Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2023-48825 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T21:46:28.258Z Vendors: n/a Products: n/a Problem Types: n/a Description: Availability Booking Calendar 5.0 is vulnerable to Multiple HTML Injection issues via SMS API Key or Default Country Code. Additional Analyst Notes: - CVE Program Container: References: - http://packetstormsecurity.com/files/176033
CVE ID: CVE-2023-48826 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T21:46:28.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: Time Slots Booking Calendar 4.0 is vulnerable to CSV Injection via the unique ID field of the Reservations List. Additional Analyst Notes: - CVE Program Container: References: - https://www.phpjabbers.com/time-slots-booking-calendar/ - http://packetstormsecurity.com/files/176034
CVE ID: CVE-2023-48827 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T21:46:28.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: Time Slots Booking Calendar 4.0 is vulnerable to Multiple HTML Injection issues via the name, plugin_sms_api_key, plugin_sms_country_code, calendar_id, title, country name, or customer_name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.phpjabbers.com/time-slots-booking-calendar/ - http://packetstormsecurity.com/files/176036
CVE ID: CVE-2023-48828 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T21:46:28.516Z Vendors: n/a Products: n/a Problem Types: n/a Description: Time Slots Booking Calendar 4.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_api_key, plugin_sms_country_code, calendar_id, title, country name, or customer_name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.phpjabbers.com/time-slots-booking-calendar/ - http://packetstormsecurity.com/files/176037
CVE ID: CVE-2023-48830 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T21:46:28.184Z Vendors: n/a Products: n/a Problem Types: n/a Description: Shuttle Booking Software 2.0 is vulnerable to CSV Injection in the Languages section via an export. Additional Analyst Notes: - CVE Program Container: References: - https://www.phpjabbers.com/shuttle-booking-software/ - http://packetstormsecurity.com/files/176038
CVE ID: CVE-2023-48831 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-10-09T15:14:42.574Z Vendors: n/a Products: n/a Problem Types: n/a Description: A lack of rate limiting in pjActionAJaxSend in Availability Booking Calendar 5.0 allows attackers to cause resource exhaustion. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.phpjabbers.com/availability-booking-calendar/#sectionDemo - http://packetstormsecurity.com/files/176039
CVE ID: CVE-2023-48833 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T21:46:29.084Z Vendors: n/a Products: n/a Problem Types: n/a Description: A lack of rate limiting in pjActionAJaxSend in Time Slots Booking Calendar 4.0 allows attackers to cause resource exhaustion. Additional Analyst Notes: - CVE Program Container: References: - https://www.phpjabbers.com/time-slots-booking-calendar/ - http://packetstormsecurity.com/files/176042
CVE ID: CVE-2023-48834 State: PUBLISHED Published: 2023-12-07T00:00:00.000Z Last Updated: 2025-05-28T15:34:47.654Z Vendors: n/a Products: n/a Problem Types: n/a Description: A lack of rate limiting in pjActionAjaxSend in Car Rental v3.0 allows attackers to cause resource exhaustion. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.phpjabbers.com/car-rental-script/ - http://packetstormsecurity.com/files/176043
CVE ID: CVE-2023-48835 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T21:46:28.555Z Vendors: n/a Products: n/a Problem Types: n/a Description: Car Rental Script v3.0 is vulnerable to CSV Injection via a Language > Labels > Export action. Additional Analyst Notes: - CVE Program Container: References: - https://www.phpjabbers.com/car-rental-script/ - http://packetstormsecurity.com/files/176045
CVE ID: CVE-2023-48836 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-11-26T15:38:15.740Z Vendors: n/a Products: n/a Problem Types: n/a Description: Car Rental Script 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_api_key, plugin_sms_country_code, calendar_id, title, country name, or customer_name parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.phpjabbers.com/car-rental-script/ - http://packetstormsecurity.com/files/176046
CVE ID: CVE-2023-48837 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T21:46:28.376Z Vendors: n/a Products: n/a Problem Types: n/a Description: Car Rental Script 3.0 is vulnerable to Multiple HTML Injection issues via SMS API Key or Default Country Code. Additional Analyst Notes: - CVE Program Container: References: - https://www.phpjabbers.com/car-rental-script/ - http://packetstormsecurity.com/files/176048
CVE ID: CVE-2023-48838 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T21:46:28.330Z Vendors: n/a Products: n/a Problem Types: n/a Description: Appointment Scheduler 3.0 is vulnerable to Multiple HTML Injection issues via the SMS API Key or Default Country Code. Additional Analyst Notes: - CVE Program Container: References: - https://www.phpjabbers.com/appointment-scheduler/ - http://packetstormsecurity.com/files/176054
CVE ID: CVE-2023-48839 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T21:46:28.901Z Vendors: n/a Products: n/a Problem Types: n/a Description: Appointment Scheduler 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin_sms_api_key, plugin_sms_country_code, calendar_id, title, country name, or customer_name parameter. Additional Analyst Notes: - CVE Program Container: References: - https://www.phpjabbers.com/appointment-scheduler/ - http://packetstormsecurity.com/files/176055
CVE ID: CVE-2023-48840 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T21:46:28.298Z Vendors: n/a Products: n/a Problem Types: n/a Description: A lack of rate limiting in pjActionAjaxSend in Appointment Scheduler 3.0 allows attackers to cause resource exhaustion. Additional Analyst Notes: - CVE Program Container: References: - https://www.phpjabbers.com/appointment-scheduler/ - http://packetstormsecurity.com/files/176056
CVE ID: CVE-2023-48841 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-10-09T15:05:11.826Z Vendors: n/a Products: n/a Problem Types: n/a Description: Appointment Scheduler 3.0 is vulnerable to CSV Injection via a Language > Labels > Export action. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.phpjabbers.com/appointment-scheduler/ - http://packetstormsecurity.com/files/176058
CVE ID: CVE-2023-48842 State: PUBLISHED Published: 2023-12-01T00:00:00.000Z Last Updated: 2025-06-03T02:24:53.955Z Vendors: n/a Products: n/a Problem Types: n/a Description: D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at hedwig.cgi. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://drive.google.com/file/d/1y5om__f2SAhNmcPqDxC_SRTvJVAWwPcH/view?usp=drive_link
CVE ID: CVE-2023-48848 State: PUBLISHED Published: 2023-11-28T00:00:00 Last Updated: 2024-10-15T17:44:52.415Z Vendors: n/a Products: n/a Problem Types: n/a Description: An arbitrary file read vulnerability in ureport v2.2.9 allows a remote attacker to arbitrarily read files on the server by inserting a crafted path. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/h00klod0er/ureport2-vuln/
CVE ID: CVE-2023-48849 State: PUBLISHED Published: 2023-12-06T00:00:00 Last Updated: 2024-08-02T21:46:28.321Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ruijie EG Series Routers version EG_3.0(1)B11P216 and before allows unauthenticated attackers to remotely execute arbitrary code due to incorrect filtering. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/delsploit/CVE-2023-48849
CVE ID: CVE-2023-48858 State: PUBLISHED Published: 2024-01-17T00:00:00.000Z Last Updated: 2025-06-02T15:06:41.502Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-site scripting (XSS) vulnerability in login page php code in Armex ABO.CMS 5.9 allows remote attackers to inject arbitrary web script or HTML via the login.php? URL part. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://abocms.ru/about/versions/version59/ - https://github.com/Shumerez/CVE-2023-48858
CVE ID: CVE-2023-48859 State: PUBLISHED Published: 2023-12-06T00:00:00 Last Updated: 2024-08-02T21:46:28.236Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK A3002RU version 2.0.0-B20190902.1958 has a post-authentication RCE due to incorrect access control, allows attackers to bypass front-end security restrictions and execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xieqiang11/security_research/blob/main/TOTOLINK-A3002RU-RCE.md
CVE ID: CVE-2023-48860 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-08-02T21:46:28.791Z Vendors: n/a Products: n/a Problem Types: n/a Description: TOTOLINK N300RT version 3.2.4-B20180730.0906 has a post-authentication RCE due to incorrect access control, allows attackers can bypass front-end security restrictions and execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xieqiang11/security_research/blob/main/TOTOLINK-N300RT-RCE.md
CVE ID: CVE-2023-48861 State: PUBLISHED Published: 2023-12-07T00:00:00 Last Updated: 2024-11-26T15:36:52.660Z Vendors: n/a Products: n/a Problem Types: n/a Description: DLL hijacking vulnerability in TTplayer version 7.0.2, allows local attackers to escalate privileges and execute arbitrary code via urlmon.dll. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xieqiang11/POC4/blob/main/README.md
CVE ID: CVE-2023-48863 State: PUBLISHED Published: 2023-12-04T00:00:00.000Z Last Updated: 2025-06-03T02:15:59.640Z Vendors: n/a Products: n/a Problem Types: n/a Description: SEMCMS 3.9 is vulnerable to SQL Injection. Due to the lack of security checks on the input of the application, the attacker uses the existing application to inject malicious SQL commands into the background database engine for execution, and sends some attack codes as commands or query statements to the interpreter. These malicious data can deceive the interpreter, so as to execute unplanned commands or unauthorized access to data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
unauthorized access to data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.sem-cms.com/ - https://gitee.com/NoBlake/cve-2023-48863/
CVE ID: CVE-2023-48864 State: PUBLISHED Published: 2024-01-10T00:00:00.000Z Last Updated: 2025-06-20T15:54:06.339Z Vendors: n/a Products: n/a Problem Types: n/a Description: SEMCMS v4.8 was discovered to contain a SQL injection vulnerability via the languageID parameter in /web_inc.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/NoBlake/cve-2023-48864
CVE ID: CVE-2023-48865 State: PUBLISHED Published: 2024-04-11T00:00:00 Last Updated: 2024-08-02T21:46:28.121Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue discovered in Reportico Till 8.1.0 allows attackers to obtain sensitive information via execute_mode parameter of the URL. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/reportico-web/reportico/issues/51 - https://gist.github.com/aashiqahamedn/39383cfbc639cbdc3e1a7d74b977aeae
CVE ID: CVE-2023-48866 State: PUBLISHED Published: 2023-12-04T00:00:00.000Z Last Updated: 2025-09-29T14:31:00.998Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Scripting (XSS) vulnerability in the recipe preparation component within /api/objects/recipes and note component within /api/objects/shopping_lists/ of Grocy <= 4.0.3 allows attackers to obtain the victim's cookies. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/grocy/grocy - https://nitipoom-jar.github.io/CVE-2023-48866/ - https://nitipoom-jaroonchaipipat.github.io/security-research-portal/2023-48866
CVE ID: CVE-2023-48880 State: PUBLISHED Published: 2023-11-29T00:00:00 Last Updated: 2024-11-26T19:30:29.139Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Menu Name field at /login.php?m=admin&c=Index&a=changeTableVal&_ajax=1&lang=cn. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/weng-xianhu/eyoucms/issues/52
CVE ID: CVE-2023-48881 State: PUBLISHED Published: 2023-11-29T00:00:00 Last Updated: 2024-08-02T21:46:28.856Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Field Title field at /login.php?m=admin&c=Field&a=arctype_add&_ajax=1&lang=cn. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/weng-xianhu/eyoucms/issues/53
CVE ID: CVE-2023-48882 State: PUBLISHED Published: 2023-11-29T00:00:00 Last Updated: 2024-08-02T21:46:28.420Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Document Properties field at /login.php m=admin&c=Index&a=changeTableVal&_ajax=1&lang=cn. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/weng-xianhu/eyoucms/issues/54
CVE ID: CVE-2023-48886 State: PUBLISHED Published: 2023-12-01T00:00:00 Last Updated: 2024-10-10T20:17:55.615Z Vendors: n/a Products: n/a Problem Types: n/a Description: A deserialization vulnerability in NettyRpc v1.2 allows attackers to execute arbitrary commands via sending a crafted RPC request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/luxiaoxun/NettyRpc - https://github.com/luxiaoxun/NettyRpc/issues/53
CVE ID: CVE-2023-48887 State: PUBLISHED Published: 2023-12-01T00:00:00 Last Updated: 2024-08-02T21:46:28.899Z Vendors: n/a Products: n/a Problem Types: n/a Description: A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/fengjiachun/Jupiter - https://github.com/welk1n/JNDI-Injection-Exploit/releases/tag/v1.0 - https://github.com/fengjiachun/Jupiter/issues/115
CVE ID: CVE-2023-48893 State: PUBLISHED Published: 2023-12-01T00:00:00 Last Updated: 2024-08-02T21:46:28.892Z Vendors: n/a Products: n/a Problem Types: n/a Description: SLiMS (aka SENAYAN Library Management System) through 9.6.1 allows admin/modules/reporting/customs/staff_act.php SQL Injection via startDate or untilDate. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/slims/slims9_bulian/issues/209 - https://github.com/Vuln0wned/slims_owned/blob/main/slims/slims9-bulian-9.6.1-SQLI-staff_act.md
CVE ID: CVE-2023-48894 State: PUBLISHED Published: 2023-11-30T00:00:00 Last Updated: 2024-08-02T21:46:28.422Z Vendors: n/a Products: n/a Problem Types: n/a Description: Incorrect Access Control vulnerability in jshERP V3.3 allows attackers to obtain sensitive information via the doFilter function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jishenghua/jshERP/issues/98
CVE ID: CVE-2023-48901 State: PUBLISHED Published: 2024-03-21T00:00:00 Last Updated: 2024-08-06T16:32:49.376Z Vendors: n/a Products: n/a Problem Types: n/a Description: A SQL injection vulnerability in tramyardg Autoexpress version 1.3.0, allows remote unauthenticated attackers to execute arbitrary SQL commands via the parameter "id" within the getPhotosByCarId function call in details.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://packetstormsecurity.com/files/177660/Tramyardg-Autoexpress-1.3.0-SQL-Injection.html
CVE ID: CVE-2023-48902 State: PUBLISHED Published: 2024-03-21T00:00:00 Last Updated: 2024-08-08T18:54:59.386Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in tramyardg autoexpress version 1.3.0, allows unauthenticated remote attackers to escalate privileges, update car data, delete vehicles, and upload car images via authentication bypass in uploadCarImages.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://packetstormsecurity.com/files/177661/Tramyardg-Autoexpress-1.3.0-Authentication-Bypass.html
CVE ID: CVE-2023-48903 State: PUBLISHED Published: 2024-03-21T00:00:00 Last Updated: 2024-08-05T14:11:42.871Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stored Cross-Site Scripting (XSS) vulnerability in tramyardg autoexpress 1.3.0, allows remote unauthenticated attackers to inject arbitrary web script or HTML within parameter "imgType" via in uploadCarImages.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://packetstormsecurity.com/files/177662/Tramyardg-Autoexpress-1.3.0-Cross-Site-Scripting.html
CVE ID: CVE-2023-48906 State: PUBLISHED Published: 2024-04-01T00:00:00.000Z Last Updated: 2025-03-28T19:27:33.878Z Vendors: n/a Products: n/a Problem Types: n/a Description: Stack Overflow vulnerability in Btstack 1.6 and earlier allows attackers to cause a denial of service via crafted input to the char_for_nibble function. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cnblogs.com/focu5/p/18070469
CVE ID: CVE-2023-48909 State: PUBLISHED Published: 2024-01-12T00:00:00.000Z Last Updated: 2025-06-06T17:44:31.548Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Jave2 version 3.3.1, allows attackers to execute arbitrary code via the FFmpeg function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Dollhouse-18/jave-core-Command-execution-vulnerability - https://gist.github.com/Dollhouse-18/288b4774bc296722c9e3c60bafa392bf
CVE ID: CVE-2023-48910 State: PUBLISHED Published: 2023-12-04T00:00:00 Last Updated: 2024-10-15T17:40:06.430Z Vendors: n/a Products: n/a Problem Types: n/a Description: Microcks up to 1.17.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /jobs and /artifact/download. This vulnerability allows attackers to access network resources and sensitive information via a crafted GET request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/microcks/microcks - https://github.com/orgs/microcks/discussions/892 - https://gist.github.com/b33t1e/2a2dc17cf36cd741b2c99425c892d826
CVE ID: CVE-2023-48912 State: PUBLISHED Published: 2023-11-30T00:00:00 Last Updated: 2024-11-26T19:29:15.538Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/edit. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Tiamat-ron/cms/blob/main/There%20is%20a%20csrf%20in%20the%20article%20management%20modification%20section.md
CVE ID: CVE-2023-48913 State: PUBLISHED Published: 2023-11-30T00:00:00 Last Updated: 2024-08-02T21:46:28.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/delete. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Tiamat-ron/cms/blob/main/The%20deletion%20function%20of%20the%20Article%20Management%20Office%20exists%20in%20CSRF.md
CVE ID: CVE-2023-48914 State: PUBLISHED Published: 2023-11-30T00:00:00 Last Updated: 2024-08-02T21:46:28.510Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/add. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Tiamat-ron/cms/blob/main/There%20is%20a%20csrf%20in%20the%20newly%20added%20section%20of%20article%20management.md
CVE ID: CVE-2023-48925 State: PUBLISHED Published: 2023-12-14T00:00:00 Last Updated: 2024-08-02T21:46:28.613Z Vendors: n/a Products: n/a Problem Types: n/a Description: SQL injection vulnerability in Buy Addons bavideotab before version 1.0.6, allows attackers to escalate privileges and obtain sensitive information via the component BaVideoTabSaveVideoModuleFrontController::run(). Additional Analyst Notes: - CVE Program Container: References: - https://security.friendsofpresta.org/modules/2023/12/07/bavideotab.html
CVE ID: CVE-2023-48926 State: PUBLISHED Published: 2024-01-16T00:00:00.000Z Last Updated: 2025-06-02T15:12:29.549Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in 202 ecommerce Advanced Loyalty Program: Loyalty Points before v2.3.4 for PrestaShop allows unauthenticated attackers to arbitrarily change an order status. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/202ecommerce/security-advisories/security/advisories/GHSA-jp2c-mj65-qpmw
CVE ID: CVE-2023-48928 State: PUBLISHED Published: 2023-12-08T00:00:00.000Z Last Updated: 2025-05-27T15:30:29.681Z Vendors: n/a Products: n/a Problem Types: n/a Description: Franklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to Open Redirect. The 'path' parameter of the prefs.asp resource allows an attacker to redirect a victim user to an arbitrary web site using a crafted URL. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/MatJosephs/CVEs/tree/main/CVE-2023-48928
CVE ID: CVE-2023-48929 State: PUBLISHED Published: 2023-12-08T00:00:00 Last Updated: 2024-08-02T21:46:29.186Z Vendors: n/a Products: n/a Problem Types: n/a Description: Franklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to Session Fixation. The 'sid' parameter in the group_status.asp resource allows an attacker to escalate privileges and obtain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/MatJosephs/CVEs/tree/main/CVE-2023-48929
CVE ID: CVE-2023-48930 State: PUBLISHED Published: 2023-12-06T00:00:00 Last Updated: 2024-11-26T19:05:45.972Z Vendors: n/a Products: n/a Problem Types: n/a Description: xinhu xinhuoa 2.2.1 contains a File upload vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Maverickfir/Vulnerability-recurrence/blob/main/xinhuOA.md - https://github.com/Maverickfir/xinhuOA2.2.1 - https://gist.github.com/Maverickfir/b8113bdb51ec66e454ffa5b50674c446
CVE ID: CVE-2023-48938 State: REJECTED Published: N/A Last Updated: 2024-04-23T21:52:19.827066 Description: No description available.
CVE ID: CVE-2023-48939 State: REJECTED Published: N/A Last Updated: 2024-04-23T21:59:25.074406 Description: No description available.