Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
p to, and including, 3.1.15.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update limited arbitrary options on the WordPress site. This can be leveraged to update the Subscriber role with Administrator-level capabilities to gain administrative user access to a vulnerable site. The vulnerability is limited in that the option updated must have a value that is an array. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/13d9a59f-1a1a-4936-a5ab-8a5e0c50303b?source=cve - https://plugins.trac.wordpress.org/browser/classified-listing/tags/3.1.12/app/Controllers/Ajax/Import.php#
?source=cve - https://plugins.trac.wordpress.org/browser/classified-listing/tags/3.1.12/app/Controllers/Ajax/Import.php#L473 - https://plugins.trac.wordpress.org/browser/classified-listing/tags/3.1.12/app/Controllers/Ajax/Import.php#L309 - https://plugins.trac.wordpress.org/changeset/3189516/
CVE ID: CVE-2024-11195 State: PUBLISHED Published: 2024-11-19T11:02:30.125Z Last Updated: 2024-11-19T14:27:18.887Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: nik00726 Products: Email Subscription Popup Problem Types: CWE-79 Description: The Email Subscription Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's print_email_subscribe_form shortcode in all versions up to, and including, 1.2.22 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that wil
for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f8c18b0d-15fe-45d6-9915-85d38803c117?source=cve - https://plugins.trac.wordpress.org/browser/email-subscribe/tags/1.2.22/wp-email-subscription.php#L2860 - https://wordpress.org/plugins/email-subscribe/#developers - https://plugins.trac.wordpress.org/changeset/3189989/
CVE ID: CVE-2024-11196 State: PUBLISHED Published: 2024-12-21T07:03:02.065Z Last Updated: 2024-12-28T00:50:11.791Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: tugbucket Products: Multi-column Tag Map Problem Types: CWE-79 Description: The Multi-column Tag Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mctagmap shortcode in all versions up to, and including, 17.0.33 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a use
kers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bb41862a-0cde-46f0-bd86-5a04e76f7345?source=cve - https://plugins.trac.wordpress.org/browser/multi-column-tag-map/tags/17.0.33/mctagmap_functions.php#L135 - https://plugins.trac.wordpress.org/browser/multi-column-tag-map/tags/17.0.33/mctagmap_functions.php#L1176 - https://plugins.trac.wordpress.org/browser/multi-column-tag-map/tags/17.0.33/mctagmap_functions.php#L1179 - https://wordpress.org/plugins/multi-column-tag-map/#dev
multi-column-tag-map/tags/17.0.33/mctagmap_functions.php#L1179 - https://wordpress.org/plugins/multi-column-tag-map/#developers
CVE ID: CVE-2024-11197 State: PUBLISHED Published: 2024-11-21T02:06:34.525Z Last Updated: 2024-11-21T11:40:11.462Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: babatechs Products: Lock User Account Problem Types: CWE-693 Description: The Lock User Account plugin for WordPress is vulnerable to user lock bypass in all versions up to, and including, 1.0.5. This is due to permitting application password logins when user accounts are locked. This makes it possible for authenticated attackers, with existing application passwords, to interact with the vulnerable site via an API such as XML-RPC or REST despite their account being locked. Additional Analyst Notes:
ith the vulnerable site via an API such as XML-RPC or REST despite their account being locked. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/63374c5c-0b0a-4091-9aee-2e6c1d17a1b2?source=cve - https://wordpress.org/plugins/lock-user-account/
CVE ID: CVE-2024-11198 State: PUBLISHED Published: 2024-11-19T12:45:31.893Z Last Updated: 2024-11-19T14:01:50.378Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: gdragon Products: GD Rating System Problem Types: CWE-79 Description: The GD Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘extra_class’ parameter in all versions up to, and including, 3.6.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Anal
e, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/66cad18d-a433-47f1-9cb6-c619c8717a0d?source=cve - https://plugins.trac.wordpress.org/browser/gd-rating-system/tags/3.6.1/d4plib/plugin/d4p.shortcodes.php#L63 - https://wordpress.org/plugins/gd-rating-system/#developers - https://plugins.trac.wordpress.org/changeset/3189622/
CVE ID: CVE-2024-11199 State: PUBLISHED Published: 2024-11-23T09:39:09.745Z Last Updated: 2024-11-23T13:18:19.743Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: rescuethemes Products: Rescue Shortcodes Problem Types: CWE-79 Description: The Rescue Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's rescue_progressbar shortcode in all versions up to, and including, 2.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a
tackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a188c615-513b-4d65-8351-d70848696297?source=cve - https://plugins.trac.wordpress.org/browser/rescue-shortcodes/tags/2.9/includes/shortcode-functions.php#L379 - https://wordpress.org/plugins/rescue-shortcodes/#developers - https://plugins.trac.wordpress.org/changeset/3193428/
CVE ID: CVE-2024-11200 State: PUBLISHED Published: 2024-12-03T13:55:33.824Z Last Updated: 2024-12-03T14:19:58.554Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: GoodLayers Products: Goodlayers Core Problem Types: CWE-79 Description: The Goodlayers Core plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘font-family’ parameter in all versions up to, and including, 2.0.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additio
n pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/e1baa3f0-28ec-409f-a9a5-c35545ab439a?source=cve - https://goodlayers.com/
CVE ID: CVE-2024-11201 State: PUBLISHED Published: 2024-12-06T05:26:14.441Z Last Updated: 2024-12-06T14:18:27.323Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpexpertsio Products: myCred – Exclusive Platform for Loyalty Points and Rewards – Create Leaderboards, Ranks, Badges, Cashback Coupons, Referral Programs, WooCommerce & eCommerce wallet, Gamification Awards, and Achievements. Problem Types: CWE-79 Description: The myCred – Loyalty Points and Rewards plugin for WordPress and WooCommerce – Give Points, Ranks, Badges, Cashback, WooCommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to Stored Cross-Site Script
ommerce rewards, and WooCommerce credits for Gamification plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mycred_send shortcode in all versions up to, and including, 2.7.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2d1d9bee-4afa-44cc-8e7a-8a73ad018c4a?source=cve - https://plugins.trac.wordpress.org/
om/threat-intel/vulnerabilities/id/2d1d9bee-4afa-44cc-8e7a-8a73ad018c4a?source=cve - https://plugins.trac.wordpress.org/browser/mycred/tags/2.7.5/includes/shortcodes/mycred_send.php#L63 - https://wordpress.org/plugins/mycred/#developers - https://plugins.trac.wordpress.org/changeset/3203071/mycred/trunk/includes/shortcodes/mycred_send.php
CVE ID: CVE-2024-11202 State: PUBLISHED Published: 2024-11-26T07:31:31.790Z Last Updated: 2024-11-26T14:09:25.025Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: creativemindssolutions Products: CM WordPress Search And Replace Plugin, Video Lessons Manager – WordPress LMS Plugin, CM Tooltip Glossary, CM Pop-Up Banners for WordPress, CM Header & Footer Script Loader – Insert Script Plugin, Name: CM E-Mail Registration Blacklist, CM Business Directory Plugin – Business Listing Directory Problem Types: CWE-79 Description: Multiple plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the cminds_free_guide shortcode in various versions due
WordPress are vulnerable to Reflected Cross-Site Scripting via the cminds_free_guide shortcode in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/db759c60-9ce9-407d-8d1f-cbbfd09759d5?source=cve - https://plugins.trac.wordpress.org/browser/cm-pop-up-banners/trunk/package/cminds-free.php#L1471 - https://wordpress.org/plugins/cm-pop-up-banners/#deve
rg/browser/cm-pop-up-banners/trunk/package/cminds-free.php#L1471 - https://wordpress.org/plugins/cm-pop-up-banners/#developers - https://plugins.trac.wordpress.org/browser/cm-header-footer-script-loader/trunk/package/cminds-free.php#L1465 - https://plugins.trac.wordpress.org/browser/enhanced-tooltipglossary/trunk/package/cminds-free.php#L1465 - https://plugins.trac.wordpress.org/browser/cm-business-directory/trunk/package/cminds-free.php#L1465 - https://plugins.trac.wordpress.org/browser/cm-video-lesson-manager/trunk/package/cminds-free.php#L1465 - https://plugins.trac.wordpress.org/browser/cm-email-blacklist/trunk/package/cminds-free.php#L1465 - https://plugins.trac.wordpress.org/browser/cm
press.org/browser/cm-email-blacklist/trunk/package/cminds-free.php#L1465 - https://plugins.trac.wordpress.org/browser/cm-on-demand-search-and-replace/trunk/package/cminds-free.php#L1469 - https://plugins.trac.wordpress.org/changeset/3191536/ - https://plugins.trac.wordpress.org/changeset/3192416/ - https://plugins.trac.wordpress.org/changeset/3193808/ - https://plugins.trac.wordpress.org/changeset/3192354/ - https://plugins.trac.wordpress.org/changeset/3194393/ - https://plugins.trac.wordpress.org/changeset/3192808/ - https://plugins.trac.wordpress.org/changeset/3192381/
CVE ID: CVE-2024-11203 State: PUBLISHED Published: 2024-11-28T08:47:30.755Z Last Updated: 2024-11-28T12:45:20.255Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: wpdevteam Products: EmbedPress – Embed PDF, PDF 3D FlipBook, Instagram Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Maps & Upload PDF Documents Problem Types: CWE-79 Description: The EmbedPress – Embed PDF, 3D Flipbook, Social Feeds, Google Docs, Vimeo, Wistia, YouTube Videos, Audios, Google Maps in Gutenberg Block & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘provider_name parameter in all versions up to, and including, 4.1.3 due to insufficien
red Cross-Site Scripting via the ‘provider_name parameter in all versions up to, and including, 4.1.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/167dedfa-36cc-4b01-8ea4-8eda8742953c?source=cve - https://github.com/WPDevelopers/embedpress/blob/a6aa3339d9dc69ab6f9338ded073e5709173c2d4/vendor/wpdevelopers/embera/src/Embera/ProviderCollection/ProviderCollectionAdapte
aa3339d9dc69ab6f9338ded073e5709173c2d4/vendor/wpdevelopers/embera/src/Embera/ProviderCollection/ProviderCollectionAdapter.php#L173 - https://github.com/WPDevelopers/embedpress/blob/a6aa3339d9dc69ab6f9338ded073e5709173c2d4/EmbedPress/Shortcode.php#L240 - https://plugins.trac.wordpress.org/changeset/3196371/
CVE ID: CVE-2024-11204 State: PUBLISHED Published: 2024-12-06T08:24:57.746Z Last Updated: 2024-12-06T14:18:25.866Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: ultimatemember Products: ForumWP – Forum & Discussion Board Problem Types: CWE-79 Description: The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action s
to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cd11abe3-8307-492b-beef-242fb21a4206?source=cve - https://plugins.trac.wordpress.org/browser/forumwp/tags/2.1.1/includes/admin/class-columns.php#L313 - https://wordpress.org/plugins/forumwp/#developers
CVE ID: CVE-2024-11205 State: PUBLISHED Published: 2024-12-10T04:23:41.091Z Last Updated: 2024-12-10T21:09:53.252Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N) Vendors: smub Products: WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & More Problem Types: CWE-862 Description: The WPForms plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wpforms_is_admin_page' function in versions starting from 1.8.4 up to, and including, 1.9.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, to refund payments and cancel subscriptions. Additi
for authenticated attackers, with Subscriber-level access and above, to refund payments and cancel subscriptions. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/66898509-a93c-4dc3-bf01-1743daaa0ff1?source=cve - https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.9.2.1/includes/functions/checks.php#L191 - https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.9.2.1/src/Integrations/Stripe/Admin/Payments/SingleActionsHandler.php#L92 - https://plugins.trac.wordpress.org/browser/wpforms-lite/tags/1.9.2.1/src/Integrations/Stripe/Admin/Payments/SingleActionsHandler.php#L148 - https://plugins.trac.wordpre
ms-lite/tags/1.9.2.1/src/Integrations/Stripe/Admin/Payments/SingleActionsHandler.php#L148 - https://plugins.trac.wordpress.org/changeset/3191229/wpforms-lite#file2128
CVE ID: CVE-2024-11206 State: PUBLISHED Published: 2024-11-14T06:27:42.932Z Last Updated: 2025-09-05T06:30:24.484Z Vendors: TECNO Products: com.transsion.phoenix Problem Types: CWE-359 Description: Unauthorized access vulnerability in the mobile application (com.transsion.phoenix) can lead to the leakage of user information. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://security.tecno.com/SRC/blogdetail/340?lang=en_US - https://security.tecno.com/SRC/securityUpdates
CVE ID: CVE-2024-11207 State: PUBLISHED Published: 2024-11-14T12:31:04.225Z Last Updated: 2024-11-14T19:32:28.671Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: Apereo Products: CAS Problem Types: CWE-601 Description: A vulnerability has been found in Apereo CAS 6.6 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /login. The manipulation of the argument redirect_uri leads to open redirect. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA
. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284521 - https://vuldb.com/?ctiid.284521 - https://vuldb.com/?submit.437207 - https://gist.github.com/0xArthurSouza/68295d8fa20f18161945260fcdf842a2
CVE ID: CVE-2024-11208 State: PUBLISHED Published: 2024-11-14T13:31:04.929Z Last Updated: 2024-11-14T14:31:21.251Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Apereo Products: CAS Problem Types: CWE-613 Description: A vulnerability was found in Apereo CAS 6.6 and classified as problematic. Affected by this issue is some unknown functionality of the file /login?service. The manipulation leads to session expiration. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did
exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284522 - https://vuldb.com/?ctiid.284522 - https://vuldb.com/?submit.437211 - https://gist.github.com/0xArthurSouza/ce3b89887b03cc899d5e8cb6e472b04e - https://ibb.co/1LxSK2k
CVE ID: CVE-2024-11209 State: PUBLISHED Published: 2024-11-14T13:31:06.281Z Last Updated: 2024-11-14T14:29:15.472Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: Apereo Products: CAS Problem Types: CWE-287 Description: A vulnerability was found in Apereo CAS 6.6. It has been classified as critical. This affects an unknown part of the file /login?service of the component 2FA. The manipulation leads to improper authentication. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References:
rly about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284523 - https://vuldb.com/?ctiid.284523 - https://vuldb.com/?submit.437238 - https://gist.github.com/0xArthurSouza/281e8ea8a797abc8371a8ced31dc5562
CVE ID: CVE-2024-11210 State: PUBLISHED Published: 2024-11-14T14:31:04.816Z Last Updated: 2024-11-14T15:07:09.264Z Severity: N/A (CVSS 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P) Vendors: n/a Products: EyouCMS Problem Types: CWE-22 Description: A vulnerability was found in EyouCMS 1.51. It has been rated as critical. This issue affects the function editFile of the file application/admin/logic/FilemanagerLogic.php. The manipulation of the argument activepath leads to path traversal. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vul
endor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284525 - https://vuldb.com/?ctiid.284525 - https://vuldb.com/?submit.437451 - https://github.com/nn0nkey/nn0nkey/blob/main/eyoucms/mlcy.md
CVE ID: CVE-2024-11211 State: PUBLISHED Published: 2024-11-14T15:00:09.604Z Last Updated: 2025-01-06T17:57:36.113Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: n/a Products: EyouCMS Problem Types: CWE-434, CWE-284 Description: A vulnerability classified as critical has been found in EyouCMS up to 1.6.7. Affected is an unknown function of the component Website Logo Handler. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - htt
out this disclosure but did not respond in any way. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284526 - https://vuldb.com/?ctiid.284526 - https://vuldb.com/?submit.437600 - https://github.com/falling-snow1/cve/blob/main/EyouCMS_RCE.md
CVE ID: CVE-2024-11212 State: PUBLISHED Published: 2024-11-14T15:00:12.619Z Last Updated: 2024-11-14T16:10:29.491Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Best Employee Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Best Employee Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/fetch_product_details.php. The manipulation of the argument barcode leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vul
aunched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.284528 - https://vuldb.com/?ctiid.284528 - https://vuldb.com/?submit.442035 - https://github.com/physicszq/web_issue/blob/main/Management/sql_injection01.md - https://www.sourcecodester.com/