Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-50697 State: PUBLISHED Published: 2025-01-24T00:00:00.000Z Last Updated: 2025-01-27T15:37:57.414Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SunGrow WiNet-SV200.001.00.P027 and earlier versions, when decrypting MQTT messages, the code that parses specific TLV fields does not have sufficient bounds checks. This may result in a stack-based buffer overflow. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://en.sungrowpower.com/security-notice-detail-2/5961
CVE ID: CVE-2024-50698 State: PUBLISHED Published: 2025-01-24T00:00:00.000Z Last Updated: 2025-09-15T15:35:57.908Z Vendors: n/a Products: n/a Problem Types: n/a Description: SunGrow WiNet-SV200.001.00.P027 and earlier versions is vulnerable to heap-based buffer overflow due to bounds checks of the MQTT message content. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://en.sungrowpower.com/security-notice-detail-2/5961
CVE ID: CVE-2024-50699 State: PUBLISHED Published: 2024-12-10T00:00:00 Last Updated: 2024-12-11T15:19:05.370Z Vendors: n/a Products: n/a Problem Types: n/a Description: TP-Link TL-WR845N(UN)_V4_201214, TL-WR845N(UN)_V4_200909 and TL-WR845N(UN)_V4_190219 were discovered to contain weak default credentials for the Administrator account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.iiita.ac.in/iot/password-reset-missing-tplink.pdf
CVE ID: CVE-2024-50701 State: PUBLISHED Published: 2024-12-30T00:00:00 Last Updated: 2024-12-30T16:58:19.828Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: TeamPass Products: TeamPass Problem Types: CWE-266 Description: TeamPass before 3.1.3.1, when retrieving information about access rights for a folder, does not properly check whether a folder is in a user's allowed folders list that has been defined by an admin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nilsteampassnet/TeamPass/compare/3.1.3...3.1.3.1 - https://github.com/nilsteampassnet/TeamPass/compare/3.1.2...3.1.3.1 - https://github.com/nilsteampassnet/TeamP
3.1.3.1 - https://github.com/nilsteampassnet/TeamPass/compare/3.1.2...3.1.3.1 - https://github.com/nilsteampassnet/TeamPass/commit/ddbb2d3d94085dced50c4936fd2215af88e4a88d
CVE ID: CVE-2024-50702 State: PUBLISHED Published: 2024-12-30T00:00:00 Last Updated: 2024-12-30T16:53:18.734Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: TeamPass Products: TeamPass Problem Types: CWE-266 Description: TeamPass before 3.1.3.1 does not properly check whether a mail_me (aka action_mail) operation is on behalf of an administrator or manager. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nilsteampassnet/TeamPass/compare/3.1.3...3.1.3.1 - https://github.com/nilsteampassnet/TeamPass/compare/3.1.2...3.1.3.1 - https://github.com/nilsteampassnet/TeamPass/commit/35e2b479f2379545b4132bc30a9d052ba7018bf9
CVE ID: CVE-2024-50703 State: PUBLISHED Published: 2024-12-30T00:00:00 Last Updated: 2024-12-30T16:41:33.523Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: TeamPass Products: TeamPass Problem Types: CWE-472 Description: TeamPass before 3.1.3.1 does not properly prevent a user from acting with the privileges of a different user_id. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/nilsteampassnet/TeamPass/compare/3.1.3...3.1.3.1 - https://github.com/nilsteampassnet/TeamPass/compare/3.1.2...3.1.3.1 - https://github.com/nilsteampassnet/TeamPass/commit/c7f7f809071eaa9e04505ee79cec7049a42959e9
CVE ID: CVE-2024-50704 State: PUBLISHED Published: 2025-03-04T00:00:00.000Z Last Updated: 2025-03-04T16:28:30.492Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code via a specially crafted HTTP POST request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://uniguest.com/cve-bulletins/ - https://uniguest.com/wp-content/uploads/2025/02/CVE-2024-50704-Vulnerability-Summary.pdf
CVE ID: CVE-2024-50705 State: PUBLISHED Published: 2025-03-04T00:00:00.000Z Last Updated: 2025-03-04T16:32:08.007Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unauthenticated reflected cross-site scripting (XSS) vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary scripts via the page parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://uniguest.com/cve-bulletins/ - https://uniguest.com/wp-content/uploads/2025/02/CVE-2024-50705-Vulnerability-Summary.pdf
CVE ID: CVE-2024-50706 State: PUBLISHED Published: 2025-03-04T00:00:00.000Z Last Updated: 2025-04-22T15:43:42.225Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unauthenticated SQL injection vulnerability in Uniguest Tripleplay version 23.1+ allows remote attackers to execute arbitrary SQL queries on the backend database. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://uniguest.com/cve-bulletins/ - https://uniguest.com/wp-content/uploads/2025/02/CVE-2024-50706-Vulnerability-Summary.pdf
CVE ID: CVE-2024-50707 State: PUBLISHED Published: 2025-03-04T00:00:00.000Z Last Updated: 2025-03-04T16:26:52.063Z Vendors: n/a Products: n/a Problem Types: n/a Description: Unauthenticated remote code execution vulnerability in Uniguest Tripleplay before 24.2.1 allows remote attackers to execute arbitrary code via the X-Forwarded-For header in an HTTP GET request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://uniguest.com/cve-bulletins/ - https://uniguest.com/wp-content/uploads/2025/02/CVE-2024-50707-Vulnerability-Summary.pdf
CVE ID: CVE-2024-50713 State: PUBLISHED Published: 2024-12-27T00:00:00 Last Updated: 2024-12-31T18:24:11.326Z Vendors: n/a Products: n/a Problem Types: n/a Description: SmartAgent v1.1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /tests/interface.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://smarts-srl.com - https://packetstorm.news/files/id/182449/
CVE ID: CVE-2024-50714 State: PUBLISHED Published: 2024-12-27T00:00:00 Last Updated: 2024-12-28T18:00:48.978Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Server-Side Request Forgery (SSRF) in smarts-srl.com Smart Agent v.1.1.0 allows a remote attacker to obtain sensitive information via a crafted script to the /FB/getFbVideoSource.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://smarts-srl.com - https://packetstorm.news/files/id/182450/
CVE ID: CVE-2024-50715 State: PUBLISHED Published: 2024-12-27T00:00:00 Last Updated: 2024-12-28T18:05:08.217Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in smarts-srl.com Smart Agent v.1.1.0 allows a remote attacker to obtain sensitive information via command injection through a vulnerable unsanitized parameter defined in the /youtubeInfo.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://smarts-srl.com - https://packetstorm.news/files/id/182451/
CVE ID: CVE-2024-50716 State: PUBLISHED Published: 2024-12-27T00:00:00 Last Updated: 2024-12-28T18:09:07.685Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Smart Agent v.1.1.0 allows a remote attacker to execute arbitrary code via the id parameter in the /sendPushManually.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://smarts-srl.com - https://packetstorm.news/files/id/182449/
CVE ID: CVE-2024-50717 State: PUBLISHED Published: 2024-12-27T00:00:00 Last Updated: 2024-12-28T18:07:06.870Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Smart Agent v.1.1.0 allows a remote attacker to execute arbitrary code via the client parameter in the /recuperaLog.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://smarts-srl.com - https://packetstorm.news/files/id/182449/
CVE ID: CVE-2024-50724 State: PUBLISHED Published: 2024-11-15T00:00:00 Last Updated: 2024-12-03T16:48:54.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: KASO v9.0 was discovered to contain a SQL injection vulnerability via the person_id parameter at /cardcase/editcard.jsp. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/youyuzhongli/KASO-SQL/blob/main/README.md
CVE ID: CVE-2024-50766 State: PUBLISHED Published: 2024-11-07T00:00:00 Last Updated: 2024-11-08T16:35:34.699Z Vendors: n/a Products: n/a Problem Types: n/a Description: SourceCodester Survey Application System 1.0 is vulnerable to SQL Injection in takeSurvey.php via the id parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://medium.com/%40luisgerardomoret_69654/sql-injection-in-survey-application-system-cve-2024-50766-8ed81426ca6e
CVE ID: CVE-2024-50800 State: PUBLISHED Published: 2024-11-15T00:00:00 Last Updated: 2024-11-15T18:55:58.987Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in M2000 Smart4Web before v.5.020241004 allows a remote attacker to execute arbitrary code via the error parameter in URL Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Jellyfishxoxo/vulnerability-research/tree/main/CVE-2024-50800
CVE ID: CVE-2024-50801 State: PUBLISHED Published: 2024-10-31T00:00:00 Last Updated: 2024-11-04T18:46:46.125Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was discovered in AbanteCart 1.4.0 in the update() function in public_html/admin/controller/responses/listing_grid/collections.php. The vulnerability is exploitable via the id parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/abantecart/abantecart-src - https://chiggerlor.substack.com/p/cve-2024-50801-and-and-cve-2024-50802
CVE ID: CVE-2024-50802 State: PUBLISHED Published: 2024-10-31T00:00:00 Last Updated: 2024-11-04T18:47:48.667Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was discovered in AbanteCart 1.4.0 in the update() function in public_html/admin/controller/responses/listing_grid/email_templates.php. The vulnerability is exploitable via the id parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/abantecart/abantecart-src - https://chiggerlor.substack.com/p/cve-2024-50801-and-and-cve-2024-50802
CVE ID: CVE-2024-50803 State: PUBLISHED Published: 2024-11-19T00:00:00 Last Updated: 2024-11-20T20:57:53.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site Scripting(XSS) which allows a remote attacker to escalate privileges Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://redaxo-core.com - http://redaxo.com - https://github.com/Praison001/CVE-2024-50803-Redaxo
CVE ID: CVE-2024-50804 State: PUBLISHED Published: 2024-11-18T00:00:00 Last Updated: 2024-11-19T15:12:26.464Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure Permissions vulnerability in Micro-star International MSI Center Pro 2.1.37.0 allows a local attacker to execute arbitrary code via the Device_DeviceID.dat.bak file within the C:\ProgramData\MSI\One Dragon Center\Data folder Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://g3tsyst3m.github.io/cve/msi/Arbitrary-Write-Privilege-Escalation-CVE-2024-50804/
CVE ID: CVE-2024-50807 State: PUBLISHED Published: 2025-01-10T00:00:00.000Z Last Updated: 2025-04-16T20:45:08.070Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trippo Responsive Filemanager 9.14.0 is vulnerable to Cross Site Scripting (XSS) via file upload using the svg and pdf extensions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gist.github.com/HackShiv/4254db89214913867aa8dd5c1ec09b7e - https://gist.github.com/SecShiv/4254db89214913867aa8dd5c1ec09b7e - https://github.com/SecShiv/CVE/blob/main/CVE-2024-50807.md
CVE ID: CVE-2024-50808 State: PUBLISHED Published: 2024-11-08T00:00:00.000Z Last Updated: 2025-03-13T17:45:40.060Z Vendors: n/a Products: n/a Problem Types: n/a Description: SeaCms 13.1 is vulnerable to code injection in the notification module of the member message notification module in the backend user module, due to unsafe handling of the "notify" variable in admin_notify.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://seacms.com - https://github.com/v9d0g/CVEs/blob/main/CVE-2024-50808.md
CVE ID: CVE-2024-50809 State: PUBLISHED Published: 2024-11-08T00:00:00 Last Updated: 2024-11-18T14:08:26.817Z Vendors: n/a Products: n/a Problem Types: n/a Description: The theme.php file in SDCMS 2.8 has a command execution vulnerability that allows for the execution of system commands Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/v9d0g/CVEs/blob/main/CVE-2024-50809.md
CVE ID: CVE-2024-50810 State: PUBLISHED Published: 2024-11-08T00:00:00 Last Updated: 2024-11-20T23:02:23.484Z Vendors: n/a Products: n/a Problem Types: n/a Description: hopetree izone lts c011b48 contains a Cross Site Scripting (XSS) vulnerability in the article comment function. In \apps\comment\views.py, AddCommintView() does not securely filter user input and renders it directly to the frontend page through templates. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Hopetree/izone/issues/289
CVE ID: CVE-2024-50811 State: PUBLISHED Published: 2024-11-08T00:00:00 Last Updated: 2024-11-21T16:34:37.041Z Vendors: n/a Products: n/a Problem Types: n/a Description: hopetree izone lts c011b48 contains a server-side request forgery (SSRF) vulnerability in the active push function as \\apps\\tool\\apis\\bd_push.py does not securely filter user input through push_urls() and get_urls(). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Hopetree/izone/issues/290
CVE ID: CVE-2024-50823 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-15T19:14:14.372Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was found in /admin/login.php in kashipara E-learning Management System Project 1.0 via the username and password parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/SQL%20Injection%20-%20admin%20login.pdf
CVE ID: CVE-2024-50824 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-15T19:18:35.295Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was found in /admin/class.php in kashipara E-learning Management System Project 1.0 via the class_name parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/SQL%20Injection%20-%20class.pdf
CVE ID: CVE-2024-50825 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-15T19:18:35.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was found in /admin/school_year.php in kashipara E-learning Management System Project 1.0 via the school_year parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/SQL%20Injection%20-%20school%20year.pdf
CVE ID: CVE-2024-50826 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-15T19:18:35.671Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was found in /admin/add_content.php in kashipara E-learning Management System Project 1.0 via the title and content parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/SQL%20Injection%20-%20add%20content.pdf
CVE ID: CVE-2024-50827 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-15T19:18:35.550Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was found in /admin/add_subject.php in kashipara E-learning Management System Project 1.0 via the subject_code parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/SQL%20Injection%20-%20add%20subject.pdf
CVE ID: CVE-2024-50828 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-15T19:18:35.434Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was found in /admin/edit_department.php in kashipara E-learning Management System Project 1.0 via the d parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/SQL%20Injection%20-%20edit%20department.pdf
CVE ID: CVE-2024-50829 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-15T19:18:36.040Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was found in /admin/edit_subject.php in kashipara E-learning Management System Project 1.0 via the unit parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/SQL%20Injection%20-%20edit%20subject.pdf
CVE ID: CVE-2024-50830 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-15T19:18:35.916Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was found in /admin/calendar_of_events.php in kashipara E-learning Management System Project 1.0 via the date_start, date_end, and title parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/SQL%20Injection%20-%20Calendar%20of%20Events.pdf
CVE ID: CVE-2024-50831 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-15T19:18:35.800Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection was found in /admin/admin_user.php in kashipara E-learning Management System Project 1.0 via the username and password parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/SQL%20Injection%20-%20admin%20user.pdf
CVE ID: CVE-2024-50832 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-15T19:18:36.334Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was found in /admin/edit_class.php in kashipara E-learning Management System Project 1.0 via the class_name parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/SQL%20Injection%20-%20edit%20class.pdf
CVE ID: CVE-2024-50833 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-15T19:18:36.206Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was found in /login.php in KASHIPARA E-learning Management System Project 1.0 via the username and password parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/SQL%20Injection%20-%20login%20page.pdf
CVE ID: CVE-2024-50834 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-15T19:18:36.475Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection was found in /admin/teachers.php in KASHIPARA E-learning Management System Project 1.0 via the firstname and lastname parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/SQL%20Injection%20-%20teacher.pdf
CVE ID: CVE-2024-50835 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-15T20:48:52.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability was found in /admin/edit_student.php in KASHIPARA E-learning Management System Project 1.0 via the cys, un, ln, fn, and id parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/SQL%20Injection%20-%20edit%20student.pdf
CVE ID: CVE-2024-50836 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-18T18:08:09.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/teachers.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the firstname and lastname parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/Stored%20XSS%20-%20Teachers.pdf
CVE ID: CVE-2024-50837 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-14T18:20:42.468Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/admin_user.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the firstname and username parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/Stored%20XSS%20-%20admin%20user.pdf
CVE ID: CVE-2024-50838 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-14T18:23:55.261Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/department.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the d and pi parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/Stored%20XSS%20-%20Department.pdf
CVE ID: CVE-2024-50839 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-14T18:30:12.134Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/add_subject.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the subject_code and title parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/Stored%20XSS%20-%20Subject.pdf
CVE ID: CVE-2024-50840 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-14T18:27:21.183Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/class.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the class_name parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/Stored%20XSS%20-%20Class.pdf
CVE ID: CVE-2024-50841 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-14T18:40:31.439Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/calendar_of_events.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the date_start, date_end, and title parameters. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/Stored%20XSS%20-%20Calendar%20of%20Events.pdf