Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2024-25828 State: PUBLISHED Published: 2024-02-22T00:00:00 Last Updated: 2024-08-19T20:13:07.677Z Vendors: n/a Products: n/a Problem Types: n/a Description: cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/template_admin.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sec-Kode/cve
CVE ID: CVE-2024-25830 State: PUBLISHED Published: 2024-02-28T00:00:00 Last Updated: 2024-08-13T18:57:18.775Z Vendors: n/a Products: n/a Problem Types: n/a Description: F-logic DataCube3 v1.0 is vulnerable to Incorrect Access Control due to an improper directory access restriction. An unauthenticated, remote attacker can exploit this, by sending a URI that contains the path of the configuration file. A successful exploit could allow the attacker to extract the root and admin password. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://neroteam.com/blog/f-logic-datacube3-vulnerability-report
CVE ID: CVE-2024-25831 State: PUBLISHED Published: 2024-02-28T00:00:00 Last Updated: 2024-08-20T19:45:49.316Z Vendors: n/a Products: n/a Problem Types: n/a Description: F-logic DataCube3 Version 1.0 is affected by a reflected cross-site scripting (XSS) vulnerability due to improper input sanitization. An authenticated, remote attacker can execute arbitrary JavaScript code in the web management interface. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://neroteam.com/blog/f-logic-datacube3-vulnerability-report
CVE ID: CVE-2024-25832 State: PUBLISHED Published: 2024-02-28T00:00:00.000Z Last Updated: 2025-03-27T14:27:50.024Z Vendors: n/a Products: n/a Problem Types: n/a Description: F-logic DataCube3 v1.0 is vulnerable to unrestricted file upload, which could allow an authenticated malicious actor to upload a file of dangerous type by manipulating the filename extension. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://neroteam.com/blog/f-logic-datacube3-vulnerability-report
CVE ID: CVE-2024-25833 State: PUBLISHED Published: 2024-02-28T00:00:00 Last Updated: 2024-08-21T15:36:08.328Z Vendors: n/a Products: n/a Problem Types: n/a Description: F-logic DataCube3 v1.0 is vulnerable to unauthenticated SQL injection, which could allow an unauthenticated malicious actor to execute arbitrary SQL queries in database. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://neroteam.com/blog/f-logic-datacube3-vulnerability-report
CVE ID: CVE-2024-25837 State: PUBLISHED Published: 2024-08-16T00:00:00 Last Updated: 2024-10-30T14:12:20.707Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in October CMS Bloghub Plugin v1.3.8 and lower allows attackers to execute arbitrary web scripts or HTML via a crafted payload into the Comments section. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.getastra.com/blog/vulnerability/stored-xss-vulnerability-in-bloghub-plugin/ - https://github.com/RatMD/bloghub-plugin/blob/master/CHANGELOG.md#version-139---stable
CVE ID: CVE-2024-25839 State: PUBLISHED Published: 2024-03-03T00:00:00 Last Updated: 2024-08-26T19:42:46.553Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Webbax "Super Newsletter" (supernewsletter) module for PrestaShop versions 1.4.21 and before, allows local attackers to escalate privileges and obtain sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/friends-of-presta/security-advisories/blob/main/_posts/2024-02-29-supernewsletter.md
CVE ID: CVE-2024-25840 State: PUBLISHED Published: 2024-02-27T00:00:00 Last Updated: 2024-08-23T20:10:35.923Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "Account Manager | Sales Representative & Dealers | CRM" (prestasalesmanager) up to 9.0 from Presta World for PrestaShop, a guest can download personal information without restriction by performing a path traversal attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://addons.prestashop.com/en/third-party-data-integrations-crm-erp/90816-account-manager-sales-representative-dealers-crm.html - https://security.friendsofpresta.org/modules/2024/02/27/prestasalesmana
-manager-sales-representative-dealers-crm.html - https://security.friendsofpresta.org/modules/2024/02/27/prestasalesmanager.html
CVE ID: CVE-2024-25841 State: PUBLISHED Published: 2024-02-27T00:00:00 Last Updated: 2024-11-20T21:37:39.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "So Flexibilite" (soflexibilite) from Common-Services for PrestaShop < 4.1.26, a guest (authenticated customer) can perform Cross Site Scripting (XSS) injection. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://addons.prestashop.com/fr/transporteurs/2704-colissimo-domicile-et-points-de-retrait.html - https://security.friendsofpresta.org/modules/2024/02/27/soflexibilite.html
CVE ID: CVE-2024-25842 State: PUBLISHED Published: 2024-03-03T00:00:00 Last Updated: 2024-08-23T20:10:02.977Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Presta World "Account Manager - Sales Representative & Dealers - CRM" (prestasalesmanager) module for PrestaShop before version 9.0, allows remote attackers to escalate privilege and obtain sensitive information via the uploadLogo() and postProcess methods. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/friends-of-presta/security-advisories/blob/main/_posts/2024-02-29-prestasalesmanager.md
CVE ID: CVE-2024-25843 State: PUBLISHED Published: 2024-02-27T00:00:00 Last Updated: 2024-08-29T15:03:49.235Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "Import/Update Bulk Product from any Csv/Excel File Pro" (ba_importer) up to version 1.1.28 from Buy Addons for PrestaShop, a guest can perform SQL injection in affected versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://addons.prestashop.com/en/data-import-export/20579-import-update-bulk-product-from-any-csv-excel-file-pro.html - https://security.friendsofpresta.org/modules/2024/02/27/ba_importer.html
CVE ID: CVE-2024-25844 State: PUBLISHED Published: 2024-03-03T00:00:00.000Z Last Updated: 2025-03-27T16:39:02.771Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Common-Services "So Flexibilite" (soflexibilite) module for PrestaShop before version 4.1.26, allows remote attackers to escalate privileges and obtain sensitive information via debug file. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/friends-of-presta/security-advisories/blob/main/_posts/2024-02-29-soflexibilite.md
CVE ID: CVE-2024-25845 State: PUBLISHED Published: 2024-03-08T00:00:00 Last Updated: 2024-08-27T19:50:28.017Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "CD Custom Fields 4 Orders" (cdcustomfields4orders) <= 1.0.0 from Cleanpresta.com for PrestaShop, a guest can perform SQL injection in affected versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cleanpresta.com - https://security.friendsofpresta.org/modules/2024/03/05/cdcustomfields4orders.html
CVE ID: CVE-2024-25846 State: PUBLISHED Published: 2024-02-27T00:00:00 Last Updated: 2024-08-08T20:10:19.815Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "Product Catalog (CSV, Excel) Import" (simpleimportproduct) <= 6.7.0 from MyPrestaModules for PrestaShop, a guest can upload files with extensions .php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://addons.prestashop.com/fr/import-export-de-donnees/19091-catalogue-de-produits-csv-excel-dimportation.html - https://security.friendsofpresta.org/modules/2024/02/27/simpleimportproduct.html
CVE ID: CVE-2024-25847 State: PUBLISHED Published: 2024-03-03T00:00:00.000Z Last Updated: 2025-04-16T16:03:50.297Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL Injection vulnerability in MyPrestaModules "Product Catalog (CSV, Excel) Import" (simpleimportproduct) modules for PrestaShop versions 6.5.0 and before, allows attackers to escalate privileges and obtain sensitive information via Send::__construct() and importProducts::_addDataToDb methods. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/friends-of-presta/security-advisories/blob/main/_posts/2024-02-29-simpleimportproduct.md
CVE ID: CVE-2024-25848 State: PUBLISHED Published: 2024-03-08T00:00:00 Last Updated: 2024-11-14T20:06:51.432Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "Ever Ultimate SEO" (everpsseo) <= 8.1.2 from Team Ever for PrestaShop, a guest can perform SQL injection in affected versions. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.team-ever.com/prestashop-ever-ultimate-seo/ - https://addons.prestashop.com/fr/seo-referencement-naturel/39489-ever-ultimate-seo.html - https://security.friendsofpresta.org/modules/2024/03/05/everpsseo.html
CVE ID: CVE-2024-25849 State: PUBLISHED Published: 2024-03-08T00:00:00.000Z Last Updated: 2025-04-16T15:51:24.220Z Vendors: n/a Products: n/a Problem Types: n/a Description: In the module "Make an offer" (makeanoffer) <= 1.7.1 from PrestaToolKit for PrestaShop, a guest can perform SQL injection via MakeOffers::checkUserExistingOffer()` and `MakeOffers::addUserOffer()` . Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://addons.prestashop.com/en/price-management/19507-make-an-offer.html - https://security.friendsofpresta.org/modules/2024/03/05/makeanoffer.html
CVE ID: CVE-2024-25850 State: PUBLISHED Published: 2024-02-22T00:00:00 Last Updated: 2024-08-22T18:46:30.168Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netis WF2780 v2.1.40144 was discovered to contain a command injection vulnerability via the wps_ap_ssid5g parameter Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.netis-systems.com/ - https://github.com/no1rr/Vulnerability/blob/master/netis/igd_wps_set_wps_ap_ssid5g.md
CVE ID: CVE-2024-25851 State: PUBLISHED Published: 2024-02-22T00:00:00 Last Updated: 2024-08-29T15:18:26.055Z Vendors: n/a Products: n/a Problem Types: n/a Description: Netis WF2780 v2.1.40144 was discovered to contain a command injection vulnerability via the config_sequence parameter in other_para of cgitest.cgi. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.netis-systems.com/ - https://github.com/no1rr/Vulnerability/blob/master/netis/other_para_config_sequence.md
CVE ID: CVE-2024-25852 State: PUBLISHED Published: 2024-04-11T00:00:00 Last Updated: 2024-08-14T19:45:30.332Z Vendors: n/a Products: n/a Problem Types: n/a Description: Linksys RE7000 v2.0.9, v2.0.11, and v2.0.15 have a command execution vulnerability in the "AccessControlList" parameter of the access control function point. An attacker can use the vulnerability to obtain device administrator rights. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://immense-mirror-b42.notion.site/Linksys-RE7000-command-injection-vulnerability-c1a47abf5e8d4dd0934d20d77da930bd - https://github.com/ZackSecurity/VulnerReport/blob/cve/Linksys/1.md
CVE ID: CVE-2024-25854 State: PUBLISHED Published: 2024-03-11T00:00:00 Last Updated: 2024-08-27T18:26:14.922Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in Sourcecodester Insurance Management System 1.0 allows attackers to run arbitrary code via the Subject and Description fields when submitting a support ticket. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hakkitoklu/hunt/blob/main/Insurance%20Management%20System%20PHP%20and%20MySQL%201.0/xss.md
CVE ID: CVE-2024-25858 State: PUBLISHED Published: 2024-03-05T00:00:00.000Z Last Updated: 2025-03-28T23:59:33.820Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Foxit PDF Reader before 2024.1 and PDF Editor before 2024.1, code execution via JavaScript could occur because of an unoptimized prompt message for users to review parameters of commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.foxit.com/support/security-bulletins.html
CVE ID: CVE-2024-25859 State: PUBLISHED Published: 2024-02-28T00:00:00 Last Updated: 2024-08-28T15:33:13.980Z Vendors: n/a Products: n/a Problem Types: n/a Description: A path traversal vulnerability in the /path/to/uploads/ directory of Blesta before v5.9.2 allows attackers to takeover user accounts and execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.blesta.com/2024/02/08/security-advisory/
CVE ID: CVE-2024-25864 State: PUBLISHED Published: 2024-04-03T00:00:00.000Z Last Updated: 2025-03-13T17:04:13.089Z Vendors: n/a Products: n/a Problem Types: n/a Description: Server Side Request Forgery (SSRF) vulnerability in Friendica versions after v.2023.12, allows a remote attacker to execute arbitrary code and obtain sensitive information via the fpostit.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/friendica/friendica/issues/13877
CVE ID: CVE-2024-25865 State: PUBLISHED Published: 2024-03-02T00:00:00.000Z Last Updated: 2025-03-28T23:29:28.942Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in hexo-theme-anzhiyu v1.6.12, allows remote attackers to execute arbitrary code via the algolia search function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/anzhiyu-c/hexo-theme-anzhiyu/issues/200
CVE ID: CVE-2024-25866 State: PUBLISHED Published: 2024-02-28T00:00:00 Last Updated: 2024-08-28T15:24:39.567Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary SQL commands via the email parameter in the index.php component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/0xQRx/VulnerabilityResearch/blob/master/2024/MembershipManagementSystem-SQL_Injection_Login.md
CVE ID: CVE-2024-25867 State: PUBLISHED Published: 2024-02-28T00:00:00 Last Updated: 2024-08-29T18:17:15.855Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL Injection vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary SQL commands via the membershipType and membershipAmount parameters in the add_type.php component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/0xQRx/VulnerabilityResearch/blob/master/2024/MembershipManagementSystem-SQL_Injection_Add_Type.md
CVE ID: CVE-2024-25868 State: PUBLISHED Published: 2024-02-28T00:00:00 Last Updated: 2024-08-27T19:10:56.513Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross Site Scripting (XSS) vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary code via the membershipType parameter in the add_type.php component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/0xQRx/VulnerabilityResearch/blob/master/2024/MembershipManagementSystem-Stored_XSS_Add_Type.md
CVE ID: CVE-2024-25869 State: PUBLISHED Published: 2024-02-28T00:00:00 Last Updated: 2024-08-01T23:52:05.852Z Vendors: n/a Products: n/a Problem Types: n/a Description: An Unrestricted File Upload vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary code via upload of a crafted php file in the settings.php component. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/0xQRx/VulnerabilityResearch/blob/master/2024/MembershipManagementSystem-Unrestricted_Fileupload.md
CVE ID: CVE-2024-25873 State: PUBLISHED Published: 2024-02-22T00:00:00 Last Updated: 2024-08-26T18:55:06.483Z Vendors: n/a Products: n/a Problem Types: n/a Description: Enhavo v0.13.1 was discovered to contain an HTML injection vulnerability in the Author text field under the Blockquote module. This vulnerability allows attackers to execute arbitrary code via a crafted payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dd3x3r/enhavo/blob/main/html-injection-page-content-blockquote-author-v0.13.1.md - https://www.enhavo.com/
CVE ID: CVE-2024-25874 State: PUBLISHED Published: 2024-02-22T00:00:00 Last Updated: 2024-08-27T18:56:20.767Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the New/Edit Article module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Create Tag text field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.enhavo.com/ - https://github.com/dd3x3r/enhavo/blob/main/xss-create-tag-v0.13.1.md
CVE ID: CVE-2024-25875 State: PUBLISHED Published: 2024-02-22T00:00:00 Last Updated: 2024-08-15T20:41:18.490Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Undertitle text field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.enhavo.com/ - https://github.com/dd3x3r/enhavo/blob/main/xss-page-content-header-undertitel-v0.13.1.md
CVE ID: CVE-2024-25876 State: PUBLISHED Published: 2024-02-22T00:00:00 Last Updated: 2024-10-30T15:36:49.915Z Vendors: n/a Products: n/a Problem Types: n/a Description: A cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title text field. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.enhavo.com/ - https://github.com/dd3x3r/enhavo/blob/main/xss-page-content-header-titel-v0.13.1.md
CVE ID: CVE-2024-25883 State: PUBLISHED Published: 2025-02-06T00:00:00.000Z Last Updated: 2025-02-11T14:34:37.860Z Vendors: n/a Products: n/a Problem Types: n/a Description: The mstatus register in RSD commit 3d13a updates incorrectly, leading to processing errors. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rsd-devel/rsd/issues/75
CVE ID: CVE-2024-25885 State: PUBLISHED Published: 2024-10-08T00:00:00 Last Updated: 2024-10-09T14:24:58.398Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDOS) via supplying a crafted string. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - http://dirk.com - http://xhtml2pdf.com - https://gist.github.com/salvatore-abello/c88dd0027496774023ef36c7b576d206
CVE ID: CVE-2024-25891 State: PUBLISHED Published: 2024-02-21T00:00:00 Last Updated: 2024-08-29T15:14:28.140Z Vendors: n/a Products: n/a Problem Types: n/a Description: ChurchCRM 5.5.0 FRBidSheets.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ChurchCRM/CRM/issues/6856
CVE ID: CVE-2024-25892 State: PUBLISHED Published: 2024-02-21T00:00:00 Last Updated: 2024-08-14T15:01:32.578Z Vendors: n/a Products: n/a Problem Types: n/a Description: ChurchCRM 5.5.0 ConfirmReport.php is vulnerable to Blind SQL Injection (Time-based) via the familyId GET parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ChurchCRM/CRM/issues/6858
CVE ID: CVE-2024-25893 State: PUBLISHED Published: 2024-02-21T00:00:00 Last Updated: 2024-08-28T20:23:37.965Z Vendors: n/a Products: n/a Problem Types: n/a Description: ChurchCRM 5.5.0 FRCertificates.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ChurchCRM/CRM/issues/6856
CVE ID: CVE-2024-25894 State: PUBLISHED Published: 2024-02-21T00:00:00 Last Updated: 2024-08-01T23:52:06.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: ChurchCRM 5.5.0 /EventEditor.php is vulnerable to Blind SQL Injection (Time-based) via the EventCount POST parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ChurchCRM/CRM/issues/6849
CVE ID: CVE-2024-25895 State: PUBLISHED Published: 2024-02-21T00:00:00 Last Updated: 2024-08-15T19:18:38.586Z Vendors: n/a Products: n/a Problem Types: n/a Description: A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 5.5.0 allows remote attackers to inject arbitrary web script or HTML via the type parameter of /EventAttendance.php Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ChurchCRM/CRM/issues/6853
CVE ID: CVE-2024-25896 State: PUBLISHED Published: 2024-02-21T00:00:00 Last Updated: 2024-11-21T20:18:16.321Z Vendors: n/a Products: n/a Problem Types: n/a Description: ChurchCRM 5.5.0 EventEditor.php is vulnerable to Blind SQL Injection (Time-based) via the EID POST parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ChurchCRM/CRM/issues/6854
CVE ID: CVE-2024-25897 State: PUBLISHED Published: 2024-02-21T00:00:00.000Z Last Updated: 2025-04-22T16:26:16.118Z Vendors: n/a Products: n/a Problem Types: n/a Description: ChurchCRM 5.5.0 FRCatalog.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ChurchCRM/CRM/issues/6856
CVE ID: CVE-2024-25898 State: PUBLISHED Published: 2024-02-21T00:00:00.000Z Last Updated: 2025-03-28T16:57:46.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: A XSS vulnerability was found in the ChurchCRM v.5.5.0 functionality, edit your event, where malicious JS or HTML code can be inserted in the Event Sermon field in EventEditor.php. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/ChurchCRM/CRM/issues/6851
CVE ID: CVE-2024-25902 State: PUBLISHED Published: 2024-02-28T13:01:35.916Z Last Updated: 2024-08-05T15:01:14.651Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:L) Vendors: miniorange Products: Malware Scanner Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in miniorange Malware Scanner.This issue affects Malware Scanner: from n/a through 4.7.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/miniorange-malware-protection/wordpress-malware-scanner-plugin-4-7-2-admin-sql-injection-vulnerability?_s_id
lnerability/miniorange-malware-protection/wordpress-malware-scanner-plugin-4-7-2-admin-sql-injection-vulnerability?_s_id=cve