Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-50842 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-14T18:37:28.976Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability was found in /admin/school_year.php in KASHIPARA E-learning Management System Project 1.0. This vulnerability allows remote attackers to execute arbitrary scripts via the school_year parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/Kashipara/E-learning%20Management%20System%20project/Stored%20XSS%20-%20School%20Year.pdf
CVE ID: CVE-2024-50843 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-14T18:34:05.638Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Directory listing issue was found in PHPGurukul User Registration & Login and User Management System 3.2, which allows remote attackers attacker to access sensitive files and directories via /loginsystem/assets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/m14r41/Writeups/blob/main/CVE/phpGurukul/User%20Registration%20&%20Login%20and%20User%20Management%20System%20With%20admin%20panel/Directory%20listings.md
CVE ID: CVE-2024-50848 State: PUBLISHED Published: 2024-11-18T00:00:00.000Z Last Updated: 2025-10-20T15:42:42.861Z Vendors: n/a Products: n/a Problem Types: n/a Description: An XML External Entity (XXE) vulnerability in the Import object and Translation Memory import functionalities of WorldServer v11.8.2 to access sensitive information and execute arbitrary commands via supplying a crafted .tmx file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.trados.com/product/worldserver/ - https://github.com/Wh1teSnak3/CVE-2024-50848 - https://github.com/1mhr4b/CVE-2024-50848
CVE ID: CVE-2024-50849 State: PUBLISHED Published: 2024-11-18T00:00:00.000Z Last Updated: 2025-10-20T15:39:29.765Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Stored Cross-Site Scripting (XSS) vulnerability in the "Rules" functionality of WorldServer v11.8.2 allows a remote authenticated attacker to execute arbitrary JavaScript code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.trados.com/product/worldserver/ - https://github.com/Wh1teSnak3/CVE-2024-50849 - https://github.com/1mhr4b/CVE-2024-50849
CVE ID: CVE-2024-50852 State: PUBLISHED Published: 2024-11-13T00:00:00 Last Updated: 2024-11-21T16:42:35.758Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda G3 v3.0 v15.11.0.20 was discovered to contain a command injection vulnerability via the formSetUSBPartitionUmount function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zp9080/Tenda/blob/main/Tenda-G3v3.0%20V15.11.0.20-formSetUSBPartitionUmount/overview.md
CVE ID: CVE-2024-50853 State: PUBLISHED Published: 2024-11-13T00:00:00 Last Updated: 2024-11-21T16:42:03.474Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda G3 v3.0 v15.11.0.20 was discovered to contain a command injection vulnerability via the formSetDebugCfg function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zp9080/Tenda/blob/main/Tenda-G3v3.0%20V15.11.0.20-formSetDebugCfg/overview.md
CVE ID: CVE-2024-50854 State: PUBLISHED Published: 2024-11-13T00:00:00.000Z Last Updated: 2025-03-14T17:03:32.853Z Vendors: n/a Products: n/a Problem Types: n/a Description: Tenda G3 v3.0 v15.11.0.20 was discovered to contain a stack overflow via the formSetPortMapping function. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/zp9080/Tenda/blob/main/Tenda-G3v3.0%20V15.11.0.20-formSetPortMapping/overview.md
CVE ID: CVE-2024-50857 State: PUBLISHED Published: 2025-01-14T00:00:00 Last Updated: 2025-01-15T20:04:28.764Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ip_do_job request in GestioIP v3.5.7 is vulnerable to Cross-Site Scripting (XSS). It allows data exfiltration and enables CSRF attacks. The vulnerability requires specific user permissions within the application to exploit successfully. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/muebel/gestioip-docker-compose - http://www.gestioip.net - https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50857
CVE ID: CVE-2024-50858 State: PUBLISHED Published: 2025-01-14T00:00:00 Last Updated: 2025-01-15T16:12:19.991Z Vendors: n/a Products: n/a Problem Types: n/a Description: Multiple endpoints in GestioIP v3.5.7 are vulnerable to Cross-Site Request Forgery (CSRF). An attacker can execute actions via the admin's browser by hosting a malicious URL, leading to data modification, deletion, or exfiltration. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/muebel/gestioip-docker-compose - http://www.gestioip.net - https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50858
CVE ID: CVE-2024-50859 State: PUBLISHED Published: 2025-01-14T00:00:00 Last Updated: 2025-01-15T19:11:06.155Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ip_import_acl_csv request in GestioIP v3.5.7 is vulnerable to Reflected XSS. When a user uploads an improperly formatted file, the content may be reflected in the HTML response, allowing the attacker to execute malicious scripts or exfiltrate data. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/muebel/gestioip-docker-compose - http://www.gestioip.net - https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50859
CVE ID: CVE-2024-50861 State: PUBLISHED Published: 2025-01-14T00:00:00 Last Updated: 2025-01-15T16:42:31.035Z Vendors: n/a Products: n/a Problem Types: n/a Description: The ip_mod_dns_key_form.cgi request in GestioIP v3.5.7 is vulnerable to Stored XSS. An attacker can inject malicious code into the "TSIG Key" field, which is saved in the database and triggers XSS when viewed, enabling data exfiltration and CSRF attacks. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/muebel/gestioip-docker-compose - http://www.gestioip.net - https://github.com/maxibelino/CVEs/tree/main/CVE-2024-50861
CVE ID: CVE-2024-50919 State: PUBLISHED Published: 2024-11-18T00:00:00 Last Updated: 2024-11-19T15:16:25.828Z Vendors: n/a Products: n/a Problem Types: n/a Description: Jpress until v5.1.1 has arbitrary file uploads on the windows platform, and the construction of non-standard file formats such as .jsp. can lead to arbitrary command execution Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/JPressProjects/jpress - https://github.com/microvorld/CVE-2024/blob/main/jpress.md - https://gist.github.com/microvorld/516552dcef65acc2d1ab0fb969cd34a3
CVE ID: CVE-2024-50920 State: PUBLISHED Published: 2024-12-10T00:00:00 Last Updated: 2024-12-11T15:44:04.751Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to create a fake node via supplying crafted packets. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CNK2100/2024-CVE/blob/main/README.md
CVE ID: CVE-2024-50921 State: PUBLISHED Published: 2024-12-10T00:00:00 Last Updated: 2024-12-11T21:03:54.481Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause a Denial of Service (DoS) via repeatedly sending crafted packets to the controller. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CNK2100/2024-CVE/blob/main/README.md
CVE ID: CVE-2024-50924 State: PUBLISHED Published: 2024-12-10T00:00:00 Last Updated: 2024-12-11T21:13:11.234Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause disrupt communications between the controller and the device itself via repeatedly sending crafted packets to the controller. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CNK2100/2024-CVE/blob/main/README.md
CVE ID: CVE-2024-50928 State: PUBLISHED Published: 2024-12-10T00:00:00 Last Updated: 2024-12-11T21:14:18.191Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to change the wakeup interval of end devices in controller memory, disrupting the device's communications with the controller. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CNK2100/2024-CVE/blob/main/README.md
CVE ID: CVE-2024-50929 State: PUBLISHED Published: 2024-12-10T00:00:00 Last Updated: 2024-12-11T15:41:41.300Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure permissions in Silicon Labs (SiLabs) Z-Wave Series 700 and 800 v7.21.1 allow attackers to arbitrarily change the device type in the controller's memory, leading to a Denial of Service (DoS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CNK2100/2024-CVE/blob/main/README.md
CVE ID: CVE-2024-50930 State: PUBLISHED Published: 2024-12-10T00:00:00 Last Updated: 2024-12-11T21:16:48.205Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Silicon Labs Z-Wave Series 500 v6.84.0 allows attackers to execute arbitrary code. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CNK2100/2024-CVE/blob/main/README.md
CVE ID: CVE-2024-50931 State: PUBLISHED Published: 2024-12-10T00:00:00 Last Updated: 2024-12-11T15:37:57.181Z Vendors: n/a Products: n/a Problem Types: n/a Description: Silicon Labs Z-Wave Series 500 v6.84.0 was discovered to contain insecure permissions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/CNK2100/2024-CVE/blob/main/README.md
CVE ID: CVE-2024-50942 State: PUBLISHED Published: 2024-11-26T00:00:00 Last Updated: 2024-12-04T16:35:01.726Z Vendors: n/a Products: n/a Problem Types: n/a Description: qiwen-file v1.4.0 was discovered to contain a SQL injection vulnerability via the component /mapper/NoticeMapper.xml. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://qiwen-file.com - https://www.qiwenshare.com/ - https://gist.github.com/3xsh0re/4253401806bc35b2f95dcea12a4310fc
CVE ID: CVE-2024-50944 State: PUBLISHED Published: 2024-12-27T00:00:00 Last Updated: 2024-12-28T18:25:16.966Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow vulnerability exists in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f in the shopping cart functionality. The issue lies in the quantity parameter in the CartController's AddToCart method. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/simplcommerce/SimplCommerce - https://www.simplcommerce.com/ - https://github.com/AbdullahAlmutawa/CVE-2024-50944 - https://github.com/simplcommerce/SimplCommerce/issues/1110
CVE ID: CVE-2024-50945 State: PUBLISHED Published: 2024-12-27T00:00:00.000Z Last Updated: 2025-03-18T18:20:30.198Z Vendors: n/a Products: n/a Problem Types: n/a Description: An improper access control vulnerability exists in SimplCommerce at commit 230310c8d7a0408569b292c5a805c459d47a1d8f, allowing users to submit reviews without verifying if they have purchased the product. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/simplcommerce/SimplCommerce - https://www.simplcommerce.com/ - https://github.com/AbdullahAlmutawa/CVE-2024-50945
CVE ID: CVE-2024-50947 State: PUBLISHED Published: 2024-12-04T00:00:00 Last Updated: 2024-12-05T19:12:59.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in kmqtt v0.2.7 allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/davidepianca98/KMQTT - https://gist.github.com/pengwGit/40934164f68a8a45ebaacfcdeb598fcb
CVE ID: CVE-2024-50948 State: PUBLISHED Published: 2024-12-03T00:00:00 Last Updated: 2024-12-04T21:19:06.894Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in mochiMQTT v2.6.3 allows attackers to cause a Denial of Service (DoS) via a crafted request. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/mochi-mqtt/server - https://gist.github.com/pengwGit/39760ed5ae03171622ca8215dc0d8c60
CVE ID: CVE-2024-50953 State: PUBLISHED Published: 2025-01-15T00:00:00.000Z Last Updated: 2025-03-24T16:36:21.773Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in XINJE XL5E-16T V3.7.2a allows attackers to cause a Denial of Service (DoS) via a crafted Modbus message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Curator-Kim/Vulnerability-mining/blob/master/XINJE%20XL5E-16T%20Modbus/XINJE%20XL5E-16T%20Modbus%20DoS.md
CVE ID: CVE-2024-50954 State: PUBLISHED Published: 2025-01-15T00:00:00.000Z Last Updated: 2025-03-20T13:39:02.562Z Vendors: n/a Products: n/a Problem Types: n/a Description: The XINJE XL5E-16T and XD5E-24R-E programmable logic controllers V3.5.3b-V3.7.2a have a vulnerability in handling Modbus messages. When a TCP connection is established with the above series of controllers within a local area network (LAN), sending a specific Modbus message to the controller can cause the PLC to crash, interrupting the normal operation of the programs running in the PLC. This results in the ERR indicator light turning on and the RUN indicator light turning off. Additional Analyst Notes: - CISA ADP Vulnric
the ERR indicator light turning on and the RUN indicator light turning off. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Curator-Kim/Vulnerability-mining/blob/master/XINJE%20XL5E-16T%20XD5E-24R%20Modbus/XINJE%20XL5E-16T%20XD5E-24R%20Modbus.md
CVE ID: CVE-2024-50955 State: PUBLISHED Published: 2024-11-13T00:00:00.000Z Last Updated: 2025-03-13T18:32:48.715Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in how XINJE XD5E-24R and XL5E-16T v3.5.3b handles TCP protocol messages allows attackers to cause a Denial of Service (DoS) via a crafted TCP message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Curator-Kim/Vulnerability-mining/blob/master/XINJE%20XD5E-24R%20XL5E-16T%20TCP%20DoS/XINJE%20XD5E-24R%20XL5E-16T%20TCP%20DoS.md
CVE ID: CVE-2024-50956 State: PUBLISHED Published: 2024-11-13T00:00:00 Last Updated: 2024-11-25T19:24:53.213Z Vendors: n/a Products: n/a Problem Types: n/a Description: A buffer overflow in the RecvSocketData function of Inovance HCPLC_AM401-CPU1608TPTN 21.38.0.0, HCPLC_AM402-CPU1608TPTN 41.38.0.0, and HCPLC_AM403-CPU1608TN 81.38.0.0 allows attackers to cause a Denial of Service (DoS) or execute arbitrary code via a crafted Modbus message. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Curator-Kim/Vulnerability-mining/blob/master/INOVANCE%20AM400%20Series%20Modbus%20buffer%20overflow/INOVANCE%20AM400%20Series%20Modbus%20buffer%20overflow.md
CVE ID: CVE-2024-50960 State: PUBLISHED Published: 2025-04-15T00:00:00.000Z Last Updated: 2025-04-18T13:25:21.966Z Vendors: n/a Products: n/a Problem Types: n/a Description: A command injection vulnerability in the Nmap diagnostic tool in the admin web console of Extron SMP 111 <=3.01, SMP 351 <=2.16, SMP 352 <= 2.16, and SME 211 <= 3.02, allows a remote authenticated attacker to execute arbitrary commands as root on the underlying operating system. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.extron.com/article/smp - https://ryanmroth.com/articles/exploiting-extron-smp-command-injection - https://github.com/layer8secure/extron-smp-inject/
CVE ID: CVE-2024-50965 State: PUBLISHED Published: 2024-11-22T00:00:00 Last Updated: 2024-11-22T17:43:42.786Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting vulnerability in Public Knowledge Project PKP Platform OJS/OMP/OPS- before v.3.3.0.16 allows an attacker to execute arbitrary code and escalate privileges via a crafted script Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://openjournaltheme.com/urgent-critical-vulnerabilities-in-3-3-0-18-upgrade-your-ojs-now/
CVE ID: CVE-2024-50966 State: PUBLISHED Published: 2024-11-08T00:00:00 Last Updated: 2024-11-08T17:26:20.459Z Vendors: n/a Products: n/a Problem Types: n/a Description: dingfanzu CMS V1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/doAdminAction.php?act=addAdmin. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/evenomn/YangYiWen/tree/main/11
CVE ID: CVE-2024-50967 State: PUBLISHED Published: 2025-01-17T00:00:00.000Z Last Updated: 2025-02-04T15:13:09.871Z Vendors: n/a Products: n/a Problem Types: n/a Description: The /rest/rights/ REST API endpoint in Becon DATAGerry through 2.2.0 contains an Incorrect Access Control vulnerability. An attacker can remotely access this endpoint without authentication, leading to unauthorized disclosure of sensitive information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://datagerry.readthedocs.io/en/latest/api/rest/user-management.html#rights - https://medium.com/@0xbytehunter/my-first-cve-discovery-of-broken-access-control-in-the-datagerry-platform-7b0404f88a43 - https
/medium.com/@0xbytehunter/my-first-cve-discovery-of-broken-access-control-in-the-datagerry-platform-7b0404f88a43 - https://github.com/0xByteHunter/CVE-2024-50967
CVE ID: CVE-2024-50968 State: PUBLISHED Published: 2024-11-14T00:00:00 Last Updated: 2024-11-20T16:15:49.251Z Vendors: n/a Products: n/a Problem Types: n/a Description: A business logic vulnerability exists in the Add to Cart function of itsourcecode Agri-Trading Online Shopping System 1.0, which allows remote attackers to manipulate the quant parameter when adding a product to the cart. By setting the quantity value to -0, an attacker can exploit a flaw in the application's total price calculation logic. This vulnerability causes the total price to be reduced to zero, allowing the attacker to add items to the cart and proceed to checkout. Additional Analyst Notes: - CISA ADP Vulnrichment: R
wing the attacker to add items to the cart and proceed to checkout. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/Akhlak2511/CVE-2024-50968
CVE ID: CVE-2024-50969 State: PUBLISHED Published: 2024-11-13T00:00:00 Last Updated: 2024-11-20T23:05:22.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Reflected cross-site scripting (XSS) vulnerability in browse.php of Code-projects Jonnys Liquor 1.0 allows remote attackers to inject arbitrary web scripts or HTML via the search parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://code-projects.org/jonnys-liquor-in-php-css-javascript-and-mysql-free-download/ - https://github.com/Akhlak2511/CVE-2024-50969
CVE ID: CVE-2024-50970 State: PUBLISHED Published: 2024-11-13T00:00:00 Last Updated: 2024-11-18T19:28:00.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in orderview1.php of Itsourcecode Online Furniture Shopping Project 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://itsourcecode.com/free-projects/php-project/online-furniture-shop-in-php-projects-free-source-code-and-database/ - https://github.com/Akhlak2511/CVE-2024-50970
CVE ID: CVE-2024-50971 State: PUBLISHED Published: 2024-11-13T00:00:00 Last Updated: 2024-11-18T19:26:37.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in print.php of Itsourcecode Construction Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the map_id parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://itsourcecode.com/free-projects/php-project/construction-management-system-project-in-php-with-source-code/ - https://github.com/Akhlak2511/CVE-2024-50971
CVE ID: CVE-2024-50972 State: PUBLISHED Published: 2024-11-13T00:00:00 Last Updated: 2024-11-18T19:25:44.454Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in printtool.php of Itsourcecode Construction Management System 1.0 allows remote attackers to execute arbitrary SQL commands via the borrow_id parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://itsourcecode.com/free-projects/php-project/construction-management-system-project-in-php-with-source-code/ - https://github.com/Akhlak2511/CVE-2024-50972
CVE ID: CVE-2024-50983 State: PUBLISHED Published: 2024-11-15T00:00:00 Last Updated: 2024-11-18T19:03:58.147Z Vendors: n/a Products: n/a Problem Types: n/a Description: FlightPath 7.5 contains a Cross Site Scripting (XSS) vulnerability, which allows authenticated remote attackers with administrative rights to inject arbitrary JavaScript in the web browser of a user by including a malicious payload into the Last Name section in the Create/Edit Faculty/Staff User or Create/Edit Student User sections. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/swampopus/flightpath/blob/e713acf9f125af22cc68c2f5664c2869cd73616b/flightpath/CHANGELOG.txt#L4 - https://github.
hub.com/swampopus/flightpath/blob/e713acf9f125af22cc68c2f5664c2869cd73616b/flightpath/CHANGELOG.txt#L4 - https://github.com/redhotchilihacker1/CVE-Hunting/blob/master/CVE-2024-50983/README.md
CVE ID: CVE-2024-50986 State: PUBLISHED Published: 2024-11-15T00:00:00 Last Updated: 2024-11-29T21:08:28.428Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Clementine v.1.3.1 allows a local attacker to execute arbitrary code via a crafted DLL file. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.clementine-player.org/ - https://github.com/clementine-player/Clementine - https://github.com/riftsandroses/CVE-2024-50986/
CVE ID: CVE-2024-50989 State: PUBLISHED Published: 2024-11-11T00:00:00 Last Updated: 2024-11-12T17:11:10.551Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in /omrs/admin/search.php in PHPGurukul Online Marriage Registration System v1.0 allows an attacker to execute arbitrary SQL commands via the "searchdata " parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vkcyberexpert/CVE-Writeup/blob/main/PHPGurukul/Marriage%20Registration/SQL%20Injction.pdf.pdf
CVE ID: CVE-2024-50990 State: PUBLISHED Published: 2024-11-11T00:00:00 Last Updated: 2024-11-12T19:12:55.145Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Reflected Cross Site Scriptng (XSS) vulnerability was found in /omrs/user/search.php in PHPGurukul Online Marriage Registration System v1.0, which allows remote attackers to execute arbitrary code via the "searchdata" POST request parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vkcyberexpert/CVE-Writeup/blob/main/PHPGurukul/Marriage%20Registration/Marriage%20reflected%20in%20userpage.pdf
CVE ID: CVE-2024-50991 State: PUBLISHED Published: 2024-11-11T00:00:00 Last Updated: 2024-11-12T19:11:09.211Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability was found in /ums-sp/admin/registered-users.php in PHPGurukul User Management System v1.0, which allows remote attackers to execute arbitrary code via the "fname" POST request parameter Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/vkcyberexpert/CVE-Writeup/blob/main/PHPGurukul/User%20Management/Ums%20%20XSS%20pdf.pdf