl/posts/2024/01/CVE-2023-49253/
CVE ID: CVE-2023-49261 State: PUBLISHED Published: 2024-01-12T14:25:26.606Z Last Updated: 2024-10-10T15:36:06.457Z Vendors: Hongdian Products: H8951-4G-ESP Problem Types: CWE-201 Description: The "tokenKey" value used in user authorization is visible in the HTML source of the login page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2024/01/CVE-2023-49253/ - https://cert.pl/posts/2024/01/CVE-2023-49253/
CVE ID: CVE-2023-49262 State: PUBLISHED Published: 2024-01-12T14:25:36.654Z Last Updated: 2025-06-03T14:04:54.692Z Vendors: Hongdian Products: H8951-4G-ESP Problem Types: CWE-190 Description: The authentication mechanism can be bypassed by overflowing the value of the Cookie "authentication" field, provided there is an active user session. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.pl/en/posts/2024/01/CVE-2023-49253/ - https://cert.pl/posts/2024/01/CVE-2023-49253/
CVE ID: CVE-2023-49269 State: PUBLISHED Published: 2023-12-20T17:41:53.093Z Last Updated: 2025-05-19T14:46:06.910Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Kashipara Group Products: Hotel Management Problem Types: CWE-79 Description: Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The 'adults' parameter of the reservation.php resource is copied into the HTML document as plain text between tags. Any input is echoed unmodified in the application's response. Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/lang/ - https://www.kashipara.com/