Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/39487908-5cc5-42ac-8af4-65626694b1e4?source=cve - https://plugins.trac.wordpress.org/browser/contact-form-to-any-api/trunk/admin/partials/cf7-to-any-api-admin-entries.php
CVE ID: CVE-2024-7618 State: PUBLISHED Published: 2024-09-10T07:30:04.499Z Last Updated: 2024-09-10T13:29:05.236Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: peepso Products: Community by PeepSo – Social Network, Membership, Registration, User Profiles, Premium – Mobile App Problem Types: CWE-79 Description: The Community by PeepSo – Social Network, Membership, Registration, User Profiles plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘content’ parameter in all versions up to, and including, 6.4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator
ufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/edf2e060-5ae4-4b46-bc68-22ae5f516fe8?source=cve - https://plugins.trac.wordpress.org/browser/peepso-core/tags/6.4.4.0/templates/reactions/admin_reaction.php#L112 - https://wordpress.org/plugins/peepso-core/#developers - https://www.peepso
templates/reactions/admin_reaction.php#L112 - https://wordpress.org/plugins/peepso-core/#developers - https://www.peepso.com/changelog/ - https://plugins.trac.wordpress.org/changeset/3147528/ - https://plugins.trac.wordpress.org/browser/peepso-core/tags/6.4.6.0/classes/adminconfigreactions.php?rev=3147528#L88
CVE ID: CVE-2024-7619 State: REJECTED Published: N/A Last Updated: 2024-09-03T18:03:26.371Z Description: No description available.
CVE ID: CVE-2024-7620 State: PUBLISHED Published: 2024-09-07T11:17:05.128Z Last Updated: 2024-09-09T15:04:28.756Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: justinbusa Products: Customizer Export/Import Problem Types: CWE-434 Description: The Customizer Export/Import plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the '_import' function in all versions up to, and including, 0.9.7. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. NOTE: This vulnerability is
arbitrary files on the affected site's server which may make remote code execution possible. NOTE: This vulnerability is only exploitable when used in conjunction with a race condition as the uploaded file is deleted shortly after it is created. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7600e7df-725d-4877-b0bf-5329f814723f?source=cve - https://plugins.trac.wordpress.org/changeset/3144365/customizer-export-import
CVE ID: CVE-2024-7621 State: PUBLISHED Published: 2024-08-10T02:01:21.796Z Last Updated: 2024-08-12T16:40:37.442Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: wpfeedback Products: Visual Website Collaboration, Feedback & Project Management – Atarim Problem Types: CWE-862 Description: The Visual Website Collaboration, Feedback & Project Management – Atarim plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the process_wpfeedback_misc_options() function in all versions up to, and including, 4.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update th
cluding, 4.0.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the plugins settings which can also be leveraged to gain access to the plugin's settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7f17e055-ad49-4115-89c5-dd76b6c531f7?source=cve - https://plugins.trac.wordpress.org/browser/atarim-visual-collaboration/trunk/inc/wpf_function.php?rev=3116009#L235 - https://plugins.trac.wordpress.org/changeset/3133163/atarim-visual-collaboration/trunk/inc/wpf_function.php
CVE ID: CVE-2024-7622 State: PUBLISHED Published: 2024-09-06T13:55:14.025Z Last Updated: 2024-09-06T14:12:41.701Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: themastercut Products: Revision Manager TMC Problem Types: CWE-862 Description: The Revision Manager TMC plugin for WordPress is vulnerable to unauthorized arbitrary email sending due to a missing capability check on the _a_ajaxQuickEmailTestCallback() function in all versions up to, and including, 2.8.19. This makes it possible for authenticated attackers, with subscriber-level access and above, to send emails with arbitrary content to any individual through the vulnerable web server. Additional An
cess and above, to send emails with arbitrary content to any individual through the vulnerable web server. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2c8a6ff9-6aa8-4e0f-b058-759561a55508?source=cve - https://plugins.trac.wordpress.org/browser/revision-manager-tmc/trunk/src/Components/Notifications.php#L357 - https://plugins.trac.wordpress.org/changeset/3147298/
CVE ID: CVE-2024-7624 State: PUBLISHED Published: 2024-08-15T02:30:36.734Z Last Updated: 2024-08-15T14:36:40.530Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: dylanjkotze Products: Zephyr Project Manager Problem Types: CWE-285 Description: The Zephyr Project Manager plugin for WordPress is vulnerable to limited privilege escalation in all versions up to, and including, 3.3.101. This is due to the plugin not properly checking a users capabilities before allowing them to enable access to the plugin's settings through the update_user_access() function. This makes it possible for authenticated attackers, with subscriber-level access and above, to grant themselv
function. This makes it possible for authenticated attackers, with subscriber-level access and above, to grant themselves full access to the plugin's settings. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b9ef344d-cd56-43f9-b185-de83a92800de?source=cve - https://plugins.trac.wordpress.org/browser/zephyr-project-manager/trunk/includes/Base/AjaxHandler.php?rev=3111536#L2464 - https://plugins.trac.wordpress.org/changeset/3134404/
CVE ID: CVE-2024-7625 State: PUBLISHED Published: 2024-08-14T23:20:17.888Z Last Updated: 2025-01-09T19:19:01.219Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N) Vendors: HashiCorp Products: Nomad, Nomad Enterprise Problem Types: CWE-610 Description: In HashiCorp Nomad and Nomad Enterprise from 0.6.1 up to 1.6.13, 1.7.10, and 1.8.2, the archive unpacking process is vulnerable to writes outside the allocation directory during migration of allocation directories when multiple archive headers target the same file. This vulnerability, CVE-2024-7625, is fixed in Nomad 1.6.14, 1.7.11, and 1.8.3. Access or compromise of the Nomad client agent at the source allocation first
fixed in Nomad 1.6.14, 1.7.11, and 1.8.3. Access or compromise of the Nomad client agent at the source allocation first is a prerequisite for leveraging this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2024-17-nomad-vulnerable-to-allocation-directory-escape-on-non-existing-file-paths-through-archive-unpacking/69293
CVE ID: CVE-2024-7626 State: PUBLISHED Published: 2024-09-11T07:31:32.430Z Last Updated: 2024-09-11T15:04:00.065Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: wpdelicious Products: WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) Problem Types: CWE-73 Description: The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file movement and reading due to insufficient file path validation in the save_edit_profile_details() function in all versions up to, and including, 1.6.9. This makes it possible for authenticated attackers, with subscriber-level access and abov
s up to, and including, 1.6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php). This can also lead to the reading of arbitrary files that may contain sensitive information like wp-config.php. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3c98bb53-9f7e-4ab3-9676-e3dbfb4a0519?source=cve - https://plugins.trac.wordpress.org/browser/delicious-recipes/tags/1.6.7/src/dashboard/class-delicious-recipes-form-handler.php#L260 - https://plugins.tr
rg/browser/delicious-recipes/tags/1.6.7/src/dashboard/class-delicious-recipes-form-handler.php#L260 - https://plugins.trac.wordpress.org/browser/delicious-recipes/tags/1.6.7/src/dashboard/class-delicious-recipes-form-handler.php#L355 - https://plugins.trac.wordpress.org/changeset/3148996/delicious-recipes/trunk/src/dashboard/class-delicious-recipes-form-handler.php
CVE ID: CVE-2024-7627 State: PUBLISHED Published: 2024-09-05T02:04:24.643Z Last Updated: 2024-09-05T13:32:49.769Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: bitpressadmin Products: Bit File Manager – 100% Free & Open Source File Manager and Code Editor for WordPress Problem Types: CWE-94 Description: The Bit File Manager plugin for WordPress is vulnerable to Remote Code Execution in versions 6.0 to 6.5.5 via the 'checkSyntax' function. This is due to writing a temporary file to a publicly accessible directory before performing file validation. This makes it possible for unauthenticated attackers to execute code on the server if an administrator has allowe
ation. This makes it possible for unauthenticated attackers to execute code on the server if an administrator has allowed Guest User read permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5f29de7a-3f15-4b6d-aad7-6a08151e2113?source=cve - https://plugins.trac.wordpress.org/browser/file-manager/trunk/backend/app/Providers/FileEditValidator.php#L39 - https://plugins.trac.wordpress.org/browser/file-manager/trunk/backend/app/Providers/FileEditValidator.php#L88 - https://plugins.trac.wordpress.org/changeset/3138710/
CVE ID: CVE-2024-7628 State: PUBLISHED Published: 2024-08-15T02:30:37.281Z Last Updated: 2024-08-15T13:15:59.205Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: inspireui Products: MStore API – Create Native Android & iOS Apps On The Cloud Problem Types: CWE-288 Description: The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 4.15.2. This is due to the use of loose comparison in the 'verify_id_token' function. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to an
nauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to an @flutter.io email address or phone number. This also requires firebase to be configured on the website and the user to have set up firebase for their account. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d174f856-d94a-42ed-b547-67699e175cd8?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3134553%40mstore-api&new=3134553%40mstore-api&sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/helpers/firebase-phone-a
sfp_email=&sfph_mail= - https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/helpers/firebase-phone-auth-helper.php?rev=3110793#L31 - https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/helpers/firebase-phone-auth-helper.php?rev=3110793#L35 - https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/helpers/firebase-phone-auth-helper.php?rev=3110793#L5
CVE ID: CVE-2024-7629 State: PUBLISHED Published: 2024-08-21T05:30:24.440Z Last Updated: 2024-08-21T13:32:33.814Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: marla14 Products: Responsive Video Problem Types: CWE-80 Description: The Responsive video plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's video settings function in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses
contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires responsive videos to be enabled for posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c530f5d2-eed3-433b-bf96-656593ad6ce2?source=cve - https://plugins.trac.wordpress.org/browser/responsive-video/trunk/responsive-video.php#L534
CVE ID: CVE-2024-7630 State: PUBLISHED Published: 2024-08-16T01:59:56.829Z Last Updated: 2024-08-16T13:21:30.113Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: msaari Products: Relevanssi – A Better Search Problem Types: CWE-200 Description: The Relevanssi – A Better Search plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.22.2 via the relevanssi_do_query() due to insufficient limitations on the posts that are returned when searching. This makes it possible for unauthenticated attackers to extract potentially sensitive information from password protected posts. Additional Analyst Notes: - CISA ADP Vulnrichme
extract potentially sensitive information from password protected posts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/3fa78f4e-ede2-4863-a2d7-99bd8c7b5912?source=cve - https://plugins.trac.wordpress.org/changeset/3134753/relevanssi/trunk/lib/common.php
CVE ID: CVE-2024-7631 State: PUBLISHED Published: 2025-03-19T18:47:27.721Z Last Updated: 2025-11-20T20:56:53.961Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Red Hat Products: Red Hat OpenShift Container Platform 3.11, Red Hat OpenShift Container Platform 4 Problem Types: CWE-22 Description: A flaw was found in the OpenShift Console, an endpoint for plugins to serve resources in multiple languages: /locales/resources.json. This endpoint's lng and ns parameters are used to construct a filepath in pkg/plugins/handlers unsafely.go#L112 Because of this unsafe filepath construction, an authenticated user can manipulate the path to retrieve any JSON files on t
ause of this unsafe filepath construction, an authenticated user can manipulate the path to retrieve any JSON files on the console's pod by using sequences of ../ and valid directory paths. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2024-7631 - https://bugzilla.redhat.com/show_bug.cgi?id=2296053
CVE ID: CVE-2024-7633 State: REJECTED Published: N/A Last Updated: 2024-08-09T02:54:27.598117Z Description: No description available.
CVE ID: CVE-2024-7634 State: PUBLISHED Published: 2024-08-22T18:07:31.058Z Last Updated: 2024-08-22T19:29:33.197Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: F5 Products: NGINX Agent Problem Types: CWE-22 Description: NGINX Agent's "config_dirs" restriction feature allows a highly privileged attacker to gain the ability to write/overwrite files outside of the designated secure directory. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://my.f5.com/manage/s/article/K000140630
CVE ID: CVE-2024-7635 State: PUBLISHED Published: 2024-08-09T12:31:03.598Z Last Updated: 2024-08-09T18:05:14.403Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects Products: Simple Ticket Booking Problem Types: CWE-89 Description: A vulnerability was found in code-projects Simple Ticket Booking 1.0. It has been classified as critical. Affected is an unknown function of the file register_insert.php of the component Registration Handler. The manipulation of the argument name/email/dob/password/Gender/phone leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA
nch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274056 - https://vuldb.com/?ctiid.274056 - https://vuldb.com/?submit.386667 - https://github.com/space-security/cve/issues/2
CVE ID: CVE-2024-7636 State: PUBLISHED Published: 2024-08-09T13:00:06.392Z Last Updated: 2024-08-09T15:20:31.444Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects Products: Simple Ticket Booking Problem Types: CWE-89 Description: A vulnerability was found in code-projects Simple Ticket Booking 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file authenticate.php of the component Login. The manipulation of the argument email/password leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274057 - https://vuldb.com/?ctiid.274057 - https://vuldb.com/?submit.386671 - https://github.com/space-security/cve/issues/1
CVE ID: CVE-2024-7637 State: PUBLISHED Published: 2024-08-09T13:31:04.056Z Last Updated: 2024-08-09T20:23:00.427Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects Products: Online Polling Problem Types: CWE-89 Description: A vulnerability was found in code-projects Online Polling 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file registeracc.php of the component Registration. The manipulation of the argument email leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/
losed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274058 - https://vuldb.com/?ctiid.274058 - https://vuldb.com/?submit.387088 - https://github.com/space-security/cve/issues/3
CVE ID: CVE-2024-7638 State: PUBLISHED Published: 2024-08-09T13:31:05.661Z Last Updated: 2024-08-09T14:09:01.125Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Kortex Lite Advocate Office Management System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Kortex Lite Advocate Office Management System 1.0. This affects an unknown part of the file delete_client.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - h
oit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274059 - https://vuldb.com/?ctiid.274059 - https://vuldb.com/?submit.387266 - https://github.com/samwbs/kortexcve/blob/main/sqli_delete_client/Kortex_sqli(delete_client.php).md
CVE ID: CVE-2024-7639 State: PUBLISHED Published: 2024-08-09T14:00:06.495Z Last Updated: 2024-08-09T15:12:57.933Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Kortex Lite Advocate Office Management System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. This vulnerability affects unknown code of the file delete_act.php. The manipulation of the argument id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://
been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274060 - https://vuldb.com/?ctiid.274060 - https://vuldb.com/?submit.387271 - https://github.com/samwbs/kortexcve/blob/main/sqli_delete_act/sqli_delete_act.md
CVE ID: CVE-2024-7640 State: PUBLISHED Published: 2024-08-09T14:00:08.480Z Last Updated: 2024-08-09T15:01:57.177Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Kortex Lite Advocate Office Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Kortex Lite Advocate Office Management System 1.0. This issue affects some unknown processing of the file delete_register.php. The manipulation of the argument case_register_id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA A
be initiated remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274061 - https://vuldb.com/?ctiid.274061 - https://vuldb.com/?submit.387272 - https://github.com/samwbs/kortexcve/blob/main/sqli_delete_register/sqli_delete_register.md
CVE ID: CVE-2024-7641 State: PUBLISHED Published: 2024-08-09T14:31:03.564Z Last Updated: 2024-08-09T15:07:52.101Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Kortex Lite Advocate Office Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in SourceCodester Kortex Lite Advocate Office Management System 1.0. Affected is an unknown function of the file deactivate_act.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: Refere
The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.274062 - https://vuldb.com/?ctiid.274062 - https://vuldb.com/?submit.387273 - https://github.com/samwbs/kortexcve/blob/main/sqli_deactivate_act/sqli_deactivate_act.md