Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-35228 State: PUBLISHED Published: 2021-03-10T18:10:13 Last Updated: 2024-08-04T17:02:07.442Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the administration web panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices allows remote attackers to inject arbitrary web script or HTML via the language parameter. Additional Analyst Notes: - CVE Program Container: References: - https://research.nccgroup.com/2021/03/08/technical-advisory-multiple-vulnerabilities-in-netgear-prosafe-plus-jgs516pe-gs116ev2-switches/
CVE ID: CVE-2020-35229 State: PUBLISHED Published: 2021-03-10T18:10:56 Last Updated: 2024-08-04T17:02:07.499Z Vendors: n/a Products: n/a Problem Types: n/a Description: The authentication token required to execute NSDP write requests on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices is not properly invalidated and can be reused until a new token is generated, which allows attackers (with access to network traffic) to effectively gain administrative privileges. Additional Analyst Notes: - CVE Program Container: References: - https://research.nccgroup.com/2021/03/08/technical-advisory-multiple-vulnerabilities-in-netgear-prosafe-plus-jgs516pe-gs116ev2-switches/
CVE ID: CVE-2020-35230 State: PUBLISHED Published: 2021-03-10T18:11:54 Last Updated: 2024-08-04T17:02:06.944Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple integer overflow parameters were found in the web administration panel on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices. Most of the integer parameters sent through the web server can be abused to cause a denial of service attack. Additional Analyst Notes: - CVE Program Container: References: - https://research.nccgroup.com/2021/03/08/technical-advisory-multiple-vulnerabilities-in-netgear-prosafe-plus-jgs516pe-gs116ev2-switches/
CVE ID: CVE-2020-35231 State: PUBLISHED Published: 2021-03-10T18:14:44 Last Updated: 2024-08-04T17:02:07.020Z Vendors: n/a Products: n/a Problem Types: n/a Description: The NSDP protocol implementation on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices was affected by an authentication issue that allows an attacker to bypass access controls and obtain full control of the device. Additional Analyst Notes: - CVE Program Container: References: - https://research.nccgroup.com/2021/03/08/technical-advisory-multiple-vulnerabilities-in-netgear-prosafe-plus-jgs516pe-gs116ev2-switches/
CVE ID: CVE-2020-35232 State: REJECTED Published: 2021-03-10T18:15:41 Last Updated: 2021-03-16T19:16:23 Description: No description available.
CVE ID: CVE-2020-35233 State: PUBLISHED Published: 2021-03-10T18:16:43 Last Updated: 2024-08-04T17:02:07.453Z Vendors: n/a Products: n/a Problem Types: n/a Description: The TFTP server fails to handle multiple connections on NETGEAR JGS516PE/GS116Ev2 v2.6.0.43 devices, and allows external attackers to force device reboots by sending concurrent connections, aka a denial of service attack. Additional Analyst Notes: - CVE Program Container: References: - https://research.nccgroup.com/2021/03/08/technical-advisory-multiple-vulnerabilities-in-netgear-prosafe-plus-jgs516pe-gs116ev2-switches/
CVE ID: CVE-2020-35234 State: PUBLISHED Published: 2020-12-14T02:21:44 Last Updated: 2024-08-04T17:02:07.102Z Vendors: n/a Products: n/a Problem Types: n/a Description: The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020. If an attacker can list the wp-content/plugins/easy-wp-smtp/ directory, then they can discover a log file (such as #############_debug_log.txt) that contains all password-reset links. The attacker can request a reset of the Administrator password and then use a link found there. Additional Analyst Notes: - CVE Program Container: References: - https://blog.nintechnet.com/wordpress-easy-wp-smtp-pl
. Additional Analyst Notes: - CVE Program Container: References: - https://blog.nintechnet.com/wordpress-easy-wp-smtp-plugin-fixed-zero-day-vulnerability/ - https://wordpress.org/plugins/easy-wp-smtp/#developers
CVE ID: CVE-2020-35235 State: PUBLISHED Published: 2020-12-14T02:20:27 Last Updated: 2024-08-04T17:02:07.522Z Vendors: n/a Products: n/a Problem Types: n/a Description: vendor/elfinder/php/connector.minimal.php in the secure-file-manager plugin through 2.5 for WordPress loads elFinder code without proper access control. Thus, any authenticated user can run the elFinder upload command to achieve remote code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://blog.nintechnet.com/authenticated-rce-vulnerability-in-wordpress-secure-file-manager-pl
Container: References: - https://blog.nintechnet.com/authenticated-rce-vulnerability-in-wordpress-secure-file-manager-plugin-unpatched/ - https://wordpress.org/plugins/secure-file-manager/#developers
CVE ID: CVE-2020-35236 State: PUBLISHED Published: 2020-12-14T04:44:18 Last Updated: 2024-08-04T17:02:07.630Z Vendors: n/a Products: n/a Problem Types: n/a Description: The GitLab Webhook Handler in amazee.io Lagoon before 1.12.3 has incorrect access control associated with project deletion. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/amazeeio/lagoon/tree/master/services/webhooks2tasks - https://github.com/amazeeio/lagoon/tree/master/services/webhook-handler - https://github.com/amazeeio/lagoon/commit/1140289bf9fa98b8602ab4662ae867b210d8476b - https://github.com/amazeeio/lagoon/compare/v1.12.2...v1.12.3
CVE ID: CVE-2020-35239 State: PUBLISHED Published: 2021-01-20T23:37:02 Last Updated: 2024-08-04T17:02:07.018Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks by changing the HTTP request method to an arbitrary string that is not in the list of request methods that CakePHP checks. Additionally, the route middleware does not verify that this overriden method (which can be an arbitrary string) is actually an HTTP method. Additional Analyst Notes: - CVE Program Container: References: - https://bakery.cakephp.org/2020/12/07/cakep
TTP method. Additional Analyst Notes: - CVE Program Container: References: - https://bakery.cakephp.org/2020/12/07/cakephp_4010_released.html
CVE ID: CVE-2020-35240 State: PUBLISHED Published: 2020-12-30T14:23:14 Last Updated: 2024-08-04T17:02:07.508Z Vendors: n/a Products: n/a Problem Types: n/a Description: FluxBB 1.5.11 is affected by cross-site scripting (XSS in the Blog Content component. This vulnerability can allow an attacker to inject the XSS payload in "Blog Content" and each time any user will visit the blog, the XSS triggers and the attacker can able to steal the cookie according to the crafted payload. Additional Analyst Notes: - CVE Program Container: References: - https://fluxbb.org/downloads/ - https://github.com/hemantsolo/CVE-Reference/blob/main/CVE-2020-35240.md - https://github.com/hemantsolo/CVE-Reference/issu
tps://github.com/hemantsolo/CVE-Reference/blob/main/CVE-2020-35240.md - https://github.com/hemantsolo/CVE-Reference/issues/1
CVE ID: CVE-2020-35241 State: PUBLISHED Published: 2020-12-30T14:26:49.000Z Last Updated: 2025-01-29T20:58:11.612Z Vendors: n/a Products: n/a Problem Types: n/a Description: FlatPress 1.0.3 is affected by cross-site scripting (XSS) in the Blog Content component. This vulnerability can allow an attacker to inject the XSS payload in Blog content via the admin panel. Each time any user will go to that blog page, the XSS triggers and the attacker can steal the cookie according to the crafted payload. Additional Analyst Notes: - CVE Program Container: References: - https://www.flatpress.org/download - https://github.com/hemantsolo/CVE-Reference/blob/main/CVE-2020-35241.md - https://github.com/alp
latpress.org/download - https://github.com/hemantsolo/CVE-Reference/blob/main/CVE-2020-35241.md - https://github.com/alpernae/vulnerability-research/tree/main/CVE-2020-35241 - https://www.exploit-db.com/exploits/48826
CVE ID: CVE-2020-35242 State: PUBLISHED Published: 2020-12-26T19:13:44 Last Updated: 2024-08-04T17:02:07.441Z Vendors: n/a Products: n/a Problem Types: n/a Description: Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::updateUserTeamInfoInDbAndMemory. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/balloonwj/flamingo/issues/47
CVE ID: CVE-2020-35243 State: PUBLISHED Published: 2020-12-26T19:14:43 Last Updated: 2024-08-04T17:02:07.568Z Vendors: n/a Products: n/a Problem Types: n/a Description: Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::updateUserInfoInDb. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/balloonwj/flamingo/issues/47
CVE ID: CVE-2020-35244 State: PUBLISHED Published: 2020-12-26T19:15:59 Last Updated: 2024-08-04T17:02:07.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::addGroup. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/balloonwj/flamingo/issues/47
CVE ID: CVE-2020-35245 State: PUBLISHED Published: 2020-12-26T19:16:34 Last Updated: 2024-08-04T17:02:07.529Z Vendors: n/a Products: n/a Problem Types: n/a Description: Flamingo (aka FlamingoIM) through 2020-09-29 has a SQL injection vulnerability in UserManager::addUser. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/balloonwj/flamingo/issues/47
CVE ID: CVE-2020-35249 State: PUBLISHED Published: 2021-11-02T10:35:19 Last Updated: 2024-08-04T17:02:07.560Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in ElkarBackup 1.3.3, allows attackers to execute arbitrary code via the name parameter to the add client feature. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/48756
CVE ID: CVE-2020-35252 State: PUBLISHED Published: 2020-12-23T18:32:05 Last Updated: 2024-08-04T17:02:07.529Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability via the 'Full Name' parameter in the User Registration section of User Registration & Login System with Admin Panel 1.0. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49153
CVE ID: CVE-2020-35257 State: REJECTED Published: 2022-07-13T12:56:31 Last Updated: 2022-07-13T12:56:31 Description: No description available.
CVE ID: CVE-2020-35259 State: REJECTED Published: 2022-07-13T13:53:00 Last Updated: 2022-07-13T13:53:00 Description: No description available.
CVE ID: CVE-2020-35261 State: PUBLISHED Published: 2022-07-15T11:25:51 Last Updated: 2024-08-04T17:02:07.102Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in sourcecodester Multi Restaurant Table Reservation System 1.0 via the Restaurant Name field to /dashboard/profile.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49135 - https://packetstormsecurity.com/files/159786/Multi-Restaurant-Table-Reservation-System-1.0-Cross-Site-Scripting.html - https://www.sourcecodester.com/php/14568/multi-restaurant-table-reservation-system-php-full-source-code.html - https://github.com/yunaranyanc
ester.com/php/14568/multi-restaurant-table-reservation-system-php-full-source-code.html - https://github.com/yunaranyancat/poc-dump/tree/main/MultiRestaurantReservationSystem/1.0
CVE ID: CVE-2020-35262 State: PUBLISHED Published: 2021-01-06T21:11:53 Last Updated: 2024-08-04T17:02:07.558Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Digisol DG-HR3400 can be exploited via the NTP server name in Time and date module and "Keyword" in URL Filter. Additional Analyst Notes: - CVE Program Container: References: - http://digisol.com - https://github.com/the-girl-who-lived/CVE-2020-35262 - https://youtu.be/E5wEzf-gkOE
CVE ID: CVE-2020-35263 State: PUBLISHED Published: 2021-01-26T17:20:30 Last Updated: 2024-08-04T17:02:07.431Z Vendors: n/a Products: n/a Problem Types: n/a Description: EgavilanMedia User Registration & Login System 1.0 is affected by SQL injection to the admin panel, which may allow arbitrary code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49058
CVE ID: CVE-2020-35269 State: PUBLISHED Published: 2020-12-23T18:44:12 Last Updated: 2024-08-04T17:02:07.066Z Vendors: n/a Products: n/a Problem Types: n/a Description: Nagios Core application version 4.2.4 is vulnerable to Site-Wide Cross-Site Request Forgery (CSRF) in many functions, like adding – deleting for hosts or servers. Additional Analyst Notes: - CVE Program Container: References: - https://gist.github.com/MoSalah20/d1d40b43eafba0bd22ee4cddecad3cbc
CVE ID: CVE-2020-35270 State: PUBLISHED Published: 2021-01-25T14:40:33 Last Updated: 2024-08-04T17:02:07.419Z Vendors: n/a Products: n/a Problem Types: n/a Description: Student Result Management System In PHP With Source Code is affected by SQL injection. An attacker can able to access of Admin Panel and manage every account of Result. Additional Analyst Notes: - CVE Program Container: References: - https://projectnotes.org/it-projects/student-result-management-system-in-php-with-source-code/ - https://www.exploit-db.com/exploits/49152
CVE ID: CVE-2020-35271 State: PUBLISHED Published: 2021-01-20T15:37:37 Last Updated: 2024-08-04T17:02:07.467Z Vendors: n/a Products: n/a Problem Types: n/a Description: Employee Performance Evaluation System in PHP/MySQLi with Source Code 1.0 is affected by cross-site scripting (XSS) in the Employees, First Name and Last Name fields. Additional Analyst Notes: - CVE Program Container: References: - https://riteshgohil-25.medium.com/employee-performance-evaluation-system-1-0-first-and-last-name-persistent-cross-site-scripting-7f319775e96f
CVE ID: CVE-2020-35272 State: PUBLISHED Published: 2021-01-20T15:38:10 Last Updated: 2024-08-04T17:02:07.488Z Vendors: n/a Products: n/a Problem Types: n/a Description: Employee Performance Evaluation System in PHP/MySQLi with Source Code 1.0 is affected by cross-site scripting (XSS) in the Admin Portal in the Task and Description fields. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49215
CVE ID: CVE-2020-35273 State: PUBLISHED Published: 2020-12-21T14:51:09 Last Updated: 2024-08-04T17:02:08.079Z Vendors: n/a Products: n/a Problem Types: n/a Description: EgavilanMedia User Registration & Login System with Admin Panel 1.0 is affected by Cross Site Request Forgery (CSRF) to remotely gain privileges in the User Profile panel. An attacker can update any user's account. Additional Analyst Notes: - CVE Program Container: References: - http://egavilanmedia.com - https://www.exploit-db.com/exploits/49151
CVE ID: CVE-2020-35274 State: PUBLISHED Published: 2020-12-21T14:51:18 Last Updated: 2024-08-04T17:02:07.528Z Vendors: n/a Products: n/a Problem Types: n/a Description: DotCMS Add Template with admin panel 20.11 is affected by cross-site Scripting (XSS) to gain remote privileges. An attacker could compromise the security of a website or web application through a stored XSS attack and stealing cookies using XSS. Additional Analyst Notes: - CVE Program Container: References: - http://dotcms.com - https://www.exploit-db.com/exploits/49168
CVE ID: CVE-2020-35275 State: PUBLISHED Published: 2020-12-21T14:51:26 Last Updated: 2024-08-04T17:02:07.536Z Vendors: n/a Products: n/a Problem Types: n/a Description: Coastercms v5.8.18 is affected by cross-site Scripting (XSS). A user can steal a cookie and make the user redirect to any malicious website because it is trigged on the main home page of the product/application. Additional Analyst Notes: - CVE Program Container: References: - http://coastercms.com - http://demo.coastercms.org/admin/home - http://demo.coastercms.org/admin/login - http://demo.coastercms.org/homepage/blog - https://www.exploit-db.com/exploits/49181
CVE ID: CVE-2020-35276 State: PUBLISHED Published: 2020-12-21T14:51:33 Last Updated: 2024-08-04T17:02:07.940Z Vendors: n/a Products: n/a Problem Types: n/a Description: EgavilanMedia ECM Address Book 1.0 is affected by SQL injection. An attacker can bypass the Admin Login panel through SQLi and get Admin access and add or remove any user. Additional Analyst Notes: - CVE Program Container: References: - http://egavilanmedia.com - http://ecm.com - https://hardik-solanki.medium.com/authentication-admin-panel-bypass-which-leads-to-full-admin-access-control-c10ec4ab4255
CVE ID: CVE-2020-35284 State: PUBLISHED Published: 2020-12-26T05:31:42 Last Updated: 2024-08-04T17:02:07.427Z Vendors: n/a Products: n/a Problem Types: n/a Description: Flamingo (aka FlamingoIM) through 2020-09-29 allows ../ directory traversal because the only ostensibly unpredictable part of a file-transfer request is an MD5 computation; however, this computation occurs on the client side, and the computation details can be easily determined because the product's source code is available. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/balloonwj/flamingo/issues/48
CVE ID: CVE-2020-35296 State: PUBLISHED Published: 2021-03-03T15:04:59 Last Updated: 2024-08-04T17:02:07.427Z Vendors: n/a Products: n/a Problem Types: n/a Description: ThinkAdmin v6 has default administrator credentials, which allows attackers to gain unrestricted administratior dashboard access. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/zoujingli/ThinkAdmin - https://github.com/Shrimant12/CVE-References/blob/main/CVE-2020-35296.md - https://smshrimant.com/admin-panel-access-using-default-credentials/
CVE ID: CVE-2020-35305 State: PUBLISHED Published: 2022-07-15T13:40:53 Last Updated: 2024-08-04T17:02:07.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross site scripting (XSS) in gollum 5.0 to 5.1.2 via the filename parameter to the 'New Page' dialog. Additional Analyst Notes: - CVE Program Container: References: - http://gollum.com - https://github.com/Szarny/ - https://github.com/gollum/ - https://github.com/gollum/gollum/releases/tag/v5.1.2
CVE ID: CVE-2020-35308 State: PUBLISHED Published: 2021-03-31T19:10:35 Last Updated: 2024-08-04T17:02:08.055Z Vendors: n/a Products: n/a Problem Types: n/a Description: CONQUEST DICOM SERVER before 1.5.0 has a code execution vulnerability which can be exploited by attackers to execute malicious code. Additional Analyst Notes: - CVE Program Container: References: - https://www.cnvd.org.cn/flaw/show/2017713
CVE ID: CVE-2020-35309 State: PUBLISHED Published: 2021-01-21T14:41:27 Last Updated: 2024-08-04T17:02:07.455Z Vendors: n/a Products: n/a Problem Types: n/a Description: Bakeshop Online Ordering System in PHP/MySQLi 1.0 is affected by cross-site scripting (XSS) which allows remote attackers to inject an arbitrary web script or HTML in admin dashboard - "Categories". Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49161
CVE ID: CVE-2020-35310 State: REJECTED Published: 2021-01-21T14:41:48 Last Updated: 2021-02-01T20:51:47 Description: No description available.
CVE ID: CVE-2020-35313 State: PUBLISHED Published: 2021-04-20T19:05:37 Last Updated: 2024-08-04T17:02:07.570Z Vendors: n/a Products: n/a Problem Types: n/a Description: A server-side request forgery (SSRF) vulnerability in the addCustomThemePluginRepository function in index.php in WonderCMS 3.1.3 allows remote attackers to execute arbitrary code via a crafted URL to the theme/plugin installer. Additional Analyst Notes: - CVE Program Container: References: - https://zetc0de.github.io/post/authenticated-rce-ssrf-wondercms/ - https://github.com/robiso/wondercms - https://packetstormsecurity.com/files/160310/WonderCMS-3.1.3-Code-Execution-Server-Side-Request-Forgery.html
CVE ID: CVE-2020-35314 State: PUBLISHED Published: 2021-04-20T19:25:54 Last Updated: 2024-08-04T17:02:07.444Z Vendors: n/a Products: n/a Problem Types: n/a Description: A remote code execution vulnerability in the installUpdateThemePluginAction function in index.php in WonderCMS 3.1.3, allows remote attackers to upload a custom plugin which can contain arbitrary code and obtain a webshell via the theme/plugin installer. Additional Analyst Notes: - CVE Program Container: References: - https://zetc0de.github.io/post/authenticated-rce-ssrf-wondercms/ - https://github.com/robiso/wondercms - https://packetstormsecurity.com/files/160311/WonderCMS-3.1.3-Remote-Code-Execution.html - https://zetc0de.
o/wondercms - https://packetstormsecurity.com/files/160311/WonderCMS-3.1.3-Remote-Code-Execution.html - https://zetc0de.github.io/post/authenticated-rce-ssrf-wondercms/#authenticated-remote-code-execution
CVE ID: CVE-2020-35326 State: PUBLISHED Published: 2023-01-18T00:00:00.000Z Last Updated: 2025-04-04T18:03:47.099Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in file /inxedu/demo_inxedu_open/src/main/resources/mybatis/inxedu/website/WebsiteImagesMapper.xml in inxedu 2.0.6 via the id value. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/inxeduopen/inxedu/issues/I14DNJ - https://github.com/876054426/vul/blob/master/inxedu%20through%202018-12-24%20has%20a%20SQL%20Injection%20vulnerability.md
CVE ID: CVE-2020-35327 State: PUBLISHED Published: 2021-03-04T15:40:34 Last Updated: 2024-08-04T17:02:07.527Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability was discovered in Courier Management System 1.0, which can be exploited via the ref_no (POST) parameter to admin_class.php Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49243
CVE ID: CVE-2020-35328 State: PUBLISHED Published: 2021-03-04T15:44:11 Last Updated: 2024-08-04T17:02:07.014Z Vendors: n/a Products: n/a Problem Types: n/a Description: Courier Management System 1.0 - 'First Name' Stored XSS Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49241
CVE ID: CVE-2020-35329 State: PUBLISHED Published: 2021-03-04T15:51:12 Last Updated: 2024-08-04T17:02:07.626Z Vendors: n/a Products: n/a Problem Types: n/a Description: Courier Management System 1.0 1.0 is affected by SQL Injection via 'MULTIPART street '. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/49242
CVE ID: CVE-2020-35337 State: PUBLISHED Published: 2021-03-24T15:40:14 Last Updated: 2024-08-04T17:02:07.452Z Vendors: n/a Products: n/a Problem Types: n/a Description: ThinkSAAS before 3.38 contains a SQL injection vulnerability through app/topic/action/admin/topic.php via the title parameter, which allows remote attackers to execute arbitrary SQL commands. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/thinksaas/ThinkSAAS/issues/24 - https://blog.unc1e.com/2020/12/thinksaas-has-post-auth-sql-injection.html
CVE ID: CVE-2020-35338 State: PUBLISHED Published: 2020-12-14T17:02:52 Last Updated: 2024-08-04T17:02:08.121Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Web Administrative Interface in Mobile Viewpoint Wireless Multiplex Terminal (WMT) Playout Server 20.2.8 and earlier has a default account with a password of "pokon." Additional Analyst Notes: - CVE Program Container: References: - https://jeyaseelans.medium.com/cve-2020-35338-9e841f48defa - https://www.mobileviewpoint.com/