Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-8346 State: PUBLISHED Published: 2024-08-30T20:31:04.621Z Last Updated: 2024-08-30T21:10:51.418Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Computer Laboratory Management System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in SourceCodester Computer Laboratory Management System 1.0. Affected is the function update_settings_info of the file /classes/SystemSettings.php?f=update_settings. The manipulation of the argument name leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP
the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276228 - https://vuldb.com/?ctiid.276228 - https://vuldb.com/?submit.400343 - https://github.com/gaorenyusi/gaorenyusi/blob/main/lms1.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-8347 State: PUBLISHED Published: 2024-08-30T21:31:04.623Z Last Updated: 2024-09-03T14:54:27.414Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Computer Laboratory Management System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in SourceCodester Computer Laboratory Management System 1.0. Affected by this vulnerability is the function delete_record of the file /classes/Master.php?f=delete_record. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichmen
remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276229 - https://vuldb.com/?ctiid.276229 - https://vuldb.com/?submit.400373 - https://github.com/gaorenyusi/gaorenyusi/blob/main/lms2.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-8348 State: PUBLISHED Published: 2024-08-30T21:31:06.557Z Last Updated: 2024-09-03T14:53:08.901Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Computer Laboratory Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Computer Laboratory Management System 1.0. Affected by this issue is the function delete_category of the file /classes/Master.php?f=delete_category. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA AD
be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276230 - https://vuldb.com/?ctiid.276230 - https://vuldb.com/?submit.400378 - https://github.com/gaorenyusi/gaorenyusi/blob/main/lms3.md - https://www.sourcecodester.com/
CVE ID: CVE-2024-8349 State: PUBLISHED Published: 2024-09-25T02:32:25.610Z Last Updated: 2024-09-25T13:36:24.147Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Uncanny Owl Products: Uncanny Groups for LearnDash Problem Types: CWE-862 Description: The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.1.0.1. This is due to the plugin not properly restricting what users a group leader can edit. This makes it possible for authenticated attackers, with group leader-level access and above, to change admin account email addresses which can subsequently lead to admin account access. Additi
el access and above, to change admin account email addresses which can subsequently lead to admin account access. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/64cf0ae2-8d66-40d1-8bb6-0cab1dafab0d?source=cve - https://github.com/karlemilnikka/CVE-2024-8349-and-CVE-2024-8350
CVE ID: CVE-2024-8350 State: PUBLISHED Published: 2024-09-25T02:32:26.514Z Last Updated: 2024-09-25T13:28:35.302Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: Uncanny Owl Products: Uncanny Groups for LearnDash Problem Types: CWE-862 Description: The Uncanny Groups for LearnDash plugin for WordPress is vulnerable to user group add due to a missing capability check on the /wp-json/ulgm_management/v1/add_user/ REST API endpoint in all versions up to, and including, 6.1.0.1. This makes it possible for authenticated attackers, with group leader-level access and above, to add users to their group which ultimately allows them to leverage CVE-2024-8349 and gain admi
level access and above, to add users to their group which ultimately allows them to leverage CVE-2024-8349 and gain admin access to the site. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a38a58de-5f7d-4033-9a65-41b590b7d510?source=cve - https://github.com/karlemilnikka/CVE-2024-8349-and-CVE-2024-8350
CVE ID: CVE-2024-8351 State: REJECTED Published: N/A Last Updated: 2025-02-11T01:05:29.484Z Description: No description available.
CVE ID: CVE-2024-8352 State: PUBLISHED Published: 2024-10-03T03:32:00.919Z Last Updated: 2024-10-03T15:24:55.745Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: dejanmarkovic Products: Social Web Suite – Social Media Auto Post, Social Media Auto Publish Problem Types: CWE-22 Description: The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.1.11 via the download_log function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst Not
s to read the contents of arbitrary files on the server, which can contain sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/78ba132c-b5b4-4999-a0ec-67d17ae2857f?source=cve - https://plugins.trac.wordpress.org/browser/social-web-suite/trunk/includes/libs/class-socialwebsuite-log.php#L78 - https://plugins.trac.wordpress.org/changeset/3155593/social-web-suite/trunk?old=3068377&old_path=%2Fsocial-web-suite%2Ftrunk
CVE ID: CVE-2024-8353 State: PUBLISHED Published: 2024-09-28T02:04:28.213Z Last Updated: 2024-09-30T15:11:42.678Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: webdevmattcrom Products: GiveWP – Donation Plugin and Fundraising Platform Problem Types: CWE-502 Description: The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input via several parameters like 'give_title' and 'card_address'. This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers t
possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to delete arbitrary files and achieve remote code execution. This is essentially the same vulnerability as CVE-2024-5932, however, it was discovered the the presence of stripslashes_deep on user_info allows the is_serialized check to be bypassed. This issue was mostly patched in 3.16.1, but further hardening was added in 3.16.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c4c530fa-eaf4-4721-bfb6-9fc06d7f343c?source=cve - https://plugins.trac.wordpress.org/browser/give/tags/3.16.0/includes/process-
a-eaf4-4721-bfb6-9fc06d7f343c?source=cve - https://plugins.trac.wordpress.org/browser/give/tags/3.16.0/includes/process-donation.php#L154 - https://plugins.trac.wordpress.org/changeset/3149290/give/tags/3.16.1/includes/process-donation.php - https://plugins.trac.wordpress.org/changeset/3149290/give/tags/3.16.1/includes/admin/admin-actions.php - https://plugins.trac.wordpress.org/changeset/3149290/give/tags/3.16.1/src/Helpers/Utils.php - https://plugins.trac.wordpress.org/changeset/3157829/give/tags/3.16.2/includes/process-donation.php
CVE ID: CVE-2024-8354 State: PUBLISHED Published: 2024-09-19T10:45:06.191Z Last Updated: 2025-11-08T08:56:17.010Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8 Advanced Virtualization, Red Hat Enterprise Linux 9 Problem Types: CWE-617 Description: A flaw was found in QEMU. An assertion failure was present in the usb_ep_get() function in hw/net/core.c when trying to get the USB endpoint from a USB device. This flaw may allow a malicious unprivileged guest user to crash the QEMU process on the host and
nt from a USB device. This flaw may allow a malicious unprivileged guest user to crash the QEMU process on the host and cause a denial of service condition. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2024-8354 - https://bugzilla.redhat.com/show_bug.cgi?id=2313497
CVE ID: CVE-2024-8355 State: PUBLISHED Published: 2024-11-22T21:32:37.615Z Last Updated: 2024-11-26T15:38:24.205Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Visteon Products: Infotainment Problem Types: CWE-89 Description: Visteon Infotainment System DeviceManager iAP Serial Number SQL Injection Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Visteon Infotainment system. Authentication is not required to exploit this vulnerability. The specific flaw exists within the DeviceManager. When parsing the iAP Serial number, the process does not properly validate a user-supplied string
hin the DeviceManager. When parsing the iAP Serial number, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-20112. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1208/
CVE ID: CVE-2024-8356 State: PUBLISHED Published: 2024-11-22T21:32:48.390Z Last Updated: 2024-11-25T01:43:36.441Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Visteon Products: Infotainment Problem Types: CWE-345 Description: Visteon Infotainment VIP MCU Code Insufficient Validation of Data Authenticity Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Visteon Infotainment systems. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the firmware update process
n the target system in order to exploit this vulnerability. The specific flaw exists within the firmware update process of the VIP microcontroller. The process does not properly verify authenticity of the supplied firmware image before programming it into internal memory. An attacker can leverage this vulnerability to escalate privileges execute arbitrary code in the context of the VIP MCU. Was ZDI-CAN-23758. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1188/
CVE ID: CVE-2024-8357 State: PUBLISHED Published: 2024-11-22T21:32:58.640Z Last Updated: 2024-11-25T01:43:36.596Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Visteon Products: Infotainment Problem Types: CWE-1326 Description: Visteon Infotainment App SoC Missing Immutable Root of Trust in Hardware Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Visteon Infotainment systems. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the configuration of the application system-o
authentication mechanism can be bypassed. The specific flaw exists within the configuration of the application system-on-chip (SoC). The issue results from the lack of properly configured hardware root of trust. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the boot process. Was ZDI-CAN-23759. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1189/
CVE ID: CVE-2024-8358 State: PUBLISHED Published: 2024-11-22T21:33:09.888Z Last Updated: 2024-11-25T01:43:36.843Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Visteon Products: Infotainment Problem Types: CWE-78 Description: Visteon Infotainment UPDATES_ExtractFile Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Visteon Infotainment systems. Authentication is not required to exploit this vulnerability. The specific flaw exists within the UPDATES_ExtractFile function. A crafted software update file can trigger execution of a system call comp
ists within the UPDATES_ExtractFile function. A crafted software update file can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23422. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1190/
CVE ID: CVE-2024-8359 State: PUBLISHED Published: 2024-11-22T21:33:19.843Z Last Updated: 2024-11-25T01:43:36.966Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Visteon Products: Infotainment Problem Types: CWE-78 Description: Visteon Infotainment REFLASH_DDU_FindFile Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Visteon Infotainment systems. Authentication is not required to exploit this vulnerability. The specific flaw exists within the REFLASH_DDU_FindFile function. A crafted software update file can trigger execution of a system call co
xists within the REFLASH_DDU_FindFile function. A crafted software update file can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23420. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1191/
CVE ID: CVE-2024-8360 State: PUBLISHED Published: 2024-11-22T21:33:32.855Z Last Updated: 2024-11-25T01:36:35.700Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Visteon Products: Infotainment Problem Types: CWE-78 Description: Visteon Infotainment REFLASH_DDU_ExtractFile Command Injection Remote Code Execution Vulnerability. This vulnerability allows physically present attackers to execute arbitrary code on affected installations of Visteon Infotainment systems. Authentication is not required to exploit this vulnerability. The specific flaw exists within the REFLASH_DDU_ExtractFile function. A crafted software update file can trigger execution of a system c
w exists within the REFLASH_DDU_ExtractFile function. A crafted software update file can trigger execution of a system call composed from a user-supplied string. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-23421. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-24-1192/
CVE ID: CVE-2024-8361 State: PUBLISHED Published: 2025-01-07T16:18:14.776Z Last Updated: 2025-09-16T16:10:05.729Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: silabs.com Products: WiSeConnect SDK Problem Types: CWE-131, CWE-617 Description: In SiWx91x devices, the SHA2/224 algorithm returns a hash of 256 bits instead of 224 bits. This incorrect hash length triggers a software assertion, which subsequently causes a Denial of Service (DoS). If a watchdog is implemented, device will restart after watch dog expires. If watchdog is not implemented, device can be recovered only after a hard reset Additional Analyst Notes: - CISA ADP Vulnrichment: References: - ht
ted, device can be recovered only after a hard reset Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://community.silabs.com/068Vm00000I7zqo
CVE ID: CVE-2024-8362 State: PUBLISHED Published: 2024-09-03T22:40:26.146Z Last Updated: 2024-09-05T03:55:51.737Z Vendors: Google Products: Chrome Problem Types: CWE-416 Description: Use after free in WebAudio in Google Chrome prior to 128.0.6613.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2024/09/stable-channel-update-for-desktop.html - https://issues.chromium.org/issues/357391257
CVE ID: CVE-2024-8363 State: PUBLISHED Published: 2024-09-05T08:30:09.466Z Last Updated: 2024-09-05T19:51:37.355Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mihail-barinov Products: Share This Image Problem Types: CWE-79 Description: The Share This Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's STI Buttons shortcode in all versions up to, and including, 2.02 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user ac
, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d01b6056-a38d-4a60-9cdc-68663aa2aed6?source=cve - https://plugins.trac.wordpress.org/browser/share-this-image/tags/2.02/includes/class-sti-shortcodes.php#L40 - https://wordpress.org/plugins/share-this-image/#developers - https://plugins.trac.wordpress.org/changeset/3146524/
CVE ID: CVE-2024-8364 State: PUBLISHED Published: 2024-09-19T03:59:15.577Z Last Updated: 2024-09-19T14:24:11.179Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: dondon-benjamincouk Products: WP Custom Fields Search Problem Types: CWE-79 Description: The WP Custom Fields Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpcfs-preset shortcode in all versions up to, and including, 1.2.35 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will exec
uthenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ef36a2a1-b3be-4270-8890-76705817b4b5?source=cve - https://plugins.trac.wordpress.org/browser/wp-custom-fields-search/trunk/plugin.php#L53 - https://wordpress.org/plugins/wp-custom-fields-search/#developers
CVE ID: CVE-2024-8365 State: PUBLISHED Published: 2024-09-02T01:30:56.618Z Last Updated: 2024-09-04T17:18:36.980Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N) Vendors: HashiCorp Products: Vault, Vault Enterprise Problem Types: CWE-532 Description: Vault Community Edition and Vault Enterprise experienced a regression where functionality that HMAC’d sensitive headers in the configured audit device, specifically client tokens and token accessors, was removed. This resulted in the plaintext values of client tokens and token accessors being stored in the audit log. This vulnerability, CVE-2024-8365, was fixed in Vault Community Edition and Vault Enterprise 1.17.5 and V
the audit log. This vulnerability, CVE-2024-8365, was fixed in Vault Community Edition and Vault Enterprise 1.17.5 and Vault Enterprise 1.16.9. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2024-18-vault-leaks-client-token-and-token-accessor-in-audit-devices/
CVE ID: CVE-2024-8366 State: PUBLISHED Published: 2024-08-31T18:00:04.959Z Last Updated: 2024-09-03T13:57:48.125Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: code-projects Products: Pharmacy Management System Problem Types: CWE-79 Description: A vulnerability was found in code-projects Pharmacy Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /index.php?id=userProfileEdit of the component Update My Profile Page. The manipulation of the argument fname/lname/email with the input <script>alert(1)</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public
ds to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276261 - https://vuldb.com/?ctiid.276261 - https://vuldb.com/?submit.398777 - https://code-projects.org/
CVE ID: CVE-2024-8367 State: PUBLISHED Published: 2024-09-01T04:00:05.840Z Last Updated: 2024-09-03T14:06:34.449Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: HM Courts & Tribunals Service Products: Probate Back Office Problem Types: CWE-74 Description: A vulnerability was found in HM Courts & Tribunals Service Probate Back Office up to c1afe0cdb2b2766d9e24872c4e827f8b82a6cd31. It has been classified as problematic. Affected is an unknown function of the file src/main/java/uk/gov/hmcts/probate/service/NotificationService.java of the component Markdown Handler. The manipulation leads to injection. Continious delivery with rolling releases is used by this prod
nt Markdown Handler. The manipulation leads to injection. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The patch is identified as d90230d7cf575e5b0852d56660104c8bd2503c34. It is recommended to apply a patch to fix this issue. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.276270 - https://vuldb.com/?ctiid.276270 - https://tools.hmcts.net/jira/browse/DTSPB-4180 - https://github.com/hmcts/probate-back-office/pull/2614 - https://github.com/hmcts/probate-back-office/commit/d90230d7cf575e5b0852d56660104c8bd2503c34
CVE ID: CVE-2024-8368 State: PUBLISHED Published: 2024-09-01T05:00:05.355Z Last Updated: 2024-09-03T14:08:21.001Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects Products: Hospital Management System Problem Types: CWE-89 Description: A vulnerability was found in code-projects Hospital Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file index.php of the component Login. The manipulation of the argument username leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http