Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-6629 State: PUBLISHED Published: 2024-01-03T04:29:33.793Z Last Updated: 2025-06-17T20:29:08.485Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: wpexpertsio Products: POST SMTP – The #1 WordPress SMTP Plugin with Advanced Email Logging and Delivery Failure Notifications Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘msg’ parameter in all versions up to, and including, 2.8.6 due to insufficient input sani
Cross-Site Scripting via the ‘msg’ parameter in all versions up to, and including, 2.8.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/7681f984-d488-4da7-afe1-988e5ad012f2?source=cve - https://plugins.trac.wordpress.org/browser/post-smtp/trunk/Postman/Wizard/NewWizard.php#L396 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sf
g/browser/post-smtp/trunk/Postman/Wizard/NewWizard.php#L396 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3012318%40post-smtp%2Ftrunk&old=3006604%40post-smtp%2Ftrunk&sfp_email=&sfph_mail=#file4
CVE ID: CVE-2023-6630 State: PUBLISHED Published: 2024-01-11T04:30:47.600Z Last Updated: 2025-06-17T21:09:13.536Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: sevenspark Products: Contact Form 7 – Dynamic Text Extension Problem Types: CWE-359 Exposure of Private Information ('Privacy Violation') Description: The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the CF7_get_custom_field and CF7_get_current_user shortcodes due to missing validation on a user controlled key. This makes it possible for authenticated attackers with contributor access or
ssing validation on a user controlled key. This makes it possible for authenticated attackers with contributor access or higher to access arbitrary metadata of any post type, referencing the post by id and the meta by key. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/a3f1d836-da32-414f-9f2b-d485c44b2486?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3019572%40contact-form-7-dynamic-text-extension%2Ftrunk&old=2968460%40contact-form-7-dynamic-text-extension%2Ftrunk&sfp_email=&sfph_mail=#file4
CVE ID: CVE-2023-6631 State: PUBLISHED Published: 2024-01-08T19:04:41.988Z Last Updated: 2025-06-03T14:34:35.451Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Subnet Solutions Inc. Products: PowerSYSTEM Center Problem Types: CWE-428 Description: PowerSYSTEM Center versions 2020 Update 16 and prior contain a vulnerability that may allow an authorized local user to insert arbitrary code into the unquoted service path and escalate privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/news-events/ics-advisories/icsa-23-353-01 - https://subnet.com/contact/
CVE ID: CVE-2023-6632 State: PUBLISHED Published: 2024-01-11T08:32:27.224Z Last Updated: 2025-06-17T21:09:13.672Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: weDevs, thehappymonster Products: Happy Addons for Elementor Pro, Happy Addons for Elementor Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Happy Addons for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via DOM in all versions up to and including 3.9.1.1 (versions up to 2.9.1.1 in Happy Addons for Elementor Pro) due to insufficient input sanitization and output escaping. This makes it possib
.1.1 in Happy Addons for Elementor Pro) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/06ef69f0-34d3-4389-8a81-a4d9922f1468?source=cve - https://plugins.trac.wordpress.org/browser/happy-elementor-addons/trunk/extensions/scroll-to-top.php#L142 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3011757%40happ
scroll-to-top.php#L142 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3011757%40happy-elementor-addons%2Ftrunk&old=2987938%40happy-elementor-addons%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6633 State: PUBLISHED Published: 2024-01-29T14:44:17.056Z Last Updated: 2024-08-07T18:42:06.090Z Vendors: Unknown Products: Site Notes Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Site Notes WordPress plugin through 2.0.0 does not have CSRF checks in some of its functionalities, which could allow attackers to make logged in users perform unwanted actions, such as deleting administration notes, via CSRF attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/eb983d82-b894-41c5-b51f-94d4bba3ba39/
CVE ID: CVE-2023-6634 State: PUBLISHED Published: 2024-01-11T08:32:28.636Z Last Updated: 2025-06-03T14:10:22.707Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: thimpress Products: LearnPress – WordPress LMS Plugin Problem Types: CWE-88 Argument Injection or Modification Description: The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the get_content function. This is due to the plugin making use of the call_user_func function with user input. This makes it possible for unauthenticated attackers to execute any public function with one parameter, which could result in remote code execution. A
uthenticated attackers to execute any public function with one parameter, which could result in remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/21291ed7-cdc0-4698-9ec4-8417160845ed?source=cve - https://plugins.trac.wordpress.org/changeset/3013957/learnpress
CVE ID: CVE-2023-6635 State: PUBLISHED Published: 2024-02-05T21:21:42.520Z Last Updated: 2025-05-15T19:46:29.611Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: munirkamal Products: Gutenberg Block Editor Toolkit – EditorsKit Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The EditorsKit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation on the 'import_styles' function in versions up to, and including, 1.40.3. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make r
with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4528f9a1-7027-4aa9-b006-bea84aa19c84?source=cve - https://plugins.trac.wordpress.org/browser/block-options/tags/1.40.3/includes/addons/styles-manager/rest-api/gutenberghub-styles-import-export-controller.php#L100 - https://plugins.trac.wordpress.org/changeset/3010794/block-options
CVE ID: CVE-2023-6636 State: PUBLISHED Published: 2024-01-11T08:32:41.439Z Last Updated: 2024-11-06T18:52:23.504Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: wpsoul Products: Greenshift – animation and page builder blocks Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation on the 'gspb_save_files' function in versions up to, and including, 7.6.2. This makes it possible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the aff
ossible for authenticated attackers with administrator-level capabilities or above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/821462d6-970e-4e3e-b91d-e7153296ba9f?source=cve - https://plugins.trac.wordpress.org/browser/greenshift-animation-and-page-builder-blocks/trunk/settings.php?rev=3006373#L867 - https://plugins.trac.wordpress.org/changeset/3009030/greenshift-animation-and-page-builder-blocks/trunk/settings.php
CVE ID: CVE-2023-6637 State: PUBLISHED Published: 2024-01-11T08:32:35.681Z Last Updated: 2025-06-03T14:09:21.070Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: daanvandenbergh Products: CAOS | Host Google Analytics Locally Problem Types: CWE-862 Missing Authorization Description: The CAOS | Host Google Analytics Locally plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_settings' function in versions up to, and including, 4.7.14. This makes it possible for unauthenticated attackers to update plugin settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refe
ed attackers to update plugin settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5ec1fd03-f865-4f58-b63b-e70c0c7e701d?source=cve - https://plugins.trac.wordpress.org/browser/host-analyticsjs-local/tags/4.7.12/includes/class-caos.php#L414 - https://plugins.trac.wordpress.org/changeset/3008878/host-analyticsjs-local#file8 - https://plugins.trac.wordpress.org/changeset/3009011/host-analyticsjs-local#file5
CVE ID: CVE-2023-6638 State: PUBLISHED Published: 2024-01-11T08:33:00.702Z Last Updated: 2025-06-03T14:08:44.404Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: gutengeek Products: GG Woo Feed for WooCommerce Shopping Feed on Google Facebook and Other Channels Problem Types: CWE-862 Missing Authorization Description: The GTG Product Feed for Shopping plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'update_settings' function in versions up to, and including, 1.2.4. This makes it possible for unauthenticated attackers to update plugin settings. Additional Analyst Notes: - CVE Program Container:
it possible for unauthenticated attackers to update plugin settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ce6b9b0a-e82e-459a-bddf-1c9354bcec00?source=cve - https://plugins.trac.wordpress.org/browser/gg-woo-feed/trunk/inc/Admin/Admin.php?rev=2933599#L199
CVE ID: CVE-2023-6640 State: PUBLISHED Published: 2024-02-21T19:56:50.808Z Last Updated: 2024-09-27T15:55:02.841Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: silabs.com Products: PC Controller Problem Types: CWE-248 Description: Malformed S2 Nonce Get Command Class packets can be sent to crash PC Controller v5.54.0 and earlier. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://community.silabs.com/068Vm000001HdNm
CVE ID: CVE-2023-6645 State: PUBLISHED Published: 2024-01-11T08:32:49.663Z Last Updated: 2025-06-17T21:09:13.798Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: pickplugins Products: Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel – Combo Blocks Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Post Grid Combo – 36+ Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom JS parameter in all versions up to, and including, 2.2.64 due to insufficient input sanitization and output escaping. This makes it possible for au
s up to, and including, 2.2.64 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor access or higher to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ab777672-6eef-4078-932d-24bb784107fa?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3010342%40post-grid%2Ftrunk&old=2999466%40post-grid%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2023-6646 State: PUBLISHED Published: 2023-12-09T21:31:03.919Z Last Updated: 2025-05-27T15:11:21.694Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: linkding Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in linkding 1.23.0. Affected is an unknown function. The manipulation of the argument q leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.23.1 is able to address this issue. It is recommended to upgrade the affected component. VDB-247338 is the identifier assigned to this vulnerability. NOTE: The ve
recommended to upgrade the affected component. VDB-247338 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early, responded in a very professional manner and immediately released a fixed version of the affected product. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.247338 - https://vuldb.com/?ctiid.247338 - https://treasure-blarney-085.notion.site/linkding-XSS-12709fa5ec664c8ebf6a4a02141252a8 - https://github.com/sissbruecker/linkding/releases/tag/v1.23.1
CVE ID: CVE-2023-6647 State: PUBLISHED Published: 2023-12-10T07:00:05.689Z Last Updated: 2024-10-09T14:36:57.227Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: AMTT Products: HiBOS Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in AMTT HiBOS 1.0. Affected by this issue is some unknown functionality. The manipulation of the argument Type leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-247340. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes:
0. NOTE: The vendor was contacted early about this disclosure but did not respond in any way. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.247340 - https://vuldb.com/?ctiid.247340 - https://github.com/gatsby2003/Sqlinjection/blob/main/sql.md
CVE ID: CVE-2023-6648 State: PUBLISHED Published: 2023-12-10T08:31:03.969Z Last Updated: 2025-02-22T11:12:20.271Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: PHPGurukul Products: Nipah Virus Testing Management System Problem Types: CWE-89, CWE-74 Description: A vulnerability, which was classified as critical, was found in PHPGurukul Nipah Virus Testing Management System 1.0. This affects an unknown part of the file password-recovery.php. The manipulation of the argument username/contactno leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Container: Refe
y. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.247341 - https://vuldb.com/?ctiid.247341 - https://vuldb.com/?submit.246745 - https://github.com/dhabaleshwar/niv_testing_sqliforgotpassword/blob/main/exploit.md - https://phpgurukul.com/
CVE ID: CVE-2023-6649 State: PUBLISHED Published: 2023-12-10T10:00:05.072Z Last Updated: 2024-08-02T08:35:14.915Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: PHPGurukul Products: Teacher Subject Allocation Management System Problem Types: CWE-79 Description: A vulnerability has been found in PHPGurukul Teacher Subject Allocation Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file index.php. The manipulation of the argument searchdata with the input <script>alert(5)</script> leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-247342 is the iden
e attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-247342 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.247342 - https://vuldb.com/?ctiid.247342 - https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/tsas-reflected-xss.md
CVE ID: CVE-2023-6650 State: PUBLISHED Published: 2023-12-10T10:31:04.231Z Last Updated: 2024-11-21T15:20:54.288Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: SourceCodester Products: Simple Invoice Generator System Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Simple Invoice Generator System 1.0 and classified as problematic. This issue affects some unknown processing of the file login.php. The manipulation of the argument cashier leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-247343. Additional Analyst Note
ed to the public and may be used. The associated identifier of this vulnerability is VDB-247343. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.247343 - https://vuldb.com/?ctiid.247343 - https://github.com/x1280/CVE/blob/main/Cross-site%20Scriping_cashier.md
CVE ID: CVE-2023-6651 State: PUBLISHED Published: 2023-12-10T11:00:05.615Z Last Updated: 2024-08-02T08:35:14.860Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects Products: Matrimonial Site Problem Types: CWE-89 Description: A vulnerability was found in code-projects Matrimonial Site 1.0. It has been classified as critical. Affected is an unknown function of the file /auth/auth.php?user=1. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-247344. Additional Analyst Notes: - CVE Program Container: Refe
may be used. The identifier of this vulnerability is VDB-247344. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.247344 - https://vuldb.com/?ctiid.247344 - https://github.com/850362564/BugHub/blob/main/Matrimonial%20Site%20System%20auth.php%20has%20Sqlinjection.pdf
CVE ID: CVE-2023-6652 State: PUBLISHED Published: 2023-12-10T12:00:04.524Z Last Updated: 2024-08-02T08:35:14.860Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: code-projects Products: Matrimonial Site Problem Types: CWE-89 Description: A vulnerability was found in code-projects Matrimonial Site 1.0. It has been declared as critical. Affected by this vulnerability is the function register of the file /register.php. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247345 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: -
ntifier VDB-247345 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.247345 - https://vuldb.com/?ctiid.247345 - https://github.com/sweatxi/BugHub/blob/main/Matrimonial%20Site%20System%20functions.php%20%20has%20Sqlinjection.pdf
CVE ID: CVE-2023-6653 State: PUBLISHED Published: 2023-12-10T12:31:03.928Z Last Updated: 2024-08-02T08:35:14.888Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: PHPGurukul Products: Teacher Subject Allocation Management System Problem Types: CWE-352 Description: A vulnerability was found in PHPGurukul Teacher Subject Allocation Management System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/subject.php of the component Create a new Subject. The manipulation of the argument cid leads to cross-site request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-2
equest forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-247346 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.247346 - https://vuldb.com/?ctiid.247346 - https://github.com/dhabaleshwar/Open-Source-Vulnerabilities/blob/main/csrf_add_sub.md
CVE ID: CVE-2023-6654 State: PUBLISHED Published: 2023-12-10T15:00:05.030Z Last Updated: 2024-08-28T15:18:27.567Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: n/a Products: PHPEMS Problem Types: CWE-502 Description: A vulnerability classified as critical was found in PHPEMS 6.x/7.x/8.x/9.0. Affected by this vulnerability is an unknown functionality in the library lib/session.cls.php of the component Session Data Handler. The manipulation leads to deserialization. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-247357 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CI
d. The identifier VDB-247357 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.247357 - https://vuldb.com/?ctiid.247357 - https://note.zhaoj.in/share/jw4Hp9cq7T69
CVE ID: CVE-2023-6655 State: PUBLISHED Published: 2023-12-10T15:31:04.609Z Last Updated: 2025-05-27T15:05:09.824Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Hongjing Products: e-HR Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, has been found in Hongjing e-HR 2020. Affected by this issue is some unknown functionality of the file /w_selfservice/oauthservlet/%2e./.%2e/general/inform/org/loadhistroyorgtree of the component Login Interface. The manipulation of the argument parentid leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-247358 is the identifier assigned
e launched remotely. The exploit has been disclosed to the public and may be used. VDB-247358 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.247358 - https://vuldb.com/?ctiid.247358 - https://github.com/willchen0011/cve/blob/main/HongJing-sql.md