Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-3092 State: PUBLISHED Published: 2023-07-12T04:38:47.062Z Last Updated: 2025-02-05T19:40:28.812Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: photoboxone Products: SMTP Mail Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The SMTP Mail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an email subject in versions up to, and including, 1.2.16 due to insufficient input sanitization and output escaping when the 'Save Data SendMail' feature is enabled. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will
ture is enabled. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8ae734d1-0cd4-4ff5-8448-828b0fb64f70?source=cve - https://plugins.trac.wordpress.org/browser/smtp-mail/trunk/includes/data-list-table.php
CVE ID: CVE-2023-3093 State: PUBLISHED Published: 2023-07-12T04:38:45.199Z Last Updated: 2025-02-05T19:41:05.065Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: yaycommerce Products: YaySMTP – Simple WP SMTP Mail Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The YaySMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses
sible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/68e6ec3a-c5fd-4f63-a9a0-2c9ddfb96e2e?source=cve - https://plugins.trac.wordpress.org/changeset/2922163/
CVE ID: CVE-2023-3094 State: PUBLISHED Published: 2023-06-04T09:00:04.748Z Last Updated: 2024-08-02T06:48:07.092Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: code-projects Products: Agro-School Management System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in code-projects Agro-School Management System 1.0. Affected is the function doUpdateQuestion of the file btn_functions.php. The manipulation of the argument question_id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-230670 is the identifier assigned to this vulnerability. Additional Analyst
isclosed to the public and may be used. VDB-230670 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.230670 - https://vuldb.com/?ctiid.230670 - https://github.com/hotencode/CveHub/blob/main/Agro-School%20Management%20System%20btn_functions.php%20has%20Sqlinjection.pdf
CVE ID: CVE-2023-3095 State: PUBLISHED Published: 2023-06-04T00:00:00 Last Updated: 2025-01-08T19:54:09.449Z Severity: MEDIUM (CVSS 6.2 CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: nilsteampassnet Products: nilsteampassnet/teampass Problem Types: CWE-284 Description: Improper Access Control in GitHub repository nilsteampassnet/teampass prior to 3.0.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/35c899a9-40a0-4e17-bfb5-2a1430bc83c4 - https://github.com/nilsteampassnet/teampass/commit/774985f62f080715774604927fba2cb6ef701612
CVE ID: CVE-2023-3096 State: PUBLISHED Published: 2023-06-05T05:31:02.930Z Last Updated: 2024-11-22T15:41:11.378Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: KylinSoft Products: kylin-software-properties Problem Types: CWE-284 Description: A vulnerability was found in KylinSoft kylin-software-properties on KylinOS. It has been declared as critical. This vulnerability affects the function changedSource. The manipulation leads to improper access controls. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. Upgrading to version 0.0.1-130 is able to address this issue. It is recommended to upgrade the affecte
and may be used. Upgrading to version 0.0.1-130 is able to address this issue. It is recommended to upgrade the affected component. VDB-230686 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.230686 - https://vuldb.com/?ctiid.230686 - https://github.com/i900008/vulndb/blob/main/kylinos_vul1.md
CVE ID: CVE-2023-3097 State: PUBLISHED Published: 2023-06-05T06:00:04.476Z Last Updated: 2024-08-02T06:48:07.104Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: KylinSoft Products: kylin-software-properties Problem Types: CWE-78 Description: A vulnerability was found in KylinSoft kylin-software-properties on KylinOS. It has been rated as critical. This issue affects the function setMainSource. The manipulation leads to os command injection. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 0.0.1-130 is able to address this issue. It is recommended to upgrade the affected comp
ay be used. Upgrading to version 0.0.1-130 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-230687. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.230687 - https://vuldb.com/?ctiid.230687 - https://github.com/i900008/vulndb/blob/main/kylinos_vul2.md
CVE ID: CVE-2023-3098 State: PUBLISHED Published: 2023-06-05T06:31:03.614Z Last Updated: 2024-08-02T06:48:07.044Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: KylinSoft Products: youker-assistant Problem Types: CWE-24 Description: A vulnerability classified as critical has been found in KylinSoft youker-assistant on KylinOS. Affected is the function restore_all_sound_file. The manipulation leads to path traversal: '../filedir'. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. Upgrading to version 3.0.2-0kylin6k70-23 is able to address this issue. It is recommended to upgrade the affected component. The iden
version 3.0.2-0kylin6k70-23 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230688. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.230688 - https://vuldb.com/?ctiid.230688 - https://github.com/i900008/vulndb/blob/main/kylinos_vul3.md
CVE ID: CVE-2023-3099 State: PUBLISHED Published: 2023-06-05T07:00:04.362Z Last Updated: 2024-08-02T06:48:07.170Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: KylinSoft Products: youker-assistant Problem Types: CWE-284 Description: A vulnerability classified as critical was found in KylinSoft youker-assistant on KylinOS. Affected by this vulnerability is the function delete_file in the library dbus.SystemBus of the component Arbitrary File Handler. The manipulation leads to improper access controls. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. Upgrading to version 3.0.2-0kylin6k70-23
the local host. The exploit has been disclosed to the public and may be used. Upgrading to version 3.0.2-0kylin6k70-23 is able to address this issue. It is recommended to upgrade the affected component. The identifier VDB-230689 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.230689 - https://vuldb.com/?ctiid.230689 - https://github.com/i900008/vulndb/blob/main/kylinos_vul4.md
CVE ID: CVE-2023-3100 State: PUBLISHED Published: 2023-06-05T07:31:03.066Z Last Updated: 2025-01-08T17:23:05.695Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: IBOS Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in IBOS 4.5.5. Affected by this issue is the function actionDel of the file ?r=dashboard/approval/del. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-230690 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additio
o this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.230690 - https://vuldb.com/?ctiid.230690 - https://github.com/shulao2020/cve/blob/main/IBOS%20sql.md
CVE ID: CVE-2023-3102 State: PUBLISHED Published: 2023-07-21T15:30:47.974Z Last Updated: 2025-11-20T04:06:53.267Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-201 Description: A sensitive information leak issue has been discovered in GitLab EE affecting all versions starting from 16.0 before 16.0.6, all versions starting from 16.1 before 16.1.1, which allows access to titles of private issue and MR. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/414269 - https://hackerone.com/reports/2012073
CVE ID: CVE-2023-3103 State: PUBLISHED Published: 2023-11-22T11:51:48.573Z Last Updated: 2024-08-02T06:48:07.090Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Unitree Robotics Products: A1 Problem Types: CWE-290 Description: Authentication bypass vulnerability, the exploitation of which could allow a local attacker to perform a Man-in-the-Middle (MITM) attack on the robot's camera video stream. In addition, if a MITM attack is carried out, it is possible to consume the robot's resources, which could lead to a denial-of-service (DOS) condition. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/m
n. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-unitree-robotics-a1
CVE ID: CVE-2023-3104 State: PUBLISHED Published: 2023-11-22T11:54:30.983Z Last Updated: 2024-08-02T06:48:07.001Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Unitree Robotics Products: A1 Problem Types: CWE-306 Description: Lack of authentication vulnerability. An unauthenticated local user is able to see through the cameras using the web server due to the lack of any form of authentication. Additional Analyst Notes: - CVE Program Container: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-unitree-robotics-a1
CVE ID: CVE-2023-3105 State: PUBLISHED Published: 2023-07-12T04:38:43.102Z Last Updated: 2024-10-23T20:28:10.340Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: LearnDash LMS Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The LearnDash LMS plugin for WordPress is vulnerable to Insecure Direct Object References in versions up to, and including, 4.6.0. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for attackers with with existing account access at any level, to change user passwords and potentially
akes it possible for attackers with with existing account access at any level, to change user passwords and potentially take over administrator accounts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2318b3e1-268d-45fa-83bf-c6e88f1b9013?source=cve - https://www.learndash.com/release-notes/
CVE ID: CVE-2023-3106 State: PUBLISHED Published: 2023-07-12T08:27:58.635Z Last Updated: 2025-11-20T17:30:32.225Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-476 Description: A NULL pointer dereference vulnerability was found in netlink_dump. This issue can occur when the Netlink socket receives the message(sendmsg) for the XFRM_MSG_GETSA, XFRM_MSG_GETPOLICY type message, and the DUMP flag is set and can cause a denial of service or possibly another unspecified impact. Due to the nature of the flaw, privilege
s set and can cause a denial of service or possibly another unspecified impact. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although it is unlikely. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-3106 - https://bugzilla.redhat.com/show_bug.cgi?id=2221501 - https://github.com/torvalds/linux/commit/1ba5bf993c6a3142e18e68ea6452b347f9cb5635
CVE ID: CVE-2023-3107 State: PUBLISHED Published: 2023-08-01T22:01:07.584Z Last Updated: 2025-07-09T13:45:34.790Z Vendors: FreeBSD Products: FreeBSD Problem Types: CWE-190 Description: A set of carefully crafted ipv6 packets can trigger an integer overflow in the calculation of a fragment reassembled packet's payload length field. This allows an attacker to trigger a kernel panic, resulting in a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-23:06.ipv6.asc - https://security.netapp.com/advisory/ntap-20230804-0001/
CVE ID: CVE-2023-3108 State: PUBLISHED Published: 2023-07-11T15:45:03.258Z Last Updated: 2025-11-20T17:30:33.364Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Description: A flaw was found in the subsequent get_user_pages_fast in the Linux kernel’s interface for symmetric key cipher algorithms in the skcipher_recvmsg of crypto/algif_skcipher.c function. This flaw allows a local user to crash the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cv
nal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2023-3108 - https://bugzilla.redhat.com/show_bug.cgi?id=2221472 - https://github.com/torvalds/linux/commit/9399f0c51489ae8c16d6559b82a452fdc1895e91
CVE ID: CVE-2023-3109 State: PUBLISHED Published: 2023-06-05T00:00:00 Last Updated: 2025-01-08T17:25:43.782Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: admidio Products: admidio/admidio Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository admidio/admidio prior to 4.2.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/6fa6070e-8f7f-43ae-8a84-e36b28256123 - https://github.com/admidio/admidio/commit/a7c211b835cafe1158932fbfcff9e5552e57510a
CVE ID: CVE-2023-3110 State: PUBLISHED Published: 2023-06-21T19:44:00.543Z Last Updated: 2024-12-09T17:05:07.005Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Silicon Labs Products: Unify Gateway Problem Types: CWE-787, CWE-125 Description: Description: A vulnerability in SiLabs Unify Gateway 1.3.1 and earlier allows an unauthenticated attacker within Z-Wave range to overflow a stack buffer, leading to arbitrary code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://siliconlabs.lightning.force.com/sfc/servlet.shepherd/document/download/0698Y00000V6HZzQAN?operationContext=S1
CVE ID: CVE-2023-3111 State: PUBLISHED Published: 2023-06-05T00:00:00.000Z Last Updated: 2025-04-23T16:21:19.365Z Vendors: n/a Products: Kernel Problem Types: CWE-416 Description: A use after free vulnerability was found in prepare_to_relocate in fs/btrfs/relocation.c in btrfs in the Linux Kernel. This possible flaw can be triggered by calling btrfs_ioctl_balance() before calling btrfs_ioctl_defrag(). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchwork.kernel.org/project/linux-btrfs/patch/20220721074829.2905233-1-r33s3n6%40gmail.com/ - https://security.netapp.com/advisory/ntap-20230703-0007/ - https://lists.debian.org/debian-lts-announc
n6%40gmail.com/ - https://security.netapp.com/advisory/ntap-20230703-0007/ - https://lists.debian.org/debian-lts-announce/2023/07/msg00030.html - https://www.debian.org/security/2023/dsa-5480 - https://lists.debian.org/debian-lts-announce/2023/10/msg00027.html
CVE ID: CVE-2023-3112 State: PUBLISHED Published: 2023-10-24T20:31:09.667Z Last Updated: 2024-09-12T14:33:21.402Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: Elliptic Labs Virtual Lock Sensor, AI Virtual Presence Sensor Problem Types: CWE-276 Description: A vulnerability was reported in Elliptic Labs Virtual Lock Sensor for ThinkPad T14 Gen 3 that could allow an attacker with local access to execute code with elevated privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-128081
CVE ID: CVE-2023-3113 State: PUBLISHED Published: 2023-06-26T19:44:58.093Z Last Updated: 2024-12-03T18:32:53.195Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: Lenovo Products: Lenovo XClarity Administrator Problem Types: CWE-611 Description: An unauthenticated XML external entity injection (XXE) vulnerability exists in LXCA's Common Information Model (CIM) server that could result in read-only access to specific files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-98715
CVE ID: CVE-2023-3114 State: PUBLISHED Published: 2023-06-22T21:59:46.778Z Last Updated: 2024-12-04T21:33:25.906Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: HashiCorp Products: Terraform Enterprise Problem Types: CWE-266 Description: Terraform Enterprise since v202207-1 did not properly implement authorization rules for agent pools, allowing the workspace to be targeted by unauthorized agents. This authorization flaw could potentially allow a workspace to access resources from a separate, higher-privileged workspace in the same organization that targeted an agent pool. This vulnerability, CVE-2023-3114, is fixed in Terraform Enterprise v202306-1. Addition
ion that targeted an agent pool. This vulnerability, CVE-2023-3114, is fixed in Terraform Enterprise v202306-1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2023-18-terraform-enterprise-agent-pool-controls-allowed-unauthorized-workspaces-to-target-an-agent-pool/55329
CVE ID: CVE-2023-3115 State: PUBLISHED Published: 2023-09-29T06:02:51.300Z Last Updated: 2025-11-20T04:06:58.296Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: CWE-286 Description: An issue has been discovered in GitLab EE affecting all versions affecting all versions from 11.11 prior to 16.2.8, 16.3 prior to 16.3.5, and 16.4 prior to 16.4.1. Single Sign On restrictions were not correctly enforced for indirect project members accessing public members-only project repositories. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/414367
s: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/414367 - https://hackerone.com/reports/2004158
CVE ID: CVE-2023-3116 State: PUBLISHED Published: 2023-11-20T11:44:26.409Z Last Updated: 2024-08-29T20:48:35.867Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: OpenHarmony Products: OpenHarmony Problem Types: CWE-276 Description: in OpenHarmony v3.2.2 and prior versions allow a local attacker get confidential information or rewrite sensitive file through incorrect default permissions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/openharmony/security/blob/master/zh/security-disclosure/2023/2023-12.md
CVE ID: CVE-2023-3117 State: REJECTED Published: 2023-06-30T00:00:00 Last Updated: 2023-08-07T16:06:02.623Z Description: No description available.
CVE ID: CVE-2023-3118 State: PUBLISHED Published: 2023-07-10T12:40:46.857Z Last Updated: 2025-04-23T16:20:39.517Z Vendors: Unknown Products: Export All URLs Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Export All URLs WordPress plugin before 4.6 does not sanitise and escape a parameter before outputting them back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8a9efc8d-561a-42c6-8e61-ae5c3be581ea
CVE ID: CVE-2023-3119 State: PUBLISHED Published: 2023-06-06T10:31:03.265Z Last Updated: 2024-08-02T06:48:07.080Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Service Provider Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in SourceCodester Service Provider Management System 1.0. Affected by this issue is some unknown functionality of the file view.php. The manipulation of the argument id leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-230798 is the identifier assigned to this vulnerability. Additional
s been disclosed to the public and may be used. VDB-230798 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.230798 - https://vuldb.com/?ctiid.230798 - https://github.com/Peanut886/Vulnerability/blob/main/webray.com.cn/Service%20Provider%20Management%20System%20-%20multiple%20vulnerabilities.md
CVE ID: CVE-2023-3120 State: PUBLISHED Published: 2023-06-06T11:00:04.154Z Last Updated: 2025-01-07T18:57:14.451Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: SourceCodester Products: Service Provider Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in SourceCodester Service Provider Management System 1.0. This affects an unknown part of the file view_service.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-230799. Additional Analyst